WEBVTT 00:00:05.700 --> 00:00:08.265 Hi everyone, I'm Mirjana Ciobanu, Lead Editor 00:00:08.265 --> 00:00:11.000 with The Papers, a global financial publication, 00:00:11.400 --> 00:00:14.217 and we are live at Cyberrevolution with 00:00:14.217 --> 00:00:17.900 Andrzej Kawalec, Head of Cybersecurity for Kodak On 00:00:17.900 --> 00:00:18.500 Business. 00:00:18.700 --> 00:00:19.000 Hi. 00:00:19.300 --> 00:00:21.000 Andrzej, yeah, hi, nice to meet you. 00:00:21.200 --> 00:00:24.500 And I'm curious to learn more about your professional background. 00:00:25.300 --> 00:00:28.298 And yeah, you once said that security is the 00:00:28.298 --> 00:00:31.500 enabling layer for innovation, maybe to connect 00:00:31.500 --> 00:00:32.400 this to ideas. 00:00:33.100 --> 00:00:39.000 So as you said, so I'm responsible for security for Vodafone business, which we look after 00:00:39.100 --> 00:00:44.400 six or seven million different businesses around the world, and they face a vast array 00:00:44.500 --> 00:00:45.200 of threats. 00:00:45.300 --> 00:00:47.822 But I think, you know, what I've learned over 00:00:47.822 --> 00:00:50.400 the years running large security organizations 00:00:50.400 --> 00:00:59.600 as CTOHP, working with NATO and other people, is that security really isn't an environment 00:00:59.600 --> 00:01:00.700 to say no in. 00:01:01.100 --> 00:01:02.200 Security lets you go faster. 00:01:02.500 --> 00:01:04.700 It lets you use technology in a better way. 00:01:05.100 --> 00:01:10.300 I often describe it as the brakes on a car, and nobody would say, well, the brakes don't 00:01:10.300 --> 00:01:11.200 let you go faster. 00:01:11.500 --> 00:01:16.300 But actually, if you ask any racing driver, what's the most important part of the car? 00:01:16.300 --> 00:01:17.000 It's the brakes. 00:01:17.000 --> 00:01:18.200 They let you slow down. 00:01:18.500 --> 00:01:22.300 They allow you to drive faster because you know you can stop if you need to or you can 00:01:22.900 --> 00:01:23.500 navigate the road. 00:01:24.200 --> 00:01:26.100 So I would say security is like the brakes on a car. 00:01:26.500 --> 00:01:30.100 They let you go faster and then they can stop you when you need to. 00:01:30.500 --> 00:01:35.700 And I think if you think of it that way, not only does it protect you, but it enables you 00:01:35.700 --> 00:01:38.200 to use the digital world in really cool ways. 00:01:38.500 --> 00:01:41.353 I think if we hold on to that, then security 00:01:41.353 --> 00:01:44.400 isn't the department of no, it's the department 00:01:44.400 --> 00:01:45.400 of go faster. 00:01:46.100 --> 00:01:51.600 Since you mentioned go faster, and Vodafone has lots of customers, users, and some of 00:01:51.700 --> 00:01:54.400 them, many of them are SMEs. 00:01:55.400 --> 00:02:03.900 I am curious if I were the seesaw of a small merchant or payment service provider, how 00:02:03.900 --> 00:02:10.700 can I make my car go faster and how can I make sure that I have the right brakes taking 00:02:10.700 --> 00:02:14.500 into the fact that there are many things that I should be concerned about? 00:02:14.500 --> 00:02:19.300 So first, what should I be concerned about and then how to pull those brakes? 00:02:19.800 --> 00:02:21.100 Yeah, that's a great question. 00:02:21.300 --> 00:02:24.800 And I think we talk to a lot of our customers. 00:02:25.000 --> 00:02:30.300 We have over 1.6 million people who consume our security services every day. 00:02:31.100 --> 00:02:38.200 But what we've noticed is, you said, if I was the seesaw for a small organization, small 00:02:38.200 --> 00:02:40.300 organizations don't have seesaws. 00:02:41.000 --> 00:02:43.300 They don't have chief information security officers. 00:02:43.300 --> 00:02:45.100 They don't have a security team. 00:02:46.500 --> 00:02:51.900 At best, they're a group of people trying to do their very best, you know, in retail 00:02:51.900 --> 00:02:56.900 or manufacturing or services, but they don't have an IT team and they don't really 00:02:56.900 --> 00:03:01.600 understand the same big challenges that are facing everybody. 