Uncategorized

Gareth Maclachlan

Trellix, which was formed around a year ago, is the result of a merger between FireEye and McAfee. It is a global organization serving approximately 45,000 enterprises. Human exploitation in cyber threats revolves around three main tactics: familiarity, urgency, and personal or corporate cost. Cyber attackers use familiar elements to manipulate users into making decisions that benefit the attackers. They create a sense of urgency, forcing users to act quickly without thinking critically. Additionally, they exploit the personal or corporate cost associated with certain actions, making users more likely to react as desired by the attackers.

One common type of cyber attack is VIP impersonation, where attackers use a text message from a CEO or executive, requesting the recipient to perform unusual activities. However, this tactic is often ineffective as such activities are typically not part of regular business practices.

Credential phishing, on the other hand, is a common and highly effective cyber attack method. Attackers run campaigns focused on obtaining users’ credentials, often using pop-ups or fake login pages that mimic reputable companies. The stolen credentials can be valuable to the attackers for further malicious activities.

Another approach used by cyber attackers is exploiting usual business activities. For example, they may send invoices or resumes through email, taking advantage of the fact that users are more likely to trust such communication as everyday business practices. By doing so, the attackers bypass users’ natural suspicion towards email and successfully launch their attacks.

Security firms should focus on assisting customers in safeguarding their organizations from cyber threats. It is crucial to avoid blaming users for system failures, as this approach creates a culture of fear and discourages individuals from reporting potential threats. Gareth Maclachlan argues for a different perspective on cybersecurity, emphasizing the need to investigate how an attack bypassed the system, rather than blaming individuals who may have clicked on malicious links or fallen victim to other tactics.

Traditional phishing training methods may inadvertently desensitize employees to actual threats. Research suggests that employees feel they understand the risks and may miss genuine threats as a result. It is important to consider alternative approaches to phishing training, such as personalizing the training using AI and LLMs, to increase its effectiveness.

Recognizing and praising individuals who successfully identify and report genuine cyber attacks can encourage a behavioral norm of recognizing that security is everyone’s responsibility. This proactive approach to positive reinforcement could decrease the likelihood of mistakes in the future.

Psychologists can also play a role in understanding and dealing with cognitive biases that impact data security. Gareth Maclachlan contemplates the role of psychology in this context and acknowledges his own biases in his perspective.

When considering digital transformation in regions like the Kingdom, it is essential to view security from a broader perspective beyond just enterprise security. Gareth Maclachlan highlights the large scale of digital transformation in the Kingdom and suggests that minds should open to consider security in relation to systems and spaces beyond individual enterprises.

During incidents, it is important to focus on learning from system failures rather than blaming users. This approach promotes growth and improvement in security practices.

Publicly celebrating and recognizing employees when they correctly report potential threats can contribute to a culture of security awareness and employee engagement.

Performing regular checks on all applications, particularly hosted software-as-a-service applications, is crucial to avoid compromise. Organizations can be compromised if a customer or individual uploads a hostile file.

In conclusion, the summary highlights the importance of understanding how cyber attackers exploit human vulnerabilities and the need for security firms to prioritize assisting customers in protecting their organizations. It emphasizes the significance of taking a system-focused approach to cybersecurity rather than blaming users for system failures. Additionally, the summary explores alternative approaches to phishing training, the role of psychologists in addressing cognitive biases, and the need for a broader perspective on security in the context of digital transformation.

Moderator – Lucy Hedges

The threat of cyber attacks in today’s interconnected and digital world is larger than ever before. Cyber criminals are taking advantage of human cognitive vulnerabilities, exploiting weaknesses in human nature within cyber systems. They employ various tactics to exploit human fallibility and compromise cybersecurity.

To address these vulnerabilities, industry-industry collaboration is crucial. By working together, industries can explore elements of human error and gain insights into the psychological factors that make humans susceptible to attacks. This collaborative approach can lead to the development of effective strategies and measures to reduce cyber vulnerabilities.

