We speak with Craig Ford who has over 20+ year ICT and Cyber professional with experience in all three Blue team, Red team and Purple teams across my career with more recently senior consulting and CISO engagements. He is the Head Unicorn (Cofounder and Director) for Cyber Unicorns. Cyber Unicorns is a cyber security consultancy with a big difference; we are on a mission to educate everyday people on how to be safer in this online world we all live in. Yes, we offer the usual cyber security consulting such as vCISO, cyber security strategy and maturity uplift but we do it all with education in mind. People are the key to improving cyber security safety around the world. He is Australia’s best-selling author of three different book series with a total of six books with more in the works. These series are A Hacker I Am, Foresight and The Shadow World.Cyber Security Asia 2024 took place on 7 – 8 October 2024 at ParkRoyal Hotel, Kuala Lumpur – bringing together top experts and practitioners for in-depth talks, and exclusive networking opportunities. It is a platform for the development of partnerships and strategies and highlights the latest technologies that are ensuring the safety and security of government, industry and individual.#csa2024 #mysecuritytv #cyberunicorns

We speak with Anita Jacobson, Managing Director and Marina Yahya, Business Advisor at Alpine Integrated Solution Sdn Bhd in the lead up to the Top Women in Security ASEAN Region Awards 2024, Malaysia Awards Dinner.The Inaugural Asia International Security Summit & Expo (AISSE) 2024 at the Putrajaya International Convention Centre (PICC) will be held from 20th to 22nd January 2025.AISSE 2025 is rapidly shaping up to become one of the world's most vital internal security events. It is hosted by the Ministry of Home Affairs and Royal Malaysia Police, and is jointly organised by Alpine Integrated Solution Sdn Bhd and Royal Malaysian Police Cooperative Limited.AISSE is designed as a vital rendezvous point for law enforcement, security, and policing bodies to engage, network and exchange intelligence and expertise and at the same time synergise with security experts, technicians and strategists.In addition to a high-tech showcase of the latest advanced technological solutions for law enforcement, security and policing, AISSE will feature the first-ever ASEAN+ Security High Roundtable Meeting 2025, comprising approximately 100 high-level delegates, including Ministers of Home Affairs, Internal Security, Interior and Chiefs of Police. These distinguished delegates and their entourage will also be programmed to visit booths of security companies, engage in networking sessions, and attend bilateral meetings.Besides these Foreign VIP delegations, the event will naturally attract the entire ‘who's who’ from all relevant Ministries, Agencies and Bodies of the Malaysian Government, who will be in attendance throughout the three-day event.The Inaugural Cybercrime Prevention Summit will also be held in conjunction with AISSE, in collaboration with the National Cyber Security Agency of Malaysia (NACSA). Another notable element of AISSE is that there will be approximately 30 forum sessions which will be run over the three-day period covering all areas of internal security and policing. For more information on Asia's Premium Security Showcase, AISSE 2025, please visit www.aisse.myFor the Women in Security ASEAN Region Awards visit https://womeninsecurityaseanregion.com/#topwomeninsecurityasean #mysecuritytv

In response to new questions asked by the annual study, sponsored by Adobe—which showcases the feedback of more than 1,800 global cybersecurity professionals on topics related to the cybersecurity workforce and threat landscape—security teams in Oceania noted they are primarily using AI for:Automating threat detection/response (36 percent vs 28 percent globally)Endpoint security (33 percent vs 27 percent globally)Automating routine security tasks (22 percent vs 24 percent globally)Fraud detection (6 percent vs 13 percent globally)Sixty-four percent of cybersecurity professionals in Australia say their role is more stressful now than it was five years ago, according to the newly released 2024 State of Cybersecurity survey report from ISACA, a global professional association advancing trust in technology. The annual study, sponsored by Adobe, showcases the feedback of more than 1,800 cybersecurity professionals globally on topics related to the cybersecurity workforce and threat landscape. According to the data, Australian cybersecurity professionals are feeling the stress at slightly higher rates than their global peers for reasons including: An increasingly complex threat landscape (85 percent vs 81 percent globally) Low budget (48 percent vs 45 percent globally) Worsening hiring/retention challenges (50 percent vs 45 percent globally) Lack of prioritisation of cybersecurity risks (35 percent vs 34 percent globally) Global cybersecurity professionals are feeling the strain of insufficiently trained staff at a higher rate than in Australia, at 45 percent compared to 37 percent locally. We speak with ISACA's Jon Brandt, Jenai Marinkovic and Jo Stewart-Rattray on the outcomes of the latest report.Read more: https://australiancybersecuritymagazine.com.au/isaca-research-reveals-cyber-professionals-are-feeling-the-strain/Get a copy of the report here: https://www.isaca.org/resources/reports/state-of-cybersecurity-2024

We had the privilege of speaking with Steven Sim, Chair of the OT-ISAC Executive Committee, during the recent summit in Singapore. As a seasoned expert in operational technology (OT) cybersecurity, Sim shared valuable insights into the importance of information sharing, the growing threat of ransomware, and the transformative role of AI in cybersecurity.Kicking off the podcast, Steven introduced the Executive Committee and its pivotal role in driving OT-ISAC’s mission to foster a collaborative community and promote best practices. By providing advisory support and strategic guidance, the committee ensures OT-ISAC stays at the forefront of cybersecurity initiatives.Balancing Information Sharing and ConfidentialityOne of the most pressing challenges in OT cybersecurity is striking the right balance between information sharing and safeguarding sensitive data. He explained that OT-ISAC has implemented robust measures, such as the Traffic Light Protocol and data anonymization techniques, to protect confidentiality while promoting collaboration. The platform also employs protocols like STIX and TAXII to automate the exchange of cyber threat intelligence, enabling members to quickly share and respond to emerging threats.Cross-Jurisdictional CollaborationWith cyber threats spanning borders, cross-jurisdictional collaboration is essential. Sim highlighted that OT-ISAC allows members to share threat intelligence across different regions without breaching data sovereignty regulations by anonymizing the information sources. This approach strengthens global defenses against transnational cyberattacks.The Growing Threat of RansomwareRansomware remains a significant risk to OT environments. Steven urged organizations to avoid paying ransoms, citing the risks and long-term consequences. Instead, he emphasized the importance of investing in strong business continuity and incident response plans. By focusing on resilience and preparedness, organizations can minimize their exposure to future attacks.AI’s Role in OT CybersecurityHe also discussed the potential of AI in OT cybersecurity, noting its ability to streamline incident response and improve threat detection. However, he cautioned that while AI offers powerful advantages, it must be implemented with human oversight to manage the risks associated with automated systems.Steven Sim has worked for more than 25 years in the cybersecurity field with large end-user enterprises and critical infrastructures, undertaken global CISO role, driven award-winning CSO50 security governance and management initiatives and headed incident response, security architecture, technology, awareness and operations at local, regional and global levels. He leads cybersecurity across large MNC, heading 8 direct reports at Group Cybersecurity Department as well as indirect reports across regional offices and local business units in 42 countries. He oversees both IT and OT Security Governance, Global Cybersecurity Technology Management and Incident Response as well as Cyber Security Masterplan Office. Always keen to give back to the community, he also volunteers at the ISACA Singapore Chapter (which won ISACA Global Outstanding Chapter Achievement in 2022) as the President (from 2021 to 2022) and OT-ISAC (since 2021), the second key thrust of the SG's OT Cybersecurity Masterplan 2019, as Chair Executive Committee, as well as member of Geneva Dialogue Technical Community, and holds Masters in Computing, CCISO, CGEIT, CRISC, CISM, CISA, CDPSE, CISSP as well as technical certifications GICSP, GREM, GCIH and GPPA. Recorded 5th Sept 2.30pm. Singapore Operational Technology Information Sharing and Analysis Summit 2024#otcybersecurity #mysecuritytv #cybersecurity #singaporecybersecurity

