8- Mahai ingurua - John Lyons, Luigi Rebufi, Alejandro Díez, Benjamin Haddad_en

Benjamin Haddad, please

take

your seats.

We

will make an effort

to

address

all

of the questions, or at least most of the questions you've been sending. That's the way we want to establish this dialogue.

We

wanted to make

this

Q&A session to look a little bit different, as you can see from the

sitting

arrangement, and then we will go for lunch.

So, we

have very interesting, highly varied questions. That's the good news

already

for our,

and

thanks to the interpretation services, by the way.

We've

been told that people are particularly happy to have a Basque booth as well for the Basque language. One of the comments that was sent. Another comment was, very few women in this field, right, Ainoa?

You're

nodding. Yes?

Yes,

I was saying, one of the comments we were sent, not many ladies,

not

many women

in

this field.

The

comment said that women have an important role

in

what is to come in cyber security, surely.

Well,

I can only agree with that comment. Unfortunately, when I attend meetings and when I have a picture taken in a group, I like wearing something bright. Today I'm wearing a red jacket. Because I want to be seen, you know, I'm usually the only one,

only

recently in Finland, of all places as well. I was at a workshop and I was the only woman there.

Let

me tell you that

at

university, our students tend to be 50-50

young

men and women.

But

that's not the case in the industrial field, in the industrial world,

or

now in cyber security.

Unfortunately,

two more women were going to be speaking at a conference here today and tomorrow. One from the European Security

Network,

a lady who unfortunately cancelled at the last minute.

And

also Elena from Incide was going to be the speaker for Incide.

But

the comment is quite right.

Another

comment said

and

reminded us that in Guipuzkoa,

that

Guipuzkoa is good evidence and proof of talent in the field of cyber security.

And

the question is,

how

can CIUR, the new

center, help

to make this more visible, make it obvious and clear in our community that we have that talent here already?

Well,

CIUR has two main objectives. Let's not forget that. CIUR will be reinforcing our industry, our firms in the event of a cyber attack.

And

the second main objective is promoting specialization and training in cyber security.

Thinking

about those two objectives,

there's

no doubt that cyber security companies are

fundamental

and they should be at the core of everything we do. And that's why CIUR will be connecting those companies with other firms and with other

stakeholders at

other levels

so

they can make the most of their existing resources, so they can test their products and services, so we can be better connected with international stakeholders.

And

here I would like to stop and remind you

that

in the past we have been working with some niche cyber security companies, but those are just a few of the rest.

There

are many more that will have access to this open,

the

nature is that it will be an open center.

So

we can make talent visible and we can make the most of it for our strategic.

Benjamin. And the

question is,

she's

asking in English,

John.

...opinion

about

the real commitment of the European institutions in order to support or to boast a structure and a strategy to develop cyber security strategies in the different countries. And they ask about, in your opinion, is there a real commitment in this field? More than a question, people, I think it's more than a clear question, is your opinion about the commitment of the European institutions at the different countries, in your opinion, if they are really in the same page, if they are thinking for the same page?

Okay,

thank you. Well, I can say from first-hand knowledge, for many years I've been working with the Council of Europe, particularly on cyber crime and supporting

the

spread of the Budapest Convention to many countries outside of Europe.

And

with various departments in the Commission,

and

we were

very

happy to be involved in the

set

-up of the European Cybercrime Centre at Europol. And I have noticed over these last four or five years a real growth in the commitment within the Commission and the other institutions

to

be leaders in cyber security, to help the 27, 28 member states to implement

the

best cyber security strategies that are available. So I'm really encouraged

by

the effort, by the investment

that

European institutions are making in order to help

the

security of the entire EU family.

I

have to say that some of the member states are quite far behind

and

will need more help than others

in

this journey,

but

I'm really encouraged and I believe that they are,

they

have the best interests of those member states in investing in the future of cyber security.

And

about European policies and

more

than that, focused on the state of the art in terms of research and innovation and development in Europe, comparing with some other parts. And this is a question for you, Luigi, because they say, according to your knowledge of the state of the art in relation to civil security, what does Europe need?

And

in a more concrete way, perhaps comparing with Israel and

maybe

Benjamin could add some other point of view.

What do we need?

To simplify, I would say, I would start from investment.

Investment

because Europe, both as Europe and as national or local level, we still have a very low level of investment. And I mentioned before, at best in the future, we will have something like 500, 600 million of euro per year 2021. This is my estimation. Today is still much less. And when you compare with what is invested in the States and other big countries, investment are much higher. You don't need to have only public sector investment. For instance, in Israel, you have this, for many years, this national innovation fund, which is really pushing all, which is supporting the development of startups and innovation in general. And this is led by the government, actually. It's a national.