One area where human vulnerability is evident is in the realm of social networks. Many people are unaware of the extent to which they reveal personal information on these platforms. This lack of understanding puts individuals at risk, as attackers can exploit this information for malicious purposes. Attackers are becoming increasingly sophisticated and can use personal data shared on social media platforms to impersonate friends and family members, effectively deceiving individuals. This highlights the importance of being selective and cautious with the information shared online.

Lucy Hedges, a cybersecurity expert, emphasises the significance of understanding and managing the information shared online. She shares anecdotes of individuals who have fallen victim to cyber attacks as a result of their personal information being exploited. While living in the online world can be beneficial, it is crucial to exercise caution and be mindful of the information we share.

Furthermore, there is a need for workplaces to promote caution and awareness towards potential cybersecurity threats, particularly those that come through emails. Hedges recalls an incident at her former workplace where a cyber attack occurred due to an employee interacting with a malicious link. It is essential for organisations to create a culture that encourages vigilance and provides training on identifying suspicious emails and other potential threats.

In conclusion, the threat of cyber attacks is ever-present in today’s digital world. Human cognitive vulnerabilities are exploited by cyber criminals, and it is vital to address this issue through industry collaboration. Individuals must be cautious about the information they share on social networks, as attackers can use personal data for malicious purposes. Additionally, workplaces should promote awareness and caution towards cybersecurity threats, especially those via email. Being alert and proactive is essential in combating cyber vulnerabilities and protecting personal and organisational data.

Prof. William H. Dutton

The discussions focused on important themes such as cybersecurity and cognitive biases, highlighting several key points and arguments.

One significant issue that was discussed is the confirmatory bias, which is the tendency for individuals to believe information that confirms their existing beliefs. It was emphasized that this bias can be exploited, as people are more likely to accept and share information that aligns with their preconceived notions. This poses a challenge in combatting misinformation and propaganda, as individuals tend to seek out information that reaffirms their own opinions.

The emergence of cognitive politics was identified as a consequence of cognitive warfare. It was revealed that in the past, attitude shaping was common, but now the focus has shifted towards shaping beliefs about a particular subject matter. This manipulation of beliefs through cognitive tactics raises concerns about the trustworthiness of information on the internet and its impact on society.

Blaming users for succumbing to cyber threats was strongly argued against. It was emphasized that blaming individuals solely for falling victim to cyber attacks absolves others who are involved in cybercriminal activities. Instead, open communication and collaboration were suggested as necessary approaches to rectify and avoid future issues. By discussing suspicions or experiences with phishing or scams, people can collectively learn from each other’s mistakes and work towards a safer online environment.

The adoption of a cybersecurity mindset was identified as an increasing trend among internet users. There is a growing awareness of the cybersecurity implications of every action taken online, as people are becoming more conscious of the threats and seeking to protect themselves. This shift in mindset is encouraging and demonstrates a proactive approach towards personal cybersecurity.

Addressing cybersecurity threats was viewed as an ongoing process that requires an ecosystem-wide approach. It was recognized that everyone, from the top to the bottom of an organization, has responsibilities towards cybersecurity. This highlights the need for collective efforts to ensure a secure online environment.

Psychologists were seen as playing a significant role in cybersecurity by educating users about their psychological tendencies. It was noted that human bias and the tendency to confirm existing biases play a significant role in the propagation of misinformation. Therefore, educating individuals about these biases can help them recognize and mitigate the impact of these tendencies on their online behavior.

While acknowledging the positive aspects of social media, such as networking and information exchange, it was suggested that more support should be given to smaller organizations and individuals outside the corporate sector. Data showed that smaller organizations and individuals in non-corporate sectors did not receive as much support as larger organizations and SMEs. Addressing this disparity in support is crucial to ensure that all entities have the necessary resources and knowledge to protect themselves online.