We sat down with Cassie Crosley to explore the complexities of supply chain risks, particularly within the realm of operational technology (OT).Comprehensive Supply Chain Security - Crosley detailed the various stages in the supply chain—design, development, and fabrication—where both deliberate and accidental abuses can occur. Each stage presents unique risks, such as compromised design specifications, development flaws, or issues during fabrication. She emphasized that securing the software supply chain requires a holistic approach that goes beyond protecting just software; it must also include firmware and hardware. For example, when working with an Intel chip, securing both the software and firmware associated with that chip is critical. Firmware, which operates at a low level on hardware, is vital for overall system security. Any vulnerabilities in firmware can significantly compromise the entire system, making it essential to secure it alongside software and hardware.Challenges in Secure by Design - Crosley also noted that while "secure by design" principles often originate from an IT perspective, they may not seamlessly translate to OT environments. This disparity creates challenges, as certain IT security measures, like multi-factor authentication (MFA), may not be practical or necessary in OT due to specific operational needs. Additionally, OT devices are often multi-generational, increasing the risk of outdated security designs. OT systems, such as programmable logic controllers (PLCs) used in industrial settings, have distinct requirements and constraints, necessitating tailored security approaches.Automated Patching Issues - Crosley highlighted that automated patching in OT environments can pose safety concerns and lead to downtime. Unlike IT systems where automated updates are common, OT systems often require careful, manual handling to avoid disrupting critical processes. Automated patching can interfere with vital safety mechanisms, underscoring the need for controlled and deliberate update management.SBOM (Software Bills of Materials) - Crosley pointed out that while generating accurate Software Bills of Materials (SBOMs) for modern technologies is relatively straightforward, it becomes more complex for multi-generational OT products due to outdated build practices and the limitations of current scanning tools. While scanners effectively identify open-source components, they struggle with proprietary or commercial libraries, and discrepancies in version identification can be problematic, particularly if certain versions have known vulnerabilities.Role of AI in Software Development – She also pointed out how AI can quickly analyze vast amounts of data, identifying risks and correlations between projects that would take humans much longer to detect. For example, AI can track a maintainer's contributions across multiple projects to spot potential security risks, such as involvement in both malicious and non-malicious projects. AI is also increasingly offering developers precise guidance on addressing specific vulnerabilities. Instead of generic suggestions, AI now recommends the best code modifications for a given context, speeding up development and enhancing code security.Supplier Assessment - Crosley advised that supplier assessments should focus on specific aspects of vulnerability management and product security rather than generic compliance questions. It's crucial to inquire about suppliers' vulnerability management practices and their methods for ensuring product security. She emphasized the importance of transparency from suppliers regarding their manufacturing processes, product variations, and supply chain details, advocating for detailed questions to effectively understand and mitigate risks.Positive Cultural Shift - Crosley shared an encouraging trend where companies are increasingly prioritizing supply chain security. A notable example is a supplier that created a position for a Product Security Officer after facing rigorous scrutiny, reflecting a positive shift towards more robust supply chain security practices.Cassie Crossley, Vice President, Supply Chain Security in the global Cybersecurity & Product Security Office at Schneider Electric, is an experienced cybersecurity technology executive in Information Technology and Product Development and author of “Software Supply Chain Security: Securing the End-to-End Supply Chain for Software, Firmware, and Hardware”. She has many years of business and technical leadership experience in supply chain security, cybersecurity, product/application security, software/firmware development, program management, and data privacy. #mysecuritytv

We sat down with Tim Conway and Robert Lee, two leading cybersecurity experts, to discuss pressing issues in OT cybersecurity.CrowdStrike Lessons LearnedTim and Robert began by examining the CrowdStrike incident from July 2024. They highlighted the dangers of over-relying on trusted technology without sufficient testing and verification, and the importance of integrating resilience into systems and avoiding a one-size-fits-all security approach.Cyber Threat LandscapeRobert discussed the rise of sophisticated malware like Fuxnet, Frostygoop and Pipe Dream, designed to target OT systems. Fuxnet was a highly targeted attack aimed at disrupting critical infrastructure in Russia, while Frostygop used similar techniques against Ukraine. In contrast, Pipe Dream serves as a more versatile attack framework applicable to various OT systems. He underscored an important lesson: even if specific malware isn't reused, studying its tactics can improve our prevention, detection, and response strategies. The key takeaway: threats to OT environments are growing, with increasingly targeted efforts from a range of actors.Critical Control – ICS Network VisibilityTim and Robert addressed the challenges of gaining visibility into OT devices. Tim noted that OT environments are diverse and require more than a one-size-fits-all approach. Each environment has unique characteristics that must be considered. While attackers exploit both commonalities and specific features, defenders must balance the need for visibility with the risk of disrupting operations. Legacy systems without modern security features further complicate these efforts. Despite historical challenges in visibility due to limited capabilities and resistance to change, recent technological advances have improved the situation. However, new technologies, such as encryption, introduce additional complexities. A balanced approach, using critical controls as a framework, is essential for prioritizing security efforts and adapting to evolving needs.Critical Control – Incident Response PlanTim and Robert highlighted that many organizations lack specific incident response plans for OT, relying instead on general IT plans. Backup plans for power outages often do not address cyber attack scenarios. Effective OT incident response requires a tailored plan that includes data collection, safety procedures, and appropriate tools. In addition, maturity in incident response involves having a detailed, operationally integrated plan that addresses various scenarios, including handling outages and restoring systems without SCADA support. OT and IT ConvergenceTim and Robert discussed several crucial aspects of OT security. They noted that the increasing interconnection between IT and OT systems has elevated the risk of attacks transitioning from IT to OT environments. Additionally, remote access, often used for vendor support, presents a significant security threat.They emphasized the distinct characteristics of OT systems, which necessitate specialized security approaches. Treating OT and IT as identical can lead to dangerous oversimplifications and vulnerabilities. Therefore, security measures must be tailored to the specific needs of OT environments, considering their safety, physical constraints, and unique risks.Tim and Robert also touched on cyber-informed engineering. Key takeaways include recognizing common attack vectors from IT systems, implementing distinct security strategies for OT, and avoiding the assumption that OT and IT are the same. Tailoring security measures to the specific needs and constraints of OT environments is essential for effective protection.Celebrating WinsFinally, Tim and Robert highlighted the importance of celebrating cybersecurity successes, such as defending against VOLTZITE. Recognizing and celebrating these victories can boost morale and encourage teams to continue their efforts. Tim Conway, Senior Instructor, https://www.sans.org/profiles/tim-conway/Tim serves as the Technical Director of ICS and SCADA programs at SANS, and he is responsible for developing, reviewing, and implementing technical components of the SANS ICS and SCADA product offerings. A recognized leader in CIP operations, he formerly served as the Director of CIP Compliance and Operations Technology at Northern Indiana Public Service Company (NIPSCO), where he was responsible for Operations Technology, NERC CIP Compliance, and the NERC training environments for the operations departments within NIPSCO Electric.Robert M. Lee, Fellow, https://www.sans.org/profiles/robert-m-lee/ SANS fellow Robert M. Lee brings to the classroom one of the most valuable and respected of credentials: real-world experience. Robert is the CEO and founder of his own company, Dragos, Inc., that provides cyber security solutions for industrial control system networks. Further viewing; https://youtu.be/BiUpuRk6pvA?si=xQcx9oiJOxQu0n7H#mysecuritytv #otcybersecurity

This episode dives into OT Cybersecurity and discusses:SCADA, ICS & IIoT CybersecurityHow do we define an OT-related cyber incident?What are the leading standards and guidelines for managing OT Cybersecurity and resilience?Threat intelligence and suitable ISAC modelsVendor platform insights and cyber maturity landscapeSpeakers include:Daniel Ehrenreich, Secure Communications and Control ExpertsLesley Carhart, Director of Incident Response - DragosIlan Barda, Founder - RadiflowRahul Thakkar, Team Lead, System Engineering, ANZ, ForescoutDean Frye, Solutions Architect ANZ, Nozomi NetworksTo visit and subscribe to the full series visit https://mysecuritymarketplace.com/security-risk-professional-insight-series/#mysecuritytv #otcybersecurityFurther reading:https://mysecuritymarketplace.com/reports/your-guide-to-nis2-compliance/ https://www.forescout.com/research-labs/ot-iot-routers-in-the-software-supply-chain/https://cyberriskleaders.com/critical-infrastructure-organisations-remain-poorly-prepared-against-cyber-attacks/

In March 2024, the Australian Senate resolved that the Select Committee on Adopting Artificial Intelligence (AI) be established to inquire into and report on the opportunities and impacts for Australia arising out of the uptake of AI technologies in Australia. The committee intends to report to the Parliament on or before 19 September 2024.More than 40 Australian AI experts made a joint submission to the Inquiry. The submission from Australians for AI Safety calls for the creation of an AI Safety Institute. “Australia has yet to position itself to learn from and contribute to growing global efforts. To achieve the economic and social benefits that AI promises, we need to be active in global action to ensure the safety of AI systems that approach or surpass human-level capabilities.” “Too often, lessons are learned only after something goes wrong. With AI systems that might approach or surpass human-level capabilities, we cannot afford for that to be the case.”This session has gathered experts and specialists in their field to discuss best practice alignment of AI applications and utilisation to safety and cybersecurity requirements. This includes quantum computing which is set to revolutionise sustainability, cybersecurity, ML, AI and many optimisation problems that classic computers can never imagine. In addition, we will also get briefed on: OWASP Top 10 for Large Language Model Applications; shedding light on the specific vulnerabilities LLMs face, including real world examples and detailed exploration of five key threats addressed using prompts and responses from LLMs; Prompt injection, insecure output handling, model denial of service, sensitive information disclosure, and model theft; How traditional cybersecurity methodologies can be applied to defend LLMs effectively; and How organisations can stay ahead of potential risks and ensure the security of their LLM-based applications.PanelistsDr Mahendra SamarawickramaDirector | Centre for Sustainable AIDr Mahendra Samarawickrama (GAICD, MBA, SMIEEE, ACS(CP)) is a leader in driving the convergence of Metaverse, AI, and Blockchain to revolutionize the future of customer experience and brand identity. He is the Australian ICT Professional of the Year 2022 and a director of The Centre for Sustainable AI and Meta61. He is an Advisory Council Member of Harvard Business Review (HBR), a Committee Member of the IEEE AI Standards, an Expert in AI ethics and governance at the Global AI Ethics Institute (GAIEI), a member of the European AI Alliance, a senior member of IEEE (SMIEEE), an industry Mentor in the UNSW business school, an honorary visiting scholar at the University of Technology Sydney (UTS), and a graduate member of the Australian Institute of Company Directors (GAICD).Ser Yoong GohHead of Compliance | ADVANCE.AI | ISACA Emerging Trends Working GroupSer Yoong is a seasoned technology professional who has held various roles with multinational corporations, consulting and also SMEs from various industries. He is recognised as a subject matter expert in the areas of cybersecurity, audit, risk and compliance from his working experience, having held various certifications and was also recognised as one of the Top 30 CSOs in 2021 from IDG. Shannon DavisPrincipal Security Strategist | Splunk SURGeShannon hails from Melbourne, Australia. Originally from Seattle, Washington, he has worked in a number of roles: a video game tester at Nintendo (Yoshi’s Island broke his spirit), a hardware tester at Microsoft (handhelds have come a long way since then), a Windows NT admin for an early security startup and one of the first Internet broadcast companies, along with security roles for companies including Juniper and Cisco. Shannon enjoys getting outdoors for hikes and traveling.Greg SadlerCEO | Good Ancestors PolicyGreg Sadler is also CEO of Good Ancestors Policy, a charity that develops and advocates for Australian-specific policies aimed at solving this century’s most challenging problems. Greg coordinates Australians for AI Safety and focuses on how Australia can help make frontier AI systems safe. Greg is on the board of a range of charities, including the Alliance to Feed the Earth in Disasters and Effective Altruism Australia. Lana TikhomirovPhD Candidate, Australian Institute for Machine Learning, University of AdelaideLana is a PhD Candidate in AI safety for human decision-making, focussed on medical AI. She has a background in cognitive science and uses bioethics and knowledge about algorithms to understand how to approach AI for high-risk human decisionsChris CubbageDirector - MYSECURITY MEDIA | MODERATORFor more information and the full series visit https://mysecuritymarketplace.com/security-risk-professional-insight-series/