00:03:01.800 --> 00:03:11.800 Governments, banks, Vodafone, we're facing a dynamic and relentless threat, an 00:03:12.100 --> 00:03:16.100 adversary that's trying to steal our secrets, our data and our money. 00:03:17.300 --> 00:03:21.600 We face technology that's moving faster than we can really keep up with. 00:03:22.200 --> 00:03:23.400 We'll talk about AI, I'm sure. 00:03:23.800 --> 00:03:24.900 But what does that mean? 00:03:25.200 --> 00:03:26.500 Small organizations don't know. 00:03:27.700 --> 00:03:33.500 And we're also facing regulation that is complex, sometimes aggressive and often 00:03:33.500 --> 00:03:36.500 different by country, by region, by state. 00:03:37.000 --> 00:03:42.700 So if you're a small business, you look at that picture and you're not a security 00:03:42.400 --> 00:03:48.200 expert, you're really, really bewildered about, as you said, which brakes to buy, 00:03:48.900 --> 00:03:51.000 which controls to put in place. 00:03:51.400 --> 00:03:54.400 And small customers just need help. 00:03:55.100 --> 00:04:00.700 So we looked across Europe and there's, I think, 24 million small businesses across 00:04:00.700 --> 00:04:01.500 the European Union. 00:04:02.400 --> 00:04:08.700 That's nearly, that's the vast majority of all businesses in the EU, 85 million 00:04:08.900 --> 00:04:09.400 employees. 00:04:11.200 --> 00:04:17.000 And two thirds, so two out of every three of those organizations, do not have a plan 00:04:17.100 --> 00:04:17.600 for security. 00:04:18.900 --> 00:04:20.400 And then what's the plan? 00:04:20.500 --> 00:04:21.500 How can we help them? 00:04:22.100 --> 00:04:26.500 Well, I think it starts, it starts with, as you would at home, you know, if I said 00:04:26.500 --> 00:04:29.100 to you, what's the most important things in your house? 00:04:29.800 --> 00:04:34.900 And you talk about, well, it's, you know, sensitive objects, it's possibly my 00:04:34.900 --> 00:04:40.700 passport, maybe it's money, it's of course, my family, my loved ones, my pets. 00:04:40.900 --> 00:04:43.900 And I think you have to go through that process with your business. 00:04:44.100 --> 00:04:46.400 What is the most important assets you have? 00:04:46.700 --> 00:04:47.900 And how do you protect them? 00:04:48.600 --> 00:04:52.200 How do you use them, but lock them up when you're not using them? 00:04:52.500 --> 00:04:54.100 How do you protect your employees? 00:04:55.000 --> 00:04:59.700 When you think about each person in your organization, their identity, their 00:05:00.000 --> 00:05:04.700 devices, their email, how would you train them and let them understand where to go 00:05:04.700 --> 00:05:06.600 in the event of a cyber fire? 00:05:07.200 --> 00:05:11.800 When you think about it through the lens of the most important things I have, the 00:05:11.800 --> 00:05:17.900 most important people I have, and then particularly, what would I do if there was 00:05:18.000 --> 00:05:18.600 an emergency? 00:05:19.300 --> 00:05:20.300 Who would I call? 00:05:21.100 --> 00:05:23.300 Who would, you know, who would be my cyber fire brigade? 00:05:23.300 --> 00:05:26.500 If you can answer those questions, you've made a massive step forward. 00:05:27.400 --> 00:05:32.300 So now you've portrayed a bit of the strategy, the points to take back home, 00:05:32.300 --> 00:05:36.600 but now I'm thinking strictly of technology and technological solutions. 00:05:37.800 --> 00:05:39.600 What those solutions might be? 00:05:39.600 --> 00:05:42.200 AI, digital identity, both, more? 00:05:43.100 --> 00:05:44.300 It's a great question. 00:05:44.400 --> 00:05:48.300 So I think it comes down to, again, what do we use the most? 00:05:49.500 --> 00:05:52.500 Genuinely, so identity is super important. 00:05:53.100 --> 00:05:57.900 Understanding the digital identity, how you authenticate your passwords, your 00:05:57.900 --> 00:05:59.400 permissions, really important. 00:06:00.100 --> 00:06:06.300 The things we use, the devices, the laptops, the phones that we all carry all day 00:06:06.300 --> 00:06:10.800 every day, that we use to connect, and the, you know, the applications. 