In conclusion, the discussions highlighted the need for individuals to take an active role in ensuring cybersecurity. The confirmatory bias, cognitive politics, and the importance of a cybersecurity mindset were all significant points of focus. Open communication, collaboration, and the involvement of psychologists were recognized as important measures in combating cyber threats. Notably, addressing cybersecurity challenges were seen as requiring a collective effort that involves individuals, organizations, and society as a whole.

David Chow

David Chow, an experienced IT expert, provides valuable insights into the complexities of cybersecurity, with a particular emphasis on the human aspect. He highlights the challenge posed by the human factor, stating that while technical aspects such as patching and network assessments can be effectively managed, the human element presents a bigger challenge. Exploiting cognitive vulnerabilities, such as appealing to emotions or curiosity, can be a significant avenue for cyberattacks.

Chow gives an example of potential scams that exploit human nature, such as seeking donations or manipulating curiosity. This underscores the need for individuals to be vigilant and aware of these cognitive vulnerabilities to prevent falling victim to such attacks.

Furthermore, Chow discusses the importance of background checks and personal security measures in mitigating cognitive vulnerabilities. Drawing from his experience at the White House, he explains that extensive background checks, FBI reviews, and financial assessments are crucial in making informed decisions and minimizing risks associated with those who may exploit cognitive vulnerabilities.

Regarding news consumption, Chow observes a clear pattern where different political administrations tend to prefer news channels aligned with their political ideologies, demonstrating confirmation bias. During Republican rule, Fox News, a conservative news channel, is the preferred choice, while CNN is commonly watched during Democrat rule. This highlights how political biases can shape news consumption and potentially influence public opinion.

Addressing user responsibility, Chow argues against solely blaming IT professionals for cybersecurity breaches. He conducted a phishing exercise that revealed the need for users to be more vigilant and take responsibility in ensuring cybersecurity. He emphasizes that everyone plays a role in cybersecurity and that it is a collective effort.

Chow also warns against excessive sharing of personal information on social media, as it can make individuals vulnerable to frauds and scams. He shares a personal experience of receiving a fraudulent text asking for an Apple gift card, which targeted him based on the information he had shared about his new job on social media. This highlights the importance of exercising discretion and being mindful of the information shared online.

In conclusion, Chow’s analysis underscores the multifaceted nature of cybersecurity, highlighting the need to address the human aspect and cognitive vulnerabilities. Measures such as background checks and personal security are essential in mitigating risks. Awareness of confirmation bias in news consumption and the importance of user responsibility contribute to establishing a strong cybersecurity culture. Lastly, his experience with social media scams serves as a reminder to exercise caution and respect individuals’ privacy when sharing personal information online.

Philippe VALLE

The analysis highlights several key points regarding cybersecurity and social engineering. One important aspect is the prevalence and impact of attacks based on human vulnerability, commonly known as social engineering. Attackers exploit the information available on social networks to gain the trust of their victims. This underscores the need for awareness and education to combat social engineering attacks. The analysis suggests that training sessions within companies could play a crucial role in educating individuals about social engineering techniques and how to identify and avoid falling victim to them.

However, it is also mentioned that blaming the user for cybersecurity breaches is counterproductive. Human error is an inevitable factor in any system, and it is unrealistic to expect individuals to be perfect in preventing all cyber threats. Instead, it is argued that a system-based approach should be adopted to address the root causes of cyber attacks. This observation underscores the importance of having robust cybersecurity measures in place, such as implementing multi-factor authentication and regularly updating access management policies.

The analysis further suggests that companies should establish quick incident reporting systems to effectively respond to cyber incidents. Time is of the essence in handling incidents, and prompt reporting can enable response teams to address the issues in a timely manner. This recommendation aligns with the notion that incident management should prioritize quick reporting and response rather than focusing on blaming individuals.

When it comes to application design, the analysis emphasizes the need for a balanced approach that considers both security and user-friendliness. Applications that are too difficult to access or operate may be bypassed, while those perceived as easily accessible may be seen as weak in terms of security. Therefore, application designers should aim to strike a balance between ensuring the security of transactions and providing a user-friendly experience.