In this interview, we sat down with Greg Smith (Head of Global Product and Solution Marketing, Certinia) to get his insights into the stages of data maturity within the AI adoption journey.Greg advices that a key distinction in the nature of data handling between generative and predictive AI. Unlike predictive AI, which primarily analyzes existing data, generative AI creates new data from existing information. This fundamental shift necessitates a robust data strategy aligned with AI objectives to maximize the technology's potential.The maturity model outlines a progression from fragmented data usage to a sophisticated, integrated approach. Organizations initially leverage external data for efficiency gains, but internal data becomes crucial for deeper insights and influencing business metrics. As AI adoption matures, a focus on closed-loop systems emerges, where predictions are continuously refined based on real-world outcomes. This journey involves both technological and cultural transformations, with early stages emphasizing technology and later stages prioritizing cultural changes such as data governance and AI skill development.The ultimate goal is to transition from efficiency gains to improved decision-making and scaled impact. ---- Greg Smith, Head of Global Product and Solution Marketing, Certinia.A primary focus of Greg’s is to help services organizations of any size run a more efficient, profitable, and data-driven services organization.---- Recorded at SuperAI Singapore, 6th June 2024, 2.30pm. #mysecuritytv #ai #certinia #superai

Prior to Joining Seaco as CIO, Damian Leach held the position of Chief Technology Officer for Workday Asia Pacific and Japan. Prior to his CTO position at Workday Damian spent 13 years in the Banking and Finance industry in Global Technology roles, most recently working for Standard Chartered Bank based in Singapore. Damian led the Digital Transformation program for the Bank to move to the cloud and pioneered Voice Biometric technologies for the retail Banking customers. Prior to coming to Asia, Damian spent many years managing professional services teams to develop core banking interactive technology systems in Europe. Damian is a certified AI professional having studied AI Bias and Governance at NTU and also completed an EMBA in Business Administration focused on Asian Leadership and Entrepreneurship with overseas segments in Wharton Penn university and UC Berkley HaaS. In his spare time Damian coaches, mentors, and is a panelist on startups / innovation contest across Asia. --- In this interview, Damian shares the highlights of how Seaco, a global company HQ in Singapore leverages a network of shipping ports and depots and has over 3million TEUs in circulation. The Seaco IT team in partnership with the business are running a series of experiments with AI and Big data to help it adapt to stay ahead of the curve. While there is a lot of hype surrounding AI, Damian emphasizes the importance of understanding the core business problems before jumping to technology solutions. He introduced the ACE framework (Analytics, Conversational, and Experience) which can help pinpoint the most relevant business cases for AI adoption. For instance, at Seaco, they evaluated 30 potential use cases and narrowed it down to 3 that deliver the biggest boost to productivity and revenue.However, successful AI adoption goes beyond technology. Damian highlights the importance of employee and stakeholder buy-in. This means addressing fears of job displacement and showcasing how AI can actually enhance productivity. For example, he explains how success stories from pilot projects can pave the way for realizing the technology's full impact. He also emphasizes fostering a culture of "psychological safety" where employees feel comfortable experimenting with new technologies. Looking to the future, he acknowledged that AI presents both opportunities and challenges for business leaders. As such, it’s essential to have a clear vision and strategy in place, along with a commitment to ongoing learning and development for his employees.Recorded 29th May 2024, ATxSG Singapore Expo, 12.30pm.

In this interview at SINCON 2024, Dr. Joshua James, a Regional Counter Cyber Crime Coordinator for the United Nations Office on Drugs and Crime (UNODC), shared his insights on the Regional Counter-cybercrime programme at UNODC.Dr. James argued that while law enforcement agencies are getting better at responding to cybercrime, the cyber criminals are also getting better at what they do. This is because cybercrime is a business for them, and they invest heavily in security measures to protect their operations.He believes that the key to defeating cybercrime is for governments to see their citizens as assets rather than liabilities. If people are viewed as assets, then more will be invested in educating them and giving them the tools they need to protect themselves online.He also said that international cooperation is essential in the fight against cybercrime. The current system for international cooperation, called mutual legal assistance, was created before the internet and is not effective for cybercrime. New tools and methods for international cooperation are needed.In conclusion, Dr. James said that he is confident that cybercrime can be defeated, but it will take a lot of work from governments and citizens alike.Recorded 23rd May 2024, 10.30am, SINCON 2024, Singapore.Dr. Joshua James is the United Nations Office on Drugs and Crime (UNODC) Regional Counter-Cybercrime for Southeast Asia and the Pacific, based in Bangkok, Thailand. He and his team implement counter-cybercrime programme in the region through capacity building and awareness programmes at all levels of government. He has worked as a seconded researcher with the Irish Police Computer Crimes Investigation Unit, INTERPOL’s Financial and High-Tech Crime Unit, and the Korean National Police. He has also worked closely with public and private sector groups to raise awareness about cybersecurity and cybercrime issues. He completed his Bachelor’s degree in Network Security from Purdue University, and his PhD in Computer Science with a focus on automating human inference in investigations from University College Dublin.#mysecuritytv #unodc #cybercrime

In this interview, we speak with Mac Munsayac, Head of Customer Experience at Philippine Airlines, to explore the transformative role of AI in the aviation industry. Mac elaborates on the integration of generative AI and tools to enhance customer interactions by providing personalized, proactive, and frictionless experiences, especially in scenarios involving flight disruptions and service-related concerns.He underscores the significance of recognizing AI's limitations and stresses the necessity of human intervention in high-risk tasks to ensure accuracy and reliability. Training employees effectively and maintaining ongoing communication are crucial to successfully implementing AI. Mark highlights that starting with high-volume, less complex pain areas allows for immediate impact and smoother adoption.Using the example of checking flight statuses—a high-volume but straightforward task—he illustrates how AI can significantly reduce customer queries and improve service efficiency. This approach serves as a training ground, gradually extending AI's application to more complex scenarios. Mark also touches on the importance of defining clear metrics for operational efficiency, customer experience, and cost savings to measure AI's success.Ultimately, he advises organizations to adopt a phased approach, beginning with manageable tasks to build trust and progressively enhancing AI capabilities. This ensures that AI is leveraged effectively to improve customer experiences and operational efficiency while managing risks and expectations realistically.Mac Munsayac, Head of Customer Experience, Philippine Airlines: A dynamic leader with 20 years of diverse leadership experience spanning global finance, business process outsourcing, and aviation. Currently serving as the head of PAL Customer Experience, he excels in fostering innovation, problem-solving, and maximizing organizational performance. In this capacity, he oversees initiatives aimed at enhancing passenger satisfaction, streamlining services, and elevating the overall customer journey. Beyond his professional pursuits, Mac is an avid traveler, deeply passionate about immersing himself in diverse cultures and experiences.Recorded 8 May 2024, 3pm, World Tour Essentials Asia 2024, Singapore Marina Bay Sands Convention Centre #mysecuritytv