00:06:11.400 --> 00:06:13.200 So really controls around those. 00:06:13.600 --> 00:06:18.400 So endpoint detection, identity, as well as, you know, application and SaaS 00:06:18.400 --> 00:06:18.900 services. 00:06:19.200 --> 00:06:20.500 Those are really, really key. 00:06:21.500 --> 00:06:25.400 I think, so focus on an employee, a focus on secure connection. 00:06:26.500 --> 00:06:30.300 So can you really work securely from anywhere? 00:06:30.700 --> 00:06:35.800 As we learned through the pandemic, being able to work for extended periods of time 00:06:35.800 --> 00:06:39.400 and collaborate with people around the world in different homes, in different 00:06:39.400 --> 00:06:44.000 cities, in different countries, can you work securely from anywhere and connect to 00:06:44.000 --> 00:06:45.200 anything that you need to? 00:06:46.200 --> 00:06:53.600 And then I think the third sort of discrete solution is being able to monitor and 00:06:53.600 --> 00:06:55.000 detect and respond. 00:06:55.800 --> 00:07:00.900 So there's MDR, there's managed security services, where something like, you know, 00:07:01.000 --> 00:07:07.200 Vodafone or any partner can really help you and tell you when you're being attacked 00:07:07.300 --> 00:07:09.100 and what you should do. 00:07:09.400 --> 00:07:14.100 We're all trained, I think, from an early age, you know, in the event of a fire, 00:07:14.800 --> 00:07:19.600 right, an alarm will sound, and you should exit the building and you'll be met by 00:07:19.600 --> 00:07:24.200 somebody, you should use the stairs, not the lift, you should, you know, take one 00:07:24.200 --> 00:07:25.700 important thing, not wait. 00:07:26.600 --> 00:07:29.500 Most cyber emergencies don't have those rules. 00:07:29.800 --> 00:07:31.900 People don't understand where to go, what to do. 00:07:32.700 --> 00:07:38.100 So for example, if you're being, you know, the subject of a cyber attack, should you 00:07:38.100 --> 00:07:39.200 use your email or not? 00:07:39.700 --> 00:07:42.000 Should you turn your computer on or not? 00:07:42.000 --> 00:07:47.900 At that point, you need advice, you need somebody that you can speak to, who can 00:07:47.900 --> 00:07:50.300 advise you and say, that's great. 00:07:51.500 --> 00:07:56.200 We've got it from here, go and have a cup of tea, you'll be OK. 00:07:56.700 --> 00:07:58.600 And I think everybody needs that peace of mind. 00:07:58.700 --> 00:08:02.600 So really focus on the employee, the individual, the controls around identity and 00:08:02.600 --> 00:08:07.400 device and application, connect securely from anywhere to anything. 00:08:08.200 --> 00:08:13.100 And we, you know, there's lots of ways of doing that and then really have somebody 00:08:13.100 --> 00:08:14.000 there who's got your back. 00:08:15.000 --> 00:08:20.600 So when that emergency does happen, you've got somebody you can speak to, somebody 00:08:20.600 --> 00:08:22.300 you can help and advise you. 00:08:22.800 --> 00:08:28.500 And if I were to work with somebody that would help me through all of this process, 00:08:30.100 --> 00:08:33.300 would it be challenging for me to implement all these systems? 00:08:33.300 --> 00:08:34.800 So what should I do? 00:08:35.100 --> 00:08:41.000 Should I change my employees' mindset to integrate all this within my business? 00:08:41.500 --> 00:08:48.300 I think that's such a really brilliant question or discussion because you picked on 00:08:48.300 --> 00:08:51.000 two things. One is, is this hard to integrate? 00:08:50.900 --> 00:08:56.800 Yeah. Yes, it's hard for trained IT and security professionals. 00:08:58.000 --> 00:09:04.200 Big organisations have on average 90 different security controls that they try to 00:09:04.200 --> 00:09:04.500 integrate. 00:09:04.500 --> 00:09:09.100 So I've seen at this event, put all the boxes and numbers, yeah. 00:09:09.100 --> 00:09:12.500 But small organisations have an average 17. 00:09:13.000 --> 00:09:17.800 You ask most small organisations, could you name the 17 security controls you have? 00:09:18.200 --> 00:09:20.900 You've already bought. And they wouldn't know. 00:09:21.300 --> 00:09:23.000 So, yes, they need to be integrated. 