But this is thanks to the understanding of the politician of the need for such investment fund and also for the better understanding of the need for the economic sector.

And

this is what is missing. And this

is what

is

missing. Coming

back maybe to the question that

you

asked to John, he was very positive. I would be a little bit more negative just to

challenge

him.

We

started yesterday. A bit more negative in the sense that the commission is just understanding, starting to understand what cyber security is, what

the

European digital, single digital market is. And what are the needs. And on top of that, the commission and the parliament, they have a strong constraint because on one hand, they want to build up something common. At the same time,

when

it comes to security, they have to deal, as I said before, with the sovereignty of the different countries, which are limiting the dialogue, which are limiting the exchange of information, which are somehow limiting the cooperation. And it's a matter of maturity. And it's

a matter of maturity, but

also the different sectors, they have problems to talk each other,

to

cooperate with each other, as I said also in the example I gave before on certification. So all this needs a certain time to build the understanding. So what I want to say is the commission really needs to understand, they're still lacking, the real,

what

the industry wants, what the industry needs in cyber security. So they have a vision from Brussels.

And

when you come to the reality, like here in a region, and you understand what are the needs,

you

see that there's still a mismatch. So the strategy, nice, politically correct strategy that you build up in Brussels, is not really what the very basic sometimes requests which are coming from industry in the field. Benjamin, do you agree with this? Yes,

yes,

to a large extent. Can you hear me? Yeah, I will speak up. Yes, to a large extent, I agree with all that was said. There is a lot of very interesting studies that try to understand what makes innovation clusters successful. There are many attempts around the world. In Europe, it's been

10,

maybe 15 years that we are trying to replicate the Silicon Valley model and been unsuccessful, to be honest, with some exception. And the role of the military is often very well documented in helping successful innovation cluster grow. It has always had a very important role, whether you are talking about cyber security or other domains of innovation. Military definitely always had its role, both in America, in Israel, and in other places, as the availability of venture capital, as the entrepreneurial mindset.

I think another government role that you mentioned is very important, but I think something that has been critical and differentiating for specifically the case of Israel and its success story was the fact that actually you had a lot of corporate R&D, a lot of leading corporate centers coming there to do R&D exclusively. And that, I think, has helped a journey where you have basically a very small country facing gigantic threats and everybody knows about it. So that means that essentially you have swathes of population that are very early on in their life sensitive to the problems in cyber, to technology, and at the army receive a training that is equivalent to a university degree.

But then, typically,

the

journey goes with a first step in your career at an R&D center of a leading multinational corporate. You are part of this and you start understanding the applied problems that you were talking about. When you go work for the R&D center of ABB, of Siemens, of Citibank, you start having the real world knowledge of what a trader in London is struggling with, of what industrial production line is really concerned about, and then you move out and create a startup.

And

that combination, I think, of, you know, mindset, venture capital availability, government support, but also sometimes need to create their people more awareness,

matched

with the role of multinational R&D center, then that's a secret sauce. I think that's hard to replicate, but that's proven to be quite successful. Perhaps how to replicate, and that's another question straight to you, because they are talking about, and yes, John, I'll give you the chance. There are some people asking about what do we need to do in Gipuzkoa, considering the size of the territory, considering the companies we've got, to create this startup ecosystem in cybersecurity. In your opinion, do we need it? It's a good question, and I'd love to collaborate more. We're talking a little bit about it. I think,

you

know, Israelis have failed when they tried to replicate what America was strong in. It goes back to the territory of competitive advantage, I suppose. Trying to do exactly what others are hyper-successful at maybe is not always the best strategy. I think there is a huge role, though, for better partnership. On one side of the equation,

you

have a country that sometimes feels a little bit isolated and far from everything, far from their customers, far from exactly the understanding of what they need. And on the other side, you have ecosystems such as these that are prioritizing in a very clear and ambitious way cybersecurity.

Rather

than creating a small Basque country version of Israel, why not increasing the links between the region? We are seeing some effective programs with Germany, with Italy, with many regions around the world, where it is really about aggregating by industries or by sub-industries a series of problems, and then creating innovation jams, creating accelerators, creating innovation roadshow, where we bring the best of the

innovation

from there into here so that it solves the problems today. Rather than trying to, it's very hard to build an innovation ecosystem.