Regarding data and application access, the analysis highlights the importance of clear and strong access management policies that focus on segmentation or zero trust. Defining who has access to what in terms of applications and data is crucial in controlling security, and monitoring access levels is considered good practice. Additionally, the implementation of multi-factor authentication is seen as crucial for organizations to enhance security and prevent unauthorized access. These measures can significantly contribute to safeguarding sensitive information.

An additional noteworthy observation is the need for regular updates to access management policies when people change roles within a company. As responsibilities change, so should access rights, ensuring that individuals only have access to the data and applications necessary for their current position.

In conclusion, the analysis highlights the significance of addressing social engineering attacks, the importance of implementing robust cybersecurity measures, the need for quick incident reporting systems, the balance between security and user-friendliness in application design, and the crucial role of access management policies and multi-factor authentication in maintaining data security.

Moderator – Lucy Hedges:
Philippe Vallee, Executive Vice President, Digital Identity and Security, Thales Lucy Hedges, Moderator, Technology Journalist and TV Presenter Professor William Dutton, Martin Fellow, Oxford University’s Global Cybersecurity Capacity Centre Emeritus Professor, University of Southern California David Shaw, Global Chief Technology Strategy Officer, Trend Micro Getting that selfie in there David, I like that. Hi everybody, it’s great to be back on stage here at the Global Cybersecurity Forum on Day 2. I hope you’re all having a fantastic day so far and after Day 1, I don’t doubt for a second that today is going to be another brilliant day of informative and insightful discussions like the one we’re about to have on stage right now. So in today’s interconnected and digital world, the threat of cyber attacks is larger than it’s ever been before, I don’t need to tell you that. And what makes this subject particularly intriguing is that it’s not just about technology, it’s about human nature as well. So we’re going to unravel the mystery behind why humans often fall prey to cyber attacks from phishing emails and social engineering, there are countless tactics that cyber criminals employ to exploit human fallibility and our cognitive vulnerabilities as a clear point of weakness in cyber systems. And my brilliant bunch of esteemed panellists are going to explore the elements of human error and shed light on the psychological factors that make us susceptible to these kinds of attacks while offering insights into the potential benefits of industry-industry collaboration and how we can better protect ourselves and ultimately reduce cyber vulnerabilities to create a more secure cyberspace for everyone. We’ve got a diverse range of experts with various backgrounds, so I don’t doubt for a second that this is set to be a very insightful conversation. So Philippe, Gareth, Bill, David, how are you? Great. Thanks, Lucy. Excellent. Very well, thank you. It’s good to have you. So I think a great place to start would be by really setting the scene. Let’s kind of paint the bigger picture by asking what are cognitive vulnerabilities in the context of cyber security, and how do they differ from technical vulnerabilities? And anyone can grab that one first. Don’t be polite.

David Chow:
Sure. I guess I can start since everybody’s looking at me. So my name is David Chow. I want to share a little bit about my past experience working as an IT practitioner. I worked in the U.S. government for 20 years, and also working at the White House for President Bush and President Obama. And coming from an IT practitioner standpoint, that I can handle all the technical aspect from the technical vulnerabilities, your patchings, your exploits, your network assessments, anything related to that. But the hardest part to defend is actually the human aspect. The human aspect in terms of every day, everybody goes through on a daily basis, they have their daily motions, you have your kids that you have to take care of. You may feel up, you may feel down, but because of that daily changes, you may click on something that you typically don’t click on. Or somebody could potentially try to exploit your softer side. Somebody could be saying that, try to appeal to your nature and say, hey, we’re seeking for a donation. We’re looking for this. Would you mind help us with something like donating certain money? So you click on the link out of curiosity, and then all of a sudden that creates some sort of cyber attack. I want to share very quickly about an example. It’s not entirely related to cybersecurity, but it’s definitely focusing on cognitive vulnerability. When I was working at the White House, we had to go through an extensive background investigation. Obviously, you’re serving the president, you have to do that. We also have to go through… FBI reviews, personal interviews, neighbor interviews, as well as going through your assessments of your financial background. The whole concept there is actually to ensure that there is not a level of cognitive vulnerability. So you’re making the right decisions, you’re not hanging out with the wrong crowd, you don’t have large sum of money coming in, or you’re not incurring any debt. So that in a way, it’s more from the physical personnel security standpoint, but it’s actually tie into the cyber as one enhance on practice and better cyber maturity.