As Vice President and CTO, Solutions, for Salesforce ASEAN, Gavin Barfield leads a team of Salesforce engineers across the region to develop and drive integrated technology solutions for Salesforce customers. Gavin works closely with customers in ASEAN on their digital transformations, bringing together the full value of the Salesforce platform to drive positive business outcomes. A seasoned IT veteran with over 20 years of experience, Gavin has a deep technology background in areas like IT infrastructure, enterprise architecture, cybersecurity, and program management for a variety of industries. Prior to joining Salesforce, he has held C-level positions managing IT and transformation for some of Southeast Asia’s largest companies, such as Ayala Corporation and Meralco. Gavin also brings many years of experience in management consulting into his work for customers.Gavin has a passion for emerging technologies and he regularly speaks at international conferences and other forums on the future of disruptive technologies and how they affect people and work.- In this interview, Gavin discusses how, to drive AI adoption and reap the benefits of AI, businesses need accurate, complete data and humans in the driver’s seat. He highlights several key points:• Trust and Value Gaps: Two main barriers to AI adoption are the trust gap and the value gap. Trust in generative AI is essential, as companies need to ensure that AI outputs are accurate, unbiased, and secure.• Human at the Helm: Gavin emphasizes the importance of having humans oversee AI operations. AI should complement human work by enhancing capabilities while maintaining transparency and trust with customers.• Quality Data: AI systems need to be grounded in high-quality, trusted data. Many companies struggle with AI outputs due to a lack of trust in the data used to train these models.• Use Case Awareness: Understanding the appropriate use cases for AI is crucial. Companies need to educate employees and align AI implementations with specific business problems to maximize benefits.• Governance and Training: Effective governance and training are necessary to build trust in AI. Organizations should focus on data accuracy, transparency, and the role of AI as a supportive tool, not a replacement for humans.• Security and Privacy: Protecting customer and company data is paramount. Salesforce has implemented a trust layer that masks personal information, uses secure gateways, and ensures data is not retained by large language models (LLMs).• Future of AI: Gavin anticipates that within a year, the AI landscape will evolve with more specialized LLMs tailored to specific industries and regions. Trust, security, and embedding AI into everyday workflows will remain critical factors for successful AI adoption. Recorded 8th May 2024, 12noon, Singapore Marina Bay, Salesforce World Tour Essentials 2024 Singapore

In this interview at Black Hat Asia 2024, we spoke with Adrian Wood and Mary Walker, security engineers from Dropbox, about the critical issues surrounding AI security, backdoors, and malware.Adrian and Mary explained that many users rely on pre-existing machine learning (ML) models from public repositories rather than creating their own. This introduces vulnerabilities similar to those found in open-source software. Using in-house data requires careful handling to avoid bias and unintended consequences, while third-party models can be compromised.They emphasized that downloading and running models from the internet can introduce malware. Attackers can backdoor models to alter their functions or insert malicious code, posing significant threats, especially in sensitive industries.Adrian and Mary also stressed the importance of understanding the ML environment, ensuring proper logging, and having incident response plans in place. Companies should prepare by conducting tabletop exercises and securing their supply chains.For more educational information on machine learning: https://gist.github.com/5stars217/236bab5d1d8d50e9785a4136aca8cf20 --------Dropbox, Security Engineer - Adrian Wood, aka threlfall, currently works for Dropbox on their red team. He has worked as a red team consultant for WHITEHACK, a company he founded, and later as a lead engineer for an offensive security research team at a US bank. His research recently has been in supply chain attacks on CI/CD and ML systems, which includes maintaining the offsec ml playbook and has presented on these topics at DEFCON 30, 31, the DEFCON AI village, Cackalackycon and more.Dropbox, Security Engineer - Mary Walker, aka mairebear, currently works for Dropbox on their threat intelligence team; she splits her time at work between research (primarily focused on ML) and building tooling to help her team move faster. She's previously worked at a major online retailer on their malware analysis and forensics team, a US bank on their red team, and an energy company in their SOC. Her background is primarily in DFIR and malware analysis, with a keen interest in production environments.Recorded 18th April 2024, 4.30pm, BlackHat Asia 2024, Singapore #BHAsia #mysecuritytv #blackhat

Now in its fourth year we'll be starting this year's series at a heightened time of risk and significant activity across the security domain - the opening episodes will be discussing how these events impact private security and emergency services and what may be the broader requirements and implications. To open the series, which will run regular episodes of live webinars, pre-recorded interviews and in-person events, we wanted to open with the current state of play – regional conflicts in the Middle East and Europe with a steadily growing risk of an Indo-Pacific conflict and how this will and may impact on the private security and emergency management sector. In this episode we're joined by:Paul Riley, Director, Foreign Risk at Curtin University Bryan de Caries, CEO, Australian Security Industry AssociationDr Shannon Ford, Faculty of Humanties, Curtin UniversityProf Sissel Jore, visiting Professor with Edith Cowan UniversityWebinar title: Requirements and implications on the private security sector in a phase of multi-region conflict• Implications of war (and pre-war) in the Indo-Pacific and impacts on the private security sector• Alignment and consistency of national security advice• Trust in information systems and delivery/interpretation• Current and required national response frameworks should war break out in the Indo-Pacific• Learning outcomes from the Pandemic – what went wrong and what needs to change?#mysecuritytv

Now in its fourth year we'll be starting this year's series at a heightened time of risk and significant activity across the security domain - the opening episodes will be discussing how these events impact private security and emergency services and what may be the broader requirements and implications. To open the series, which will run regular episodes of live webinars, pre-recorded interviews and in-person events, we wanted to open with the current state of play – regional conflicts in the Middle East and Europe with a steadily growing risk of an Indo-Pacific conflict and how this will and may impact on the private security and emergency management sector. In this episode we're joined by:• Dr Malcolm Davis, Senior Analyst, ASPI• Stephen Beaumont AM, Chair, Critical Infrastructure ISAC and• Gill Savage, Senior Fellow, ASPIWebinar title: Requirements and implications on the private security sector in a phase of multi-region conflict• Implications of war (and pre-war) in the Indo-Pacific and impacts on the private security sector• Alignment and consistency of national security advice• Trust in information systems and delivery/interpretation• Current and required national response frameworks should war break out in the Indo-Pacific• Learning outcomes from the Pandemic – what went wrong and what needs to change?#mysecuritytv

We speak with Alina Tan, Ethical Hacker and Security Architect based in Singapore.Alina is a former Top 30 Women in Cybersecurity Singapore (now the Top Women in Security ASEAN Region Awards).GISEC Global 2024 attracted more than 20,000 attendees from over 130 countries to the Dubai World Trade Center. Taking place over three days, April 23-25, the event provides a platform for more than 750 brands to showcase their innovations. #gisec #gisecglobal #mysecuritytv #womenincybersecurity #topwomeninsecurityASEAN

We speak with Col Francel Margareth Padilla-Taborlupa, Armed Forces of the Philippines Spokesperson.A C4S Officer with 27 years experience in Technology and Security, Francel is an International Lecturer, Moderator/Panelist and experienced Information Technology Professional with a demonstrated history of working in the Army Management Information Center catering to IS needs for the whole Armed Forces of the Philippines. Francel is a former Top Women in Security ASEAN Region Awards finalist and Judge.GISEC Global 2024 attracted more than 20,000 attendees from over 130 countries to the Dubai World Trade Center. Taking place over three days, April 23-25, the event provides a platform for more than 750 brands to showcase their innovations. #gisec #gisecglobal #mysecuritytv #topwomeninsecurityASEAN #womenincybersecurity

We speak with THNG, Chin Hwee, Vice President, Public Safety & Security, ST Engineering and NG Yeow Boon, Deputy Chief Executive (Development), HTX at the inaugural Milipol Asia-Pacific - TechX Summit (MAP-TXS) that took place from 3 to 5 April 2024 at Sands Expo & Convention Centre, Singapore. Co-organised by Singapore’s HTX, GIE Milipol, and Comexposium Singapore, the biennial event comes under the auspices of the Ministry of Home Affairs, Singapore and the Ministry of the Interior of France. Milipol Asia-Pacific’s trade exhibition will showcase the latest innovations in homeland security, and the TechX Summit will host prominent Government officials, industry leaders, and academia in a high-level conference. For more information visit https://innovd.stengg.com/spotlight/milipolap-2024?utm_campaign=map24-pss&utm_source=mysec&utm_medium=banner&utm_content=static#milipolap #milipol #mysecuritytv #stengineering

What are the strategic directions for AI in homeland security. Attending Milipol APAC and TechX Summit 2024, we speak with Physicist and former Yale University Professor, Dimitri Kusnezov, Under Secretary for S&T, US Department of Homeland Security.Nominated by President Biden in 2021, Dimitri Kusnezov was the deputy under secretary for artificial intelligence and technology at DoE (Energy), leading efforts to drive the use of AI and machine learning across the department’s core missions.Australia and the United States of America signed a treaty on cooperation in science and technology (S&T) for domestic security on 21 December 2005.Recorded 4 April, 2024 at the Sands Expo & Convention Centre, Singapore.#milipolap #mysecuritytv #DHS #homelandsecurity #ai #nationalsecurity #nationalsecurityscience

With the rapidly evolving challenges in global travel, trade, and security, we speak to Australian Border Force Commissioner, Michael Outram APM at the Milipol APAC and TechX Summit 2024 in Singapore. We discuss how border security been affected by technology and the current landscape, emerging threats, and the importance of fostering collaboration between government and industry to ensure border management has the cutting-edge technologies to ensure security and efficiency.Recorded 4 April 2024 at the Sands Expo & Convention Centre, Singapore.#milipolap #maptxs #mysecuritytv #policing #customs #nationalsecurity

Pentera is an automated pentesting platform. Validate every attack surface in your network, and test continuously to maintain control over your true security posture. Be proactive in fixing vulnerabilities, misconfigurations, leaked credentials, and privileges before they are exploited.We speak with Jannis Utz, VP Global Sales Engineering at Pentera and get insights into Pentera's capabilities and what will be on display at Booth B20, Hall 8 at GISEC Global 2024, 23-25 April at the Dubai World Trade Centre. #Pentera #gisecglobal #mysecuritytv