And

you have

a

lot of documents on how unsuccessful the countries have been around the world in doing that.

Thank

you. John?

By the way, sorry. This is

exactly what we are doing

in

EXO, linking the region. Of course. Sorry. Yeah.

The

necessity to interrupt me, of course, and interrupt yourself.

No,

if I may, I'd like to add to the other side of the coin.

And

I fully support what Benjamin is saying about innovation and not one size fits all.

But I

have the thing about getting back to the basics

for

businesses in Kapuzkoa that I think is worth just re-emphasizing. Okay? Because whilst we're building up the innovation

and

skills

and

attracting ladies into the profession,

the

businesses that are operating here and now have got issues that need to be fixed immediately.

Okay?

So I'm not saying,

you

know, none of that

is

poor. We should be doing that. But in parallel, and at the same time,

there

are some very basic steps

that

every company in Kapuzkoa could take

to

make themselves more secure immediately. Very simple, straightforward, technical security controls. We'll have a list of them at the center,

which,

you know, our job will be to share with you. And by supporting our technical security companies,

they

can help with a small amount of consultancy and work. So it's a bit like home. If you imagine how many times have I been asked, if you know anything about computers, your aunt or your grandmother or your mother says,

John,

how do I secure this new laptop I bought? Well, you know, keep your operating system up to date.

Keep

your antivirus and security suite up to date. And don't click on links from people you don't know. Okay? So those are the basics for home, if you like.

And

there are some very simple things that every business can do, which are not expensive, can be done immediately, and will mitigate up to 80% of common online threats.

Okay?

They won't help you fight the Chinese,

but

they will help you fight

the

digital cyber carpet bombing that we're seeing every day. Okay? So I'd like us

to

start with the

basics

also. Thank you. Interesting to see that people are commenting, you know, by Twitter, for example, they are commenting on your comments. They

are just

adding those other points of view. So it's very interesting to see that we are really talking to each other. Alex, bein eta berriro, haipatzen da, galdera tan, betiko...

Alex?

...sektore privatua, hemen nola bait ordezkatzen ari gara...

Perdón, pero no nos diga a sonido a cabina.

Estaremos...

Sorry, but the sound is not reaching the booth. We'll be back, hopefully, as soon as it does. Apologies. Oh, no. Now,

the

question is,

how

can we have better synergies between the private and the public sector, and also collaborating with

public

institutions?

Because

we've heard about synergies, for instance, between CIUR, the center,

and

other stakeholders.

It

sounds like we're doing things right in the Basque country in this sense, right?

Well,

public-private partnership is paramount right now in this field. And it's not that hard, in fact,

because

we have

public

institutions, on the one hand, that need to have clear objectives.

And

then it's

ever

so simple, really. My training and my experience was in the private sector. So what needs to be done?

Public

institutions need to listen to the companies, to the technology experts,

and

then set in motion projects.

And

there are many success stories of projects and activities that have been very, very successful.

That's

the key to the success of PPP.

For

instance, Benjamin mentioned the possibility of building bridges, for instance, between the Basque country and Israel. That would be a partnership, that would be a collaboration. And for that to succeed, we would just need to listen to one another. What is the same thing if it's a PPP here?

Listen

to one another and have the necessary tools.

Another

question

has

to do with the industrial fabric here in Guipuzkoa, which 80% of them are SMEs, that tend to have more difficulties in this sense. What would be the immediate steps that an SME should

take to

improve in the field of cybersecurity? For SMEs, what should they do immediately, in your opinion?

Can

you hear this mic okay?

Great. Well, an

SME logically doesn't have all the

resources

a larger company has access to.

They don't

have security experts close at hand either.

And

because of that, awareness is basic for an SME.

And

diagnose where they are,

at

which point they are,

so

they can have a starting point. And then I totally agree, there are some basics, basic, very simple, basic principles.

I suppose any

SME

can

or micro-enterprise

should

implement. Very, very basic ones, I insist.

So,

these basic

points

or best practices really make a difference,

talking

about digital security or cybersecurity.

I

feel there are times that

financial

resources for training of staff

tends

to be

one

of the main barriers.

Or

when they hire somebody,

maybe

not having access always to people with those skills, because

it

costs more money.

But

still, sometimes it makes sense to invest a little bit in cybersecurity. And we have seen very recently how

and

why.

We've

seen cases, not particularly SMEs in fact, that have been very badly hurt.

We've

had cases with companies

pleading

us to please recover a hard disk drive with payroll information or with ciphered information that is vital for a particular company. And they can't have access to it, they can't access it because of ransomware.