Moderator – Lucy Hedges:
Thanks, David. Anyone want to add anything to that?

Gareth Maclachlan:
Yeah, I’ll add a bit. So just to kind of give you a little background, Trellix was the merger of FireEye and McAfee that we brought together about a year or so ago. And we cover about 45,000 enterprises across the globe, a lot here in the kingdom. One of the things that we see is always the attack and really the attempt to exploit the human part of it really focuses maybe on kind of three things. It focuses on familiarity. Does it look like something a user is used to doing? Is there a sense of urgency, something which is like forcing you to make a decision faster or behave in a way that you wouldn’t normally do? Is there a personal cost? Maybe it’s a corporate cost, maybe it’s a personal cost. For example, if I look at my own email that comes to me personally, I seem to have an addiction for buying antivirus software. I must sign up for a year’s worth of Norton antivirus at least once a week. So you kind of get this idea that you might have lost your own money, so you’re more likely to respond to it. And for us, try to understand those bits, see how attackers are starting to exploit them and get people to act almost against their better judgment because putting some of those stresses on them really gets to the heart of the human factor.

Philippe VALLE:
One point, these attacks based on people or let’s say human vulnerability are called also sometimes social engineering. By social engineering, you connect to social networks, which means that people often do not know the number of information they are releasing to the public by putting all their life on their social networks. Typically, one of the things that could be done in training session, for example, within the company is to explain to people how they could retrieve, for example, the stock of information that Facebook has on them, I should say Meta, has on them about their personal life. Because, I mean, those attackers are using that core information to attack and like was said previously and pretend that they know very well the person. So let’s be very careful about the level of information we leave every day on the different social networks.

Moderator – Lucy Hedges:
It really is quite unbelievable how many people don’t really realize that the information that they put out there, especially on social media, is so susceptible to these kind of attacks. You know, we’re under the impression that this data that was being owned by these big companies is potentially private, but, you know, these attackers are getting smarter and smarter by the day and being able to tune in to all these personal details is really quite mind-blowing. I know so many people that have been, you know, attacked by their personal information that they’ve put online and I think it’s important for us all to realize that living your life online is fantastic, but also be very selective about the kind of information that you put out there as well. So what about cognitive biases, guys? What does this mean and how does that affect our behavior online? Do you want to go for that, Bill?

Prof. William H. Dutton:
I think, you know, this might be a way of broadening the discussion a bit, because I think we usually mean by cognitive biases what psychological… predispositions do we have that could be played with by bad actors and I think or with information that they may have and I think that’s the general way we think about cognitive biases but I my own personal view is that I think more and more the biggest issue is confirmatory bias that is we all want to confirm what we already believe to be the truth and and this it applies to hacking I mean if we really want our printer fixed and we’re in an emergency and somebody approaches us and say hey I can fix your printer and log on here and whatever then you’re you want to believe that because it it meets a need I mean but I think in another way cognitive biases have a much broader it’s a very broad area that we’re talking about and I would I would link it right now to the the rise of what what I would call cognitive politics which is the it derives from the emergence of cognitive warfare in the sense that in earlier days we take up a propaganda and influence campaign and advertising shaping your opinion shaping your opinions about a person or a product or a thing and I think increasingly propaganda and influence campaigns are focused on challenge on shaping your beliefs so instead of shaping attitudes were shaping beliefs what is the truth so what is the border of this country what is the history of this person and so forth so that what that means is increasingly we shape where how people vote or how people side with different issues by shaping their beliefs about the whole subject matter. And so this is really a big issue where I think that, I don’t know if it’s too broad for this panel, but I think that we have to think more and more about cognitive politics because it undermines what we believe and it may undermine, you know, it may really harm trust in the internet and trust in information because we don’t know whether we’re being played by particular individuals or trying to shape what we believe rather than simply whether we’re positively or negatively disposed to a person.