In this interview, Renen Hallak, Founder and CEO, Vast Data navigates the dynamic landscape of AI adoption and evolution, tracing its trajectory from the early days in 2016 to today’s diverse applications across various business sectors. Prior to founding VAST, Renen led the architecture and development of an all-flash array at XtremIO, from inception to over a billion dollars in revenue while acting as VP R&D and leading a team of over 200 engineers. He holds a BA and an MSc in Computer Science, both summa cum laude.Central to Renen's discourse is the pivotal role of data transformation in unlocking value within organizations in the AI era, and how businesses leverage vast unstructured data to derive valuable insights to gain a competitive edge. Renen also notes the challenges and opportunities presented by AI in terms of cybersecurity. He delves into the dual role of AI as both a potential vulnerability and a defense mechanism against cyber threats. Given the significance of scalable infrastructure in supporting the growing demands of AI-driven applications, Renen highlights platforms like Vast Data, which offer scalable solutions capable of handling vast amounts of data with high performance and minimal latency.Recorded 13 March 2024, 11am. Singapore Shangri La Hotel, Breakfast Session with VAST Data#mysecuritytv #AI #VastData

Headquartered in Singapore, ST Engineering is a global technology, defence and engineering group with customers and partners in more than 100 countries around world.We speak with Mr THNG Chin Hwee, Vice-President, Public Safety & Security Cluster, ST Engineering about the capabilities on display at Milipol APAC and a must see at Booth 1910.Find out more visithttps://innovd.stengg.com/spotlight/milipolap-2024/MySecurity Media will be coordinating a delegation at Milipol APAC 2024 - to find out more visit https://mysecuritymarketplace.com/event/milipol-asia-pacific/#stengineering #stengg #milipolapac #milipolap #mysecuritytv

Sharat Nautiyal, Director of Security Engineering, APJ, Vectra AI.Sharat has over 15 years of experience assisting organisations in the areas of security architecture, threat detection and threat hunting. He has a strong focus on leading security engineering, security architecture, and the sales engineering team across APJ.The global cybersecurity landscape is witnessing a concerning surge in threats, and is particularly pronounced in the Asia-Pacific region. With the imminent impact of AI-boosted cyberattacks, cybercriminal tactics like phishing and social engineering are evolving in sophistication. Moreover, the recent uptick in high-severity cyber incidents underscores the urgent need for organisations to bolster their defence strategies. The implementation of comprehensive cybersecurity protocols is paramount for businesses and organisations to effectively mitigate these evolving threats.Vectra AI, Inc. is the leader in hybrid attack detection, investigation and response. The Vectra AI Platform delivers integrated signal across public cloud, SaaS, identity, and data center networks in a single platform. Vectra AI’s patented Attack Signal Intelligence empowers security teams to rapidly detect, prioritize, investigate and stop the most advanced hybrid cyber-attacks. With 35 patents in AI-driven detection and the most vendor references in MITRE D3FEND, organizations worldwide rely on the Vectra AI Platform and MDR services to move at the speed and scale of hybrid attackers.Visit Booth 1810 at Milipol APAC 2024, 3 - 5 April at the Sands Expo & Convention Centre, Singapore.#milipol #vectra #mysecuritytv

We speak with Grant Wright, General Manager of Marketplace and AI Products, SEEK.Grant leads SEEK's global AI and Analytics teams at SEEK, who build and support the AI services that power SEEK's products including search, recommendations, candidate quality and pricing; and provide internal analytics and experimentation capability to better understand the performance of our products and drive continuous improvement and innovation. Grant brings to this role his previous experience as Strategy Director at SEEK. Prior to joining SEEK, Grant worked at L.E.K Consulting for over 10 years where he advised organisations and governments across Australia, New Zealand and the US on strategy, performance improvement and mergers and acquisitions. Grant holds a Bachelor of Business (Economics) & Bachelor of Computer and Information Science (Software Development) from the Auckland University of Technology, where he was awarded the New Zealand Computer Society Cup for the top Computer and Information Science Graduate. ----Generative AI, particularly ChatGPT, is transforming service delivery for clients and end-users, prompting businesses to actively integrate this technology for operational refinement. Grant shares anecdotes, such as using ChatGPT to craft children's bedtime stories. Acknowledging glimpses of success in applying generative AI to customer interactions, Grant highlights the challenges of scaling these applications. Ongoing efforts focus on optimizing technology for widespread use, particularly in customer service scenarios. In the realm of Gen AI transforming information into intelligence, Grant provides statistical insights into the platform's extensive reach, encompassing millions of candidate profiles, billions of interactions, and a substantial volume of job applications. Gen AI's value lies in extracting insights from traditionally unstructured data like job ads and CVs, summarizing and distilling it for actionable intelligence. Anticipating a transformative shift in user experience, Grant envisions users communicating with AI more naturally. This evolution, inclusive of voice interfaces, promises new avenues for interaction, moving away from adapting to machine language. Delving into responsibility in AI implementation, Grant underscores the importance of responsibly handling data and biases to prevent reinforcing discriminatory outcomes through AI. Emphasizing the necessity to understand the risks associated with training data and be mindful of potential impacts on individuals affected by AI-generated decisions. Exploring the challenges and realities of AI impact on jobs, Grant highlights the disparity between the hype around AI's impact on jobs and tangible transformations in the job market. A balanced perspective is crucial to avoid overestimating or underestimating AI's immediate effects. Jobs are perceived as bundles of tasks, and Grant emphasizes the complexity of job market transformations. While some tasks may automate, others evolve or experience increased demand. For instance, the transition from last-mile delivery to drone-based delivery illustrates how job demands can shift within industries. In preparing for change and AI adoption, Grant advises individuals, employers, and business owners to embrace adaptability in the face of evolving technological landscapes. Individuals are encouraged to explore and experiment with AI tools in their daily lives. Employers should focus on evolving skill requirements rather than rigidly adhering to traditional hiring practices. Additionally, caution is advised in AI adoption, especially in building internal capabilities. It involves asking the right questions about underlying AI capabilities, understanding potential risks. Recorded on 29th February 2024, 6pm, SEEK office (Wallich Street, Singapore).

We speak with Charles Chu, General Manager of Cloud Security at CyberArk in the lead up to his Australian visit in March 2024.CyberArk has advanced capabilities for securing access to cloud services and modern infrastructure for all users, based on the company’s risk-based intelligent privilege controls.The CyberArk Secure Cloud Access solution provides just-in-time access with zero standing privileges to cloud management consoles and services running in multi-cloud environments. These security controls enable secure access to every layer of cloud environments, while causing no disruption or change to the way developers and other users access cloud services.Charles will be in Sydney & Melbourne - 18-22 March, 2024.For a demo visit https://www.cyberark.com/request-demo/ or find out more at https://www.cyberark.com/contact/#mysecuritytv #cyberark #iam #identitysecurity #cloudsecurity #pam

Ivo de Carvalho Peixinho, Head Cybercrime Intelligence Unit, INTERPOL, has a BS degree in Computer Science at Universidade Federal da Bahia, with two post-graduations, one in Distributed Systems and another on Mechatronics. He is also a BS7799 certified auditor. Ivo has more than 10 years of experience on network security, and worked the last two years on security research and incident handling. Prior to Interpol, he works as a Forensics Expert at the Brazilian Federal Police Department.In this interview, Ivo shared insights in 6 topics:1. Information sharing challenges: Addressing conflicts between private sectors and law enforcement priorities, particularly in cases like ransomware, where the need to restore operations clashes with preserving evidence.2. Data Processing Regulations: Exploring Interpol's regulations for data processing and exchange, considering cultural barriers, language differences, and data sovereignty concerns when sharing information among different countries.3. Project Gateway Initiative: Understanding the process and significance of Project Gateway, a collaboration framework between Interpol and private entities, including the steps for private organizations to join this initiative.4. AI's Impact on Cybersecurity: Recognizing AI as a productivity enhancer, both for defenders and attackers, and the importance of balancing technological advancements with legal frameworks in the evolving cybercrime landscape.5. Training and Collaboration: Emphasizing the need for regular training sessions and exercises to foster a common understanding and language among global law enforcement agencies, crucial for effective collaboration during global cybercrime operations.6. Skill Set for Investigators: Discussing the essential skills for law enforcement investigators, including self-driven motivation, the importance of work-life balance, and the role of teamwork, personal interests, and joy in maintaining stamina and perseverance in the field of cybersecurity.Recorded 7th December, ISC2 Secure Asia Pacific 2023, 10.30am.#interpol #mysecuritytv #cybersecurity