00:09:23.000 --> 00:09:28.200 I mean, we take a very simple approach that says these things need to work together and 00:09:28.200 --> 00:09:32.400 need to give you a single traffic light view of your organisation's risk, right? 00:09:33.100 --> 00:09:34.800 Are you A, B or C? 00:09:34.900 --> 00:09:36.500 Are you good or bad? How does that work? 00:09:37.600 --> 00:09:43.700 But the second point you raise is, I think, is as important and that's the people. 00:09:44.200 --> 00:09:46.100 The people, yeah. Changing behaviours. 00:09:46.200 --> 00:09:51.900 Changing behaviours or actually helping people become more literate around security, 00:09:51.900 --> 00:09:54.600 help them understand what the things are. 00:09:55.100 --> 00:09:58.300 We often, in security, we describe people as the weakest link. 00:09:59.500 --> 00:10:01.900 We say things like there's no patch for people. 00:10:02.300 --> 00:10:04.300 Well, actually, we should turn that on its head. 00:10:04.800 --> 00:10:06.900 People are your first line of defence. 00:10:08.200 --> 00:10:11.600 And helping them understand the risks and recognise threats. 00:10:12.300 --> 00:10:20.000 We asked about 3,000 people in the UK very recently if they felt prepared to respond to 00:10:20.000 --> 00:10:21.300 an AI phishing attack. 00:10:21.900 --> 00:10:25.300 Ninety five percent of them said no. 00:10:26.700 --> 00:10:27.400 Ninety five. 00:10:27.500 --> 00:10:31.300 So we need to help people, almost everybody. 00:10:31.600 --> 00:10:35.600 I mean, would you feel comfortable responding to an AI phishing attack? 00:10:35.900 --> 00:10:39.600 The rest were the CISOs from big corporations. 00:10:40.100 --> 00:10:46.700 So we really have to keep investing in our people, helping them understand the risks and 00:10:46.700 --> 00:10:52.300 know what to do when they get that email or that phishing attack that looks real, but 00:10:52.300 --> 00:10:56.900 they're not sure. We're the first people to really question things, but know what to do 00:10:56.900 --> 00:11:04.500 when that happens. So training and awareness and that human risk is as important as the 00:11:04.500 --> 00:11:06.400 technology and the security risk. 00:11:07.000 --> 00:11:11.300 And since we mentioned technology, security, we're here at the cyber revolution. 00:11:11.800 --> 00:11:16.300 What are some trends or ideas that you take back home from the event? 00:11:17.300 --> 00:11:19.200 I think there's a couple of observations. 00:11:19.500 --> 00:11:26.100 One is, as you said, security is so complicated, so many different aspects of it. 00:11:26.700 --> 00:11:33.400 And as an industry, we need to really simplify security for businesses of all sizes. 00:11:34.100 --> 00:11:36.500 I think it's something we can do better at. 00:11:36.700 --> 00:11:39.600 So my first observation is we make things deliberately complicated. 00:11:40.500 --> 00:11:47.300 Secondly, when we start to think about the promise of, let's take AI, there's huge 00:11:47.300 --> 00:11:53.300 advantages from a defensive perspective, but there's also huge advantages for the 00:11:53.300 --> 00:11:56.800 attackers. And I think that's what makes security so dynamic. 00:11:57.300 --> 00:12:07.600 Every time we create a new piece of defensive technology or control or process, we need 00:12:07.600 --> 00:12:09.400 to keep improving our brakes. 00:12:09.500 --> 00:12:14.500 As our cars get faster, we need to improve our brakes so that they never stand still. 00:12:14.900 --> 00:12:17.800 And there is room and there are room for experts in this. 00:12:17.900 --> 00:12:23.400 But we need to really make sure we understand how to deliver these things at scale. 00:12:23.800 --> 00:12:24.600 Yeah, great. 00:12:25.000 --> 00:12:25.800 Thank you, Andrzej. 00:12:26.000 --> 00:12:30.800 And yeah, we look forward for our next interview, next edition. 00:12:31.300 --> 00:12:33.000 Hopefully we'll film it within a car. 00:12:33.200 --> 00:12:34.100 That would be amazing. 00:12:34.900 --> 00:12:35.500 Thank you. 00:12:42.100 --> 00:12:42.400 Thank you.