David Chow:
Yeah, it’s enough to make you super paranoid, isn’t it? Can I give an example? Okay. So when I was, obviously I worked for three different presidents and when there’s a change in administration, you see that the television, the television news channel that the political appointee watch is actually different. So when Republican is actually in charge, you see Fox News. That’s conservative news, right? And then when you see Democrats, when they’re in charge, you actually see pervasively CNN. So that’s an example where they want to be confirmed of their viewpoints, these politicians or these political appointees. And that’s very interesting in terms of rather than looking from a broader point of view, they just want to confirm their own assumptions and be able to move forward with their assumptions.

Moderator – Lucy Hedges:
Yeah, absolutely. So let’s give a few examples now. You know, what are some of the most common types of cyber attacks? You know, we’ve touched on a few examples, but if you’ve got any more to add, I’m sure the audience will appreciate that. So what are the common types of cyber attacks or psychological tricks that attackers use to manipulate victims and, you know, obviously target these human cognitive vulnerabilities and why are they so effective? Go on, Gareth.

Gareth Maclachlan:
I’ll take that first of all. So one of the things I think it’s also worth thinking about is what’s the call to action that an attacker actually wants? You know, you can spend a lot of time thinking about, you know, how you might construct a phishing email, how you might influence someone and get them to respond to something. But you’ve actually got to get them to do something in order to have an effect. So it might be intelligence operations, as you say. It might be changing the way they think, changing the way they vote. That’s too big for me to worry about, right? You know, working in a cybersecurity firm, I care really about helping our customers keep their organization safe, keeping their citizens safe. And what we’ve seen is, you know, different waves of different attacks. So for example, there’ll be a lot which talk about VIP impersonation. You get a text message from your CEO saying, I want you to go and do something. You must go and do it now. That’s a great way to get people to respond because it’s a position of authority. But what does your CEO normally ask you to do? It’s kind of unlikely that he’s going to say, I need you to transfer money to this organization you’ve never heard of and isn’t set up in your systems. Our business practices go against that. So you don’t get people to act even though the authority is there. And your CEO sending you a text message and say, I want you to run down the road and go and buy some gift cards. That’s not usual either. So it doesn’t work. What does work are things like credential phishing. So we see a lot of campaigns really focused on people trying to get someone’s credentials because that’s the most valuable thing you can use as a way to go launch another attack. So we’ll see pop-ups pretending to be a log on for Microsoft or a log on for Cisco or log on for some other organization. That is quite effective. Very difficult to know what it is. You’re used to it. It’s familiar. It’s a usual action. And it’s incredibly valuable to the attackers. So those sorts of things go through. And then what we see is really people trying to bypass the natural kind of suspicion we’ve built up around email. We all know email is a bad thing. is dangerous. Our antenna are up, we worry about it, we’re gonna think twice before we click on that link. But if you’re working in finance, if you’re working in accounts, you’re working in an HR and a invoice comes through or a resume comes through a CV, well that’s usual so you’ll click on it. So we often think about it’s not just email or something was suspicious, what’s all the other routes in which you may be less aware of or less resistant to might come through.