Dr. Yuriy Bulygin is the CEO and founder of Eclypsium, the digital supply chain security company that helps organizations protect their critical hardware, firmware, and software. Prior to Eclypsium, Yuriy was Chief Threat Researcher and led the Microprocessor Security Analysis team at Intel Corporation, as well as the Advanced Threat Research team at Intel Security. He is also the creator of CHIPSEC, the popular open-source firmware and hardware supply chain security assessment framework. When enterprises started using CHIPSEC to find vulnerabilities, discover compromised firmware, or just poke around hardware systems, Yuriy founded Eclypsium with Alex Bazhaniuk. Since then Eclypsium has been on a mission to protect devices from supply chain risks.In this interview, Yuriy highlights the potential vulnerabilities in the firmware (software running the hardware) in today’s digital devices, and the risk posed by threat actors.Using a typical PC as an example, which involves contributions from over 265 suppliers, each with its components and code, he notes the ubiquity of software, and liken the supply chain of such a device to a “Wild West”:“at any point in the supply chain, at any of those links in the supply chain, a compromise may happen”, and “ all of these components and all the code that is developed by those suppliers and vendors has vulnerabilities.”He elaborated that “even if it's OK now … 3 months from now, it can be compromised because of those vulnerabilities.”To give an example, he referenced the recently discovered threat in the wild – “BlackLotus”, an evolution of threats based on open-source frameworks – e.g. Lojax, MosaicRegressor, Moon bounce - discovered in the past 3 to 4 years. He highlighted the characteristics of such threats:• These UEFI compromises allow attackers to compromise equipment remotely, for access or persistent malware installation. • They cannot be removed by reinstalling operating system or reimaging or even replacing the hard drive.• BlackLotus exploitation of the UEFI system vulnerabilities, particularly the Secure Boot - a fundamental security feature adopted by modern operating systems - sets it apart as an advanced threat, marking the first instance of such threats discovered "in the wild."He explained that compromising firmware is attractive for threat actors for many reasons:• Stay hidden: Detection and protection controls operate at the software application level and above, but there is no equivalent for firmware.• Achieve "Persistence" - where traditional mitigation measures cannot remove the malware/threats.• Simplicity – for example, exploiting firmware vulnerabilities to gain access is much simpler than developing a very complicated exploit chain.• Gain high privileges – Remain hidden and persistent while gaining high level of privileges.To mitigate against malicious firmware implants, Yuriy suggested, (a) assess the supply chain risks (e.g. potential vulnerabilities and threats introduced during procurement and deployment), (b) continuous monitoring of system integrity, (c) implement specialized technologies designed for malicious firmware detection. Recorded at Singapore International Cyber Week / Govware 2023 – 18th October 2023, 3pm.#mysecuritytv #govware #sicw

Mr Yeong Zee Kin holds a Master of Laws from Queen Mary University of London and completed his undergraduate law degree at the National University of Singapore. His experience as a Technology, Media and Telecommunications lawyer spans both the private and public sectors. He has spoken and published in areas relating to electronic evidence and intellectual property, as well as legal issues relating to Blockchain and AI deployment. Zee Kin is an internationally recognized expert on AI ethics. He spearheaded the development of Singapore’s Model AI Governance Framework, which won the UNITU WSIS Prize in 2019. He is currently a member of the OECD Network of Experts on AI (ONE AI). In 2019, he was a member of the AI Group of Experts at the OECD (AIGO), which developed the OECD Principles on AI. These principles have been endorsed by the G20 in 2019. He was also an observer participant at the European Commission’s High-Level Expert Group on AI, which fulfilled its mandate in June 2020Zee Kin is also a well-regarded expert on data privacy issues. He has contributed to publications on legal issues relating to data privacy and has spoken at many well-recognised international and domestic platforms on this topic.--In this interview, Zee Kin shares his insights on the legal challenges in the Era of Advanced AIZee Kin highlighted that with the latest AI innovations, the responsibility and legal issues remain largely consistent, but the tools and technology introduce different challenges.For instance, he shared that such concerns around content, child protection, intermediary behavior, data security, data protection, and cybercrime remain, while challenges such as detection of fake content has intensified due to increased tool accessibility and the scalability of threats. Referring to the "Getty vs. Stability AI" case, he shared that the interesting question is the use of copyrighted data to train AI models – which is not new, and the key is to establish a proper legal basis for using such data. Data lineage and the provenance of data have always been important in legal contexts. He also noted that these concerns have also surfaced during the recent governmental responses around the world to the latest AI innovations.Zee Kin also highlighted the challenges with defining terms such as "fairness," "transparency," and "repeatability" – varies by context, where expectations and priorities for AI differ based on its use, such as safety and predictability in medicine, and bias and fairness in personal data applications.Repeatability poses an additional challenge in Generative AI because every iteration of an image or summary will vary (**owing to Generative AI's statistical predictive nature).Zee Kin also shares his views of AI's impact on job security, nothing that there will be emerging opportunities for lawyers to use AI tools for efficiency and error reduction.Recorded at TechLaw Fest 2023, 21st Sept 2023, 3.30pm, Marina Bay Sands, Singapore.#mysecuritytv #cybersecurity #ai #law #ailawyer

Mr Wong Wai Meng is currently the Chief Executive Officer (Data Centres) of Data Centres & Networks Division. He has almost 30 years of experience in the Information and Communications Technology (ICT) industry and currently spearheads the company's thrust towards being one of the leading data centre developers and solution provider in Europe and Asia Pacific. Prior to joining Keppel T&T, Mr Wong was Vice President of BT Advise BT Global Services across Asia Pacific, Middle East, Africa and Turkey (AMEA) where he managed the company's practices in business consulting, systems integration, software development, networking, mobility, collaboration and security. He was also CEO of the BT Frontline group of companies where he played a critical role in the integration of BT Frontline into BT Global Services. Mr Wong now serves as Chair of SGTech Council, Member of the Council and Chair of Digitalisation Committee in Singapore Business Federation, and is active on various industry panels and committees.In November 2022, he won the Top Business Leaders accolade at the Asia-Pacific Cloud & Datacentre AwardsMore recently in August 2023, he was named by the Singapore Computer Society as Tech Leader of the Year 2023.In this interview, Mr Wong shared his insights on the evolution of data centres over the last two decades, from the early computing days to today’s AI and Web3 eras, highlighting the pivotal role of connectivity in transforming how “we consume technology today”. Noting how the shift bring to realisation of a “computer” in our palms and concepts such as “software as a service”, he said these transformations contribute to a trend from on-premises solutions to cloud-based applications. These changes in turn have driven demands for centralisation of services in the cloud, leading to the growth of data centres, and the rise of hyperscalers.Other topics discussed include:1. The impact of AI on the tech industry, and the significance of AI in the context of AI vs. AI scenarios.2. Location considerations for data centres (factors such as power availability, water supply for cooling, and connectivity infrastructure being key considerations); sustainability in data centres (including energy efficiency and the use of renewable energy sources).3. Cybersecurity as a holistic approach to digital trust, which goes beyond just technology and involves governance, data management, and privacy considerations.Mr Wong wrapped up the interview by sharing how the tech industry's perpetual evolution change keep him passionately engaged throughout his career – and the promise of groundbreaking change, making each day a thrilling journey of discovery.Recorded at Tech Week 2023, 12th October 2023, 4pm, Singapore Marina Bay Sands.#mysecuritytv

Dennis Giese is a researcher with focus on the security and privacy of IoT devices.While being interested in physical security and lockpicking, he enjoys applied research and reverse engineering malware and all kinds of devices.His most known projects are the documentation and hacking of various vacuum robots. His current vacuum robot army consists of over 49 different models from various vendors.Recorded on 18 October, 2023 at The Australian Cyber Conference 2023 - Melbourne with the Australian Information Security Association. #cybercon #IoTsecurity #mysecuritytv

Jane Lo speaks with Ben Verschaeren, Director, Global Solutions, Sophos about cybersecurity opportunities and challenges with Generative AI.With over 19 years in the IT industry, Ben Verschaeren is a seasoned professional based in Melbourne. He leads global strategic initiatives, educates on threat landscapes, and develops training tools focusing on real-world exploits. Ben also directs a global sales engineering team responding to RFPs, and a software engineering team creating high-quality products for various uses. His prior roles include serving as a Solution Architect at JB HiFi, Australia's largest retailer, and at Thiess, the leading mining and construction company in Australia. Ben’s unique blend of sales and engineering experience across diverse sectors enables him to drive tech-forward initiatives with an innovative approach, affirming his position as a key asset in the industry.In this interview, Ben kicked off the interview by sharing his insights on drivers into the wide-spread popularity of the latest AI technology – “generative AI”. On discussing how generative AI could transform the cybersecurity landscape, Ben acknowledged that it could help increase the productivity of cyber defenders, as an “AI” personal assistant – such as “help you write code” or “help you write query”. However, he also cautioned that the technology also introduces new threats.Elaborating on some of the emerging threats, he said that contrary to expectations, malware generated by LLM can be more easily detected than phishing emails and synthetic voice. To mitigate against such threats, he suggested enhancing business processes and controls (for example, robust fund transfer authorisation, to mitigate phishing risk). He also recommended conducting user awareness training regularly to align with the fast-evolving landscape of phishing tactics, emphasising the importance of understanding the "why."Another threat is the potential of generative AI to “hallucinate” when making recommendations for software libraries. He pointed out this issue underscores the need to maintain a SBOM (software bill of materials), and implementing quality controls throughout the software development process.Ben also recommended that organisations looking to embrace AI, develop an “AI policy”, providing guidance in areas such as the types of data or models that to be used during training and deployment. He also shared that middleware solutions are available to anonymise the data entered in the prompt, and check that no personally identifiable information (PII) is included.Wrapping up, Ben notes that rapid pace of generative AI development and “the landscape is changing everyday”, and advises cyber defenders to “stay on top”, “don’t be complacent”, and it is “another area where and different threats are emerging every day”.Recorded at Cloud Expo Asia, Singapore Marina Bay Sands, 12th October 2023.#mysecuritytv #sophos #generativeai #cybersecurity