We

see more and more those situations which can be avoided if those basic steps and a little bit more investment is done also by SMEs.

Sorry,

I should have told you that if anybody else wants to say anything,

you're

getting the interpretation okay, yes?

Right,

another question. What would you say to a CEO in a small company

if

you had an interview this afternoon? So he or she can stop saying,

can

stop talking about costs and spending on cybersecurity and talk about investment.

Who

wants to answer that question? Any of you.

Well,

I would ask them to, I would ask him or her to look at their balance sheet.

And

that would probably say a lot.

Because

cybersecurity is not just about defenses and protection. The regional minister said it very well. It also adds value and competitiveness

to

products, to your products or services, or you should do.

So that's

why I said looking at the balance sheet for that particular company,

I

would point out, can you imagine what would happen if your manufacturing plant

all

of a sudden had to stop

because

of some of these problems or what would happen if your product could have more added value?

To

guess what exactly you're saying,

but you're

saying what would encourage the adoption of more security practice on an ongoing basis rather than. So I think the disappointing answer is that people won't have a chance to choose whether to adopt more security in the future. We are seeing a clear trend from the regulators to impose measures to adopt security in everything that a company does. GDPR is an excellent example of that. It's the most radical revision of data protection law in the last 20 years. And it imposes on every company that holds EU citizen data, which is about every company in their CRM, in their financial system, in their every company of even small size holds EU personal data.

The GDPR says if you do hold that, you will have to build security by design and by default in every product and in every process that you have as a company.

And

if you don't, you will have fines up to 4% of your revenue. And there are other examples than GDPR that there are drives, for example, to better understand the security risk of all your third party suppliers. Now, if you're a logistical supply company, your whole business is depending on that. And your clients will have imposition from regulators more and more around the world, it's converging, that are saying basically to the board of directors, it's your responsibility to understand if your supplier is cyber resilient or not.

And

so, yes, of course, competitive advantage. There are the tier three, you know, forward-looking thinking type of customers who are proactive. But I think the good news, actually, is that companies will have to comply to a much more cyber secure world in this area of, you know, in the developed nation. And then the rest of the world, hopefully, will follow.

And

to the CEO, I would say bring your accountant along, right, your financial director. And I would say look at the amount of money you're spending on ICT, information technology products, smartphones through to servers, through to cloud services.

And

if you're not dedicating

at

least 20% of that cost

to

securing it,

then

you're not spending enough.

And

to give them some measure of what to budget for. And then we can sit down and talk about

how

to spend that wisely. 20%,

okay, right. Right, we

have another question for Ainoa, because

the

provincial governments in the Basque country are very special institutions in the Basque country, in this particular region, because they can raise taxes. The Basque country is different from the rest of Spain in that sense.

Thanks

to that,

in

the Basque country, we can also have a lot more power for regulations and how,

hopefully,

we can help

companies. Is

that right?

Oh,

absolutely.

The

Gipuzkoa provincial government has many challenges ahead of us. But I'm thinking of two of them right now in this sense.

We

want to help our industry, our companies be more competitive. And the other one is guaranteeing

well

-being in

our

community, in our society.

And

when we draft our industrial policy, we are very careful to comply with those two

objectives. And

so that is well aligned as well with our fiscal policy.

And

with others like education and training

or

promoting entrepreneurship.

And

those are the areas that we try to subsidize or we try to offer financial aid.

And

only yesterday we have new incentives and

allowances that

we're going to have new ones and which areas are going to be priority for us. And in the near future, I can tell you that one of those priority areas

will

be

is

going to be cybersecurity.

And

then we will have some activities and we will have possibilities also for patronage and with tax allowances. So we can better promote this particular industry.

Now,

we've also had some questions in the social media. One of them is why would I subcontract my cybersecurity in my company? Why should I do that? So why should I pay for those services if I have INCIBE or those centers to help me?

Why

should I pay for it? So

is

it a question for you then? Well,

it

is true that INCIBE offers services

which

we don't want to for them to overlap with products and services that private companies provide.

In

fact, we're hoping that our services can

we

can guide people who come to us to those companies that can provide them with those services. So once again, we don't want to

do

the same as private companies can do. We don't offer an audit, for instance, as companies can do.

We

offer

services

and help that maybe they can't get anywhere else connected with awareness or training tools

so

they can understand what cybersecurity is about and so that they're more aware and they can go to firms, private firms for those services.

