Panel
Cybersecurity: Anticipating the Next Trojan Horse
Milken InstituteYun-Hee Kim, David Koh, Matthew P. Moynahan, Rafal Rohozinski, Silvino Schlickmann Jr.
- Critical Information Infrastructure (CII) Focus: The Singapore Cybersecurity Agency (CSA) defines CII as essential services including telecommunications, electricity, land/sea/air transport, and medical services, with a mandate to protect the "people sector" and industries affecting the national economy.
- Insider Threats: Matthew Moynihan identifies the hacking of trusted individuals (insider threats) as a primary risk, noting that nation-states often embed employees to gain root access to intellectual property and critical data.
- Fundamental Internet Flaws: Rafal Rozinski argues the global economic system is built on the internet, which was designed for interoperability and resilience, not security; attempting to patch this "hack" at a technical level is insufficient.
- Demographic Drivers of Crime: Over two-thirds of global internet users are under 35, and 50% are under 25, with a significant portion of new users coming from fragile or failed states, creating a "demographic bomb" that incentivizes cybercrime.
- Jurisdictional Gaps: The absence of a global cybercrime convention and weak cross-jurisdictional coordination allows criminals to exploit legal disparities, exemplified by the persistence of "419 scams" in West Africa.
- Singapore's Regulatory Response: Singapore is tabling an omnibus cybersecurity bill to define CII, grant investigators rights, mandate threat intelligence sharing, and regulate the cybersecurity industry to combat "snake oil" vendors.
- Commoditization of Cybercrime: Silvino Schlickman notes that criminal syndicates have dissolved into anonymous, modular services where criminals hire unknown actors via platforms, complicating investigations and attribution.
- Equifax Breach Context: The 2017 Equifax breach affecting 140 million consumers highlighted a shift from preventing entry to preventing data exfiltration, as traditional "perimeter" security fails against inevitable breaches.
- Prevention Failures: Panelists agree that major breaches like Equifax, WannaCry, and Sony were preventable through basic, known measures like patching, indicating a systemic cultural failure where security is treated as compliance rather than risk management.
- IoT Vulnerabilities:
- Approximately 88% of US industries plan to deploy IoT, yet 90% of executives lack confidence in existing security solutions for these devices.
- IoT devices are prioritized for cost and functionality over security, often lacking update mechanisms or firewalls.
- Compromised IoT devices can transition from data theft to physical harm, impacting traffic lights, power plants, and medical equipment.
- Market Failure in IoT: The negative externalities of unpatched IoT devices (e.g., using home devices to attack others) create a market failure where individual consumers lack the incentive to secure devices that protect the broader network.
- Data Sovereignty Risks: Rafael Rozinski warns that varying national data laws (e.g., China's localization requirements) could fragment the internet into isolated zones, potentially impacting 26% of the global digital economy.
- AI and Machine Learning Limitations:
- Machine learning is effective for supervised tasks but struggles with "advanced persistent threats" (APTs) that rely on patience and evasion over time.
- Criminals are already utilizing AI to test malware against antivirus databases and to automate attacks at scale.
- Real-time AI decision-making for security remains a challenge due to latency and the inability of machines to replicate human judgment in dynamic environments.
- Security Maturity Gap: Sylvio Schlickman highlights that 92% of malware uses the Domain Name System (DNS), yet less than 30% of Fortune 1000 companies have visibility into their DNS networks.
- C-Suite Accountability: David Koh and panelists emphasize that cybersecurity is a boardroom-level business continuity issue, not an IT compliance task; C-suite executives lack the necessary knowledge to make informed risk/trade-off decisions.
- Zero Trust and Human Factors: The shift toward "zero trust" models reflects a move away from the internet's original trust-based architecture, as human nature remains the largest vector for 90% of breaches.
- Three Core Prevention Recommendations:
- Prioritization: Individuals should focus on securing high-value data (e.g., freezing credit lines).
- Trust Awareness: Users must adopt a mindset of distrust, assuming they are vulnerable to social engineering.
- Risk-Based Strategy: Companies must shift from "security" to "cyber risk" management, engaging shareholders and CEOs to drive strategy.