Recognised by the US Cybersecurity and Infrastructure Security Agency (CISA), Motorola Solutions has established a cyber threat Information Sharing and Analysis Organisation (ISAO) to provide public safety agencies the capabilities they need to defend against attacks.Since January 2022, Motorola Solutions’ Public Safety Threat Alliance observed 350+ cyber attacks impacting public safety organisations worldwide, often resulting in downtime of critical services. Cyber attacks against public safety agencies increased in both 2021 and 2022, with 2022 seeing a 700 percent increase in distributed denial of service (DDoS) attacks for public safety organisations and a 179 percent increase in hacktivist activity.In many Australian states and territories, emergency services use the Motorola Solutions Land Mobile Radio (LMR) communication networks and devices as well as their managed services to help maintain reliable voice and data communications and keep their technology securely and optimised, 24 x 7.However, LMR networks and other critical infrastructures can also be targeted by threat actors (e.g. critical infrastructures including utilities being targeted in the war in Ukraine)Motorola Solutions continues to grow and invest in its portfolio of communications, software and video security products including our cyber security offerings. The ActiveEye platform monitors about 1M cyber attack events on public safety networks each month, with 98 percent auto-triaged by artificial intelligence, and the rest looked at by cybersecurity experts on our team to determine how to mitigate risks.Among Australian customers already using these cyber services are the NSW Telco Authority for which Motorola Solutions are providing a comprehensive suite of public safety services for PSN, including network lifecycle upgrades and 24 x 7 cybersecurity, helping to keep this mission-critical technology up-to-date, secure and performing reliably in any situation.For more information and to get involved, visit Public Safety Threat Alliance -https://www.motorolasolutions.com/psta #motorola #cybersecurity #mysecuritytv #publicsafety #motorolasolutions

Brendan is a cyber security expert with more than 20 years of experience in the financial sector and U.S. intelligence community, including leadership roles as the founder and CEO of a successful startup and an executive at the National Security Agency. He has a deep knowledge of advanced cyber threat actors, threat hunting, financial sector systemic risks, and risk management best practices.In this interview, Brendan shared his perspectives on cybersecurity skills, threats and budgets.Reflecting on his career at the NSA from 2002 to 2013 and essential cybersecurity skills, Brendan emphasized the importance of curiosity, analytical thinking, and adaptability, which he believes are still relevant in today's cybersecurity landscape. When it comes to the question of whether cyber threat actors possess greater expertise than cyber defenders, Brendan suggested that they strive to utilize their resources as effectively as possible to breach networks. From this standpoint, they share similarities with other criminals who possess the necessary skills to perpetuate their criminal activities.For cyber defenders also seeking to optimise the return on investments, he noted the challenge of quantifying cybersecurity investments and the need to tailor metrics for different companies and industries.On the topical theme of AI in cybersecurity, Brendan highlighted the potential of AI, particularly in threat intelligence characterization and customer engagement. He also mentioned the challenges of AI models and their potential use by threat actors. He also shared his experiences starting a company and raising funds, and the value of Information Sharing and Analysis Centers (ISACs) and various industry-specific information-sharing groups. Recorded 26th Sept 2023, 5.30pm, Asia Square Singapore.#mysecuritytv #cybersecurity #isac

We speak with Bugcrowd CEO Dave Gerry in Sydney as he visits Australia to meet with partners and customers. Bugcrowd, a multi-solution crowdsourced cybersecurity platform, has also announced significant global customer momentum, highlighting the market need for Bugcrowd’s crowdsourced cybersecurity platform. The company’s rapidly growing customer base includes top brands such as ExpressVPN, Rapyd and T-Mobile, which have chosen to partner with Bugcrowd for one or more of its Bug Bounty, Penetration Testing and Vulnerability Disclosure Programs. Serving nearly a thousand organizations worldwide, Bugcrowd empowers customers and hackers to unleash their ingenuity to protect brands and intellectual property. The company drove over 50% growth in payments to the hacker community through customer programs, amplifying a pivotal time of remarkable growth and innovation for the Bugcrowd Platform. ExpressVPN, an industry-leading privacy and security company, chose Bugcrowd for its world-class team of hackers that had skills expertly matched to their unique scope. The company’s goal is to allow users to take control of their internet experience – with privacy and security at its core – and Bugcrowd makes this possible by streamlining the reporting, remediation, reward and disclosure processes of a public bug bounty program. ExpressVPN has been harnessing Bugcrowd’s powerful and highly-scalable Vulnerability Disclosure and Bug Bounty programs to protect their data and customers for over three years.Bugcrowd’s latest customers include U.K.-based fintech company Rapyd, who chose Bugcrowd for its ability to support organizations around the globe in scaling their security programs to meet rapid organizational growth. During a time of major acquisitions and the need for more focused API testing, the 500+ Rapyd team transitioned to Bugcrowd in order to leverage the company’s highly specialized team of hackers that fit their exact needs. Bugcrowd’s CrowdMatch technology, which enables precise crowd matching, allows organizations to connect with the right hackers for Rapyd’s needs. In one year, the team found 40 total vulnerabilities, 15 of which were critical. Top customers also include T-Mobile, the U.S.’ leader in 5G with the largest, fastest and most awarded 5G network in the country. T-Mobile and Bugcrowd launched a revamped public bug bounty platform to invite hackers to find vulnerabilities in T-Mobile’s applications and websites. T-Mobile evaluates the reported vulnerabilities and takes appropriate action. Recorded 10 October, 2023. #mysecuritytv #cybersecurity #pentesting #bugbounty #bugcrowd

In this interview, both John and Thian introduce the history of ISACs (formed in 1999, subsequent to the 1998 signing of U.S. Presidential Decision Directive-63), and in particular, the creation of OT-ISAC (Operational Technology Information Sharing and Analysis Centre) as one of the key trusts of the Cyber Security Agency of Singapore’s “OT Cybersecurity Masterplan 2019 to facilitate the sharing of information.Reflecting on the journey from conceptualization to today, Thian Chin remarked that “OT-ISAC has become that safe harbour the platform for the organisations of the different parties with vested interest to different business lines come together to share, because their common goal is how do we then exchange information to reduce the risks that caused by threat actors.” Other topics covered in the interview include:• The types of information being shared – such as strategic threat landscape including cyber incidents and vulnerabilities, standards and best practices, and TTPs.• Closing the cultural / communication gap between the engineers and the IT cybersecurity practitioners because “because the problem statement they're dealing with is the same. It's a threat actor out there to try to disrupt.”• The maturing of conversations from beyond terminology such as zero trust, air gap to actual implementation• What does success mean in information sharing - diversity of opinions – in particular, including C-suite in cybersecurity conversations, and more more stakeholders coming forward to share real-life case studies of actual incidences. John Lee, Managing Director, Global Resilience FederationJohn has more than 20 years of experiences in ICT and Information Security. He is currently the Managing Director of the Operational Technology Information Sharing Analysis Centre (OT-ISAC) that supports member organizations (public and private) in OT threat information. The centre was setup in 2019 and has members from Transport, Aviation, Maritime, Healthcare, Manufacturing, Water, Energy, Government etc. His past roles were in Information Security Governance, Risk Management, Security Operations, Infrastructure and Application Delivery. He has led teams in Asia-Pacific as well as managing global services. He is also a certified cybersecurity trainer for ISACA.Thian Chin Lim Senior Director (Governance Group) GovTechThian Chin has over 20 years of experience in Information & Technology governance, risk management, resilience and compliance, and operational Technology cybersecurity. Prior to his current appointment at GovTech, he led the Critical Information Infrastructure (CII) Division at the Cyber Security Agency of Singapore (CSA). Before joining CSA in August 2015, he was responsible for the regional Technology Governance function in United Overseas Bank. He also led the Technology Risk function in GIC Pte Ltd from 2008 – 2013. In his earlier years, he was a manager leading a team of Information Technology auditors in Ernst & Young.Thian Chin holds an Executive Masters in Cybersecurity from Brown University, Bachelor’s Degree in Computer Engineering from Nanyang Technological University and is an alumnus of the George C Marshall European Center for Security Studies. He is a certified CGEIT, CRISC, CISM, CISSP, CISA, CDPSE, GICSP and SABSA practitioner.Recorded 7th Sept 2023, OT-ISAC Summit 2023, Voco Orchard, Singapore, 5pm.