We

need to explain to them how they can be more cyber secure with those services.

Let

me also tell you that we don't provide any products or services that compete

with

the private sector.

Why?

Because

the

Basque Security Center

has

very, very clear that we want to promote the private industry and private

supply and

we want to collaborate with those firms.

So

if somebody thinks they can come to us for a free service, well, that's not the case because

services

we offer are so contracted with private firms

and

there's a tender, there's bidding for it. So when services are provided by us, it's private companies that do so.

Why?

Because the Basque Security Center, to be able to provide ourselves any of those services, we would have

maybe

50, 60 people working for us.

So

that's not a problem at all. Well, I think representatives from

all

three institutions that have been present here. I think we've all tried to explain that we don't want to compete with the private sector.

And

when we've done the

study,

the diagnosis, the monitoring, we have

been

working with them, with private companies. Benjamin, a question for you in English. Innovative

initiatives in cyber security

in

the last, let's say, two years.

You

have, you mentioned this,

the

middle layers and that we are moving very slowly through the new era. In the two years, perhaps,

yes. The

most innovative cyber security solutions or attacks? The question says solutions,

but

I would like to add also

attacks.

So because of the always evolving threat landscape, sophistication of the threats, explosion of threats, you know, there are statistics that say every week you have one million new malwares. Sometimes it's mutation of existing malware. You take a malware, the code of the malware, you switch some lines of the code, and it's a mutation. It's the same family, but slightly different.

Still

manages to bypass all your protection. And then there are what we call APTs, like very sophisticated malwares, also an explosion of it. The

increasing

complexity of this threat landscape has meant that you have had, over the last ten years, a

very

big, very significant amount of entrepreneurs seeing an opportunity and saying, okay, to this threat I would propose this solution, to this threat I would propose this solution. And the result of this in the corporate market, in the enterprise environment, is that it has created a lot of complexity. There are, again, good statistics around how many cyber security products the average enterprise is utilizing.

And

this is about 20 to 30, sometimes it goes, you know, it grows in complexity with the size as well, 50 security products in many enterprises. All of them not build to talk to each other in the case of an incident. And so, for me,

overall,

the, you know, innovation belongs to hackers, unfortunately. And very, very sophisticated hackers. You have to

get

away from

that

mentality of a hacker is just a bad boy with his, you know, hoodie in a dark corridor in some university. These are nation states, well equipped with a lot of budget from these nations to do major attacks on infrastructure, on entire hospitals, on entire, it is really an increasing, and

that's

the innovation. The nation state attackers, such as China, such as Russia, such as Iran, are the big innovators in cyber security. On the solution side, though, because we have reacted and created such a fragmented environment, for me, one of the most interesting

solution

innovation is around what we call SOC automation and orchestration. SOC is a security operation center where all these security products are being managed. There is a lot of fatigue from the people who work in these environments. If you, if we have some of them here, maybe you recognize yourself in that. They have to react constantly to false positives, to an attack. And when there is an attack, make sure that they write Python codes so that the attack that infected one product is not going to go into the other product.

Very

manual, very reactive, very manual,

very reactive, very

terrible job. And

one

of the good innovations there has been really artificial intelligent solution that connects, that creates the sort of connecting tissue between all the different security products that an enterprise has, so that when there is an attack in, let's say, your mobile phone, because you've downloaded the wrong document,

it

doesn't affect your network. It does it in an automatic way. It helps the security analysts in the SOC to sort of focus really on the key part and not just do this reactive manual work. So, yeah, I would say SOC automation and orchestration is one of my favorites. There has been a big acquisition recently in that space. And there are interesting competitors as well. So, that's my long answer. Sorry.

Something

to add?

Any

further questions or comments from the floor?

If

that's not the case, I would like to say something or repeat something that has been said here today

in

one of the comments that were sent.

I

often tell my customers, the comment says, we should have more common sense, which is good, not just for cybersecurity in particular, but for life in general.

So

anyway,

I

want to thank

the

person who sent that comment, because I totally agree with it. And I want to

thank

our dear experts for their presentations and for their comments and answers right now.

We

are learning

what

the path is and to stay on the right path

together.

Thank you.

Thank you. Right

then.

It's

time now to go for lunch

so

we can come back all full of beans or whatever else is served.

That

was a joke from the interpreter.

But

again, we'll be back at three.

Ready

to start.

Uh, hey, I'm

Pierce.

Yes. With that russian methodsball narrative. Being positive. Heave E Ter entscheidly, I saw a miracle advisor.