Mr. Yigal Unna was appointed by Israel’s Prime Minister as the Director General of the Israel National Cyber Directorate (INCD) in 2018. In this 4 years role, until 2022, Mr. Unna reported directly to the Israeli Prime Minister and led a team of 350 employees responsible for all aspects of cyber security, including formulating policy and building technological power for operational defense of critical infrastructure. In addition to his work protecting Israel, Mr. Unna forged long-term relationships with many foreign governments and lectured around the world on cyber security.Prior to the INCD, Mr. Unna served in the Israel Security Agency (ISA), also known as Shin Bet and Shabak, for 23 years. The ISA is Israel’s domestic intelligence service. He retired as the Director of the Cyber and Signal Intelligence Operations Division (military rank equivalent of major general).Mr. Unna began his career as an officer in the elite Unit 8200 in the Israel Defense Forces. Unit 8200 is responsible for collecting signal intelligence and code decryption. Overall, Mr. Unna served 33 years in Israel National security – all of them in cyber security and Data warfare.Since retiring from public office, Mr. Unna advise to leading and promising Israeli cyber startups and growing enterprises, a venture partner in venture capital funds focusing on cyber security, and manage national cyber projects for foreign governments (Africa, Asia and eastern Europe). Mr. Unna take part in the international advisory panel for Singapore Ministry of Transportation in Maritime, contributing his experience on cyber security aspects of Maritime. Mr. Unna is part of the Global Cyber Group of Aspen institute, and a member of the advisory team to Krach Institute for tech diplomacy at Purdue, both US research institutions.In this interview, Mr Unna shares with the audience his extensive experience, and his perspectives on the emerging cybersecurity issues introduced by innovations such as blockchain and AI. Touching briefly on blockchain, Mr Unna notes that, the technology is a huge step “for managing our data and our knowledge in a better and more secure way” and will mature as we build more safeguards and applications. As an example, he referred to the NFTs. He points out some of the lessons and possibilities introduced by the phenomenon, such as how to better secure and define assets in the future, including non-tangible assets. On the topic of AI, Mr Unna also believes that, if history is any guide, that after the “first shock of fear and enthusiasm”, AI will be here to stay and “mankind will eventually build security and safeguards”.However, he also points out that as with other new technologies, the AI innovation outpaces our abilities to put in appropriate safeguards. In particular, he cautions that for the first time in human history, “Intelligent and maybe even self aware machines may begin to become dangerous to mankind”. He advises that technological companies put ethical principles before business outcomes, to fully harness the benefits of the AI while addressing the potential abuses. Mr Unna also shares the three areas of AI that the Israel cybersecurity community is working and researching on:(a) how cyber threat actors could exploit AI(b) how cyber defenders could harness AI(c) emerging threats from adversarial AI - a new playground of AI vs. AI Wrapping up, Mr Unna shares 3 valuable cybersecurity lessons drawn from his extensive experience for defenders.Recorded at ST Engineering’s InnoTech Conference 2023, held at Marina Bay Sands, Singapore on 5th September 2023, 4.30pm.Our previous Webinar session with Mr Unna when in the role as Director General is available here https://australiancybersecuritymagazine.com.au/australia-israel-counterpart-series-national-cybersecurity-strategy-insights/

Mark Orsi is the Chief Executive Officer of Global Resilience Federation, (GRF) a non-profit with the mission to develop and support threat intelligence and information sharing communities including education, operations technology, financial services, retail and hospitality, legal and professional services, energy, health, and oil and natural gas. Launched in 2017 as a standalone company, from a former Financial Services Information Sharing and Analysis Center (FS-ISAC) division, GFR is the evolution of 1998's U.S. Presidential Decision Directive 63 and 2003's Homeland Security Presidential Directive 7 which mandated that the public and private sectors share information about cyber and physical security threats and vulnerabilities to help protect critical infrastructure. Mr. Orsi led strategic efforts for several prominent Fortune 100 companies, working directly with CIOs and CISOs to develop, deploy, and improve security controls protecting the confidentiality, integrity, and availability of sensitive information. Mark joined the company from JPMorgan Chase where he served as executive director and product owner for cybersecurity and technology controls. Prior to JPMorgan, Mr. Orsi served KPMG as director of cybersecurity, and Goldman Sachs as vice president of technology risk. Mark holds an MBA from Columbia Business School, an MS in computer science from Johns Hopkins University, and a BS in Aerospace Engineering from the University of Maryland In this interview, Mark shared the latest in artificial intelligence, and operational resiliency. Artificial intelligence Mark highlights how the latest AI innovations powered by large language model differ from the previous iterations of AI technologies such as democratising the cyberattacks tools used by nation state actors and leveraging dynamic datasets in training AI models.He also notes how cyber defenders are adopting the technology to “multiply” the efforts of resources, for example, in code development and testing. He also foresees that such technology would empower cyber defenders to deliver more targeted threat intelligence. Through a personal story, Mark illustrates how the technology lowers the barriers of entry for hacktivists and other threat actors, and the importance of exercising extra vigilance – including understanding how the third parties in the supply chain are using AI. He also notes that an “AI” SBOM (akin to the software SBOM) could help to address the AI model and data supply chain concerns. Operational resiliency Mark introduces the Operational Resilience Framework (ORF) launched by Global Resilience Federation’s Business Resilience Council (BRC) to solve the challenge of providing services in an impaired state. For example, while businesses may have robust processes in place for backing up business or customer data for regulatory reasons, less attention may be paid to backup data such as system images or active directory, network configurations –which would minimize service disruptions in the face of destructive attacks and events. He also explains that ORF was developed to be broadly applicable and is aligned with existing controls like those from NIST and ISO. Some useful links and contacts:BRC: https://www.grf.org/brcOperational Resilience Framework: https://www.grf.org/orfLeadership Guide to AI Security - https://www.grf.org/the-leadership-guide-to-securing-aiPractitioners’ Guide to AI Security - https://www.grf.org/practitioners-guide-to-managing-ai-securityGeneral info: [email protected]; Mark Orsis: [email protected] on Security and Third-Party Risk – Oct 11-12 Austin Texas: https://www.grf.org/2023-summit-on-security-and-third-party-risk Recorded 25th August 2023, 1.30pm, GRF APAC Headquarters Singapore

Mike Silverman has a unique blend of a business and technology background, with 20 years of experience in strategic, technological, financial, and change management leadership across many industries, primarily in Financial Services and Software. He enables firms to innovate, scale, and transform through increasing productivity, reducing costs, and streamlining processes and operations. Mr. Silverman was previously the Global Head of Enterprise Technology Strategy at FIS, the world’s largest Financial Technology Company. Prior to that, he was a management consultant focusing on Corporate & IT Strategy, CxO Advisory, Merger & Acquisition Integration, Business Process Re-engineering, and more, and has held other roles in innovation and development.Mike has an MBA with specializations in Strategy, Finance, and Leadership & Change Management; and a BSE in Computer Engineering, Cum Laude with Departmental Honors.In this interview, Mike shares with the audience highlights of the FS-ISAC (financial services information sharing and analysis centre) APAC Summit 2023 – in particular, on two themes: Artificial Intelligence and Quantum Technology.Recorded 3rd August 2023, U.S. PST 6.am. SGT 9pm.

Jane Lo, Singapore Correspondent speaks with Miao Song, Global Chief Information Officer, GLP Singapore.Miao Song has over 23 years of global experience in various industries, with broad exposure to the Oil/ Energy/Natural Resources as well as Consumer Goods and Health Care business. Over the course of her past tenure, she received many awards such as the CIO of the Year by IDG, Leadership Excellent, Women Leader, CIO of the Year Silicon Valley, Global CIO 100, and more.In this interview, Miao shares the highlights of her presentation, “The emergence of GenAI technology”, at the World AI Show 2023.She notes that latest AI innovation based on LLM (large language model) is significantly different from previous “traditional” AI or machine learning. In particular, the AI LLM models, enable the generation of new content with cognitive search and text summarisation.Noting how the new capabilities could help drive efficiency or help humans “do jobs better” (for instance, in medical diagnosis), Miao stresses such benefits need to be balanced with concerns. Some of these considerations including the impacts on jobs, the need for regulation, and security risks implications. For companies looking to adopt the latest AI innovation, Miao points out that it is “not a simple matter of having a conversation with ChatGPT and the problem will be solved”. Rather, there is a need to understand the space and the technology (data structure and overall technology architecture), and the business pain points, to “translate the business opportunity into technology adoption”.She elaborates that implementing AI is different from a traditional large IT project that typically runs linearly requiring a team of consultants. Instead, the adoption requires hands-on approach to re-iterate “test and learn” cycles - in other words, education – which requires a secure environment to learn the capabilities and limitations of AI. From her firm’s adoption journey, Miao offers a few tips:• the technology team be immersed in the business to build practical use cases. • the need for data architects and engineers to design data structures and identify the data types to be fed into AI • security professionals to implement necessary measures to mitigate potential security breaches and AI specific risks (such as model risks that could lead to fraud)• guidelines for the organisation (for examples, restricted use of confidential company information or personal information to experiment with AI; privacy regulations that are applicable)Wrapping up, Miao offers the view that to remain competitive, companies will have to embrace and adopt the latest AI innovations. She also offers an optimistic view that with generative AI, we can move away from “memorising” knowledge to focus on generating creative ideas.Recorded 2nd August 1.30pm, World AI Show 2023, Singapore Marina Bay Sands.

We speak with Asjad Athick, Cyber Security Lead, APAC for Elastic who gave a presentation at CISO Melbourne earlier this week. Asjad’s presentation encompassed the concepts around ‘unleashing the full potential of AI in security operations’. In today's rapidly evolving threat landscape, security analysts play a crucial role in protecting organizations from cyberattacks. However, the overwhelming volume of security alerts and the complexity of identifying and responding to advanced threats pose significant challenges. Enter Artificial Intelligence (AI), the game-changer in security operations.Asjad discusses the transformative potential of AI in Security Operations Centers (SOCs) and explores how it can empower security analysts to tackle the ever-growing complexities of cybersecurity. By harnessing the power of AI, SOC teams can enhance their capabilities, augment human expertise, and gain the upper hand against adversaries. For further information visit https://www.elastic.co/security#mysecuritytv #elastic #elasticsecurity #generativeai #aicybersecurity