Moderator – Lucy Hedges:
And it’s that familiarity isn’t it, that’s what really traps people. You know when I was working at the Metro newspaper, we got attacked because someone clicked on a malicious link and it was connected to work. I don’t think it was a CV, I can’t remember what it was, but this email went around and said you know this is happening, we’ve been attacked, so be more aware and just be a bit more cautious when you’re clicking on these links. And it’s a bit frustrating isn’t it, but you know we all have to be cautious, incredibly cautious, especially in a work environment. We do, but just if

Gareth Maclachlan:
I may continue, we also you know avoid blaming the user. Links are supposed to be clicked on. You know we’ve always taken the approach of think how, not who. If someone clicks on a link, well you can’t expect your employees to be perfect every time. You’ve got to ask how did the link actually get there, what failed to put them in that situation. So do you think this kind of

Moderator – Lucy Hedges:
blame the user mentality in cybersecurity is counterproductive, you know, in addressing these issues when it comes to cognitive vulnerabilities?

Philippe VALLE:
For me to be even blunter, every time a CISO or Chief Information Security Officer of a company runs an internal phishing campaign to test, there will always be a percentage point of the population which will click anyway. So you can train the people and so on. So for me, being the victim of phishing attack is not a human error, it’s a technical error. You should have a system, a technology and probably things need to be invented here. to be perfected, but it’s a system answer that we need to provide and not blame somebody for clinking on it. You can be tired, it can be the end of the day, you have been trained, but you are subject to error. That’s human beings.

Moderator – Lucy Hedges:
Yeah, yeah, absolutely. Anyone got anything to add before I move on?

Prof. William H. Dutton:
Well, I mean, I’m totally for this idea, because I think if you blame the user that you let everybody else off the hook. But you’re reminding me, think back to telemarketing. I mean, telemarketing had an economic model where they could send out tons of marketing material to tons of people, but they only needed a small fraction of individuals to be interested in that. And so you could never stop it, because the economic model of that was so successful. And I think it’s similar here where you may see an obvious phishing email in your inbox, and think you’re smart this time. But they send out this to so many people that it may hit another person at the wrong time for that person where they really want that, and it makes sense to them, because at that moment they are looking for this particular aspect or whatever. So even really very intelligent people in really great positions can be fooled by this. And that’s why I think one of the key issues is always to talk to people. If you think something might be a little funny about this, talk to the person next to you or talk to a friend. What do you think this is, a phishing email or whatever? If you have doubts, it probably is, and you should have… But, gosh, the president of a major corporation in the United States years ago, decades ago, clicked on the I love you virus, you know, the I love you. And so, I mean, he’s hitting himself, right? And he was, but he, at least he had the audacity to say, admit that he did this, it was stupid and whatever, but it hit him at the wrong time. He was busy, clicked on this, opened a link, and infected all of the systems in his corporation. So it’s, anyway, I think, don’t blame the user, but every time there isn’t a problem, you should let people know about it. If you suspect it, or if it happened, you should let people know about it so that it can be corrected. If you don’t tell anybody, it’s very hard to correct these problems.

Moderator – Lucy Hedges:
Exactly. And that’s a great rule of thumb. David, I can see you’re ready for Mike.

David Chow:
I just want to provide a slightly contrary view to not blaming the user. And this is based on personal practice. So I was a CISO for a financial regulator within the US, and we sent out this phishing campaign, right? This phishing exercise, basically, we sent an email saying that, you know, see what your colleagues are doing in the lunchroom. So people click on it, right? We sent it to executives, obviously the most high profile target, and then we sent it to everybody else. So the executive director and deputy executive director for the agency clicked on it. They’re the top two career individuals within the agency. So I asked the executive director, I said, why did you click on it? He said, well, you know, I was curious, right? And then I asked the deputy executive director, who’s actually very IT savvy, I said, why did you click on it? And he said, well, I clicked on it because I was curious, plus I know that you IT guys will take care of it if something happens. So I agree with Philippe, when he’s talking about that there There’s technical errors, technical issues that we need to set as practitioners. We need to set the expectation. We need to provide the education. We also need to constantly ensure that our tools is catching ransomware attacks or some other attacks. But at the same time, it starts with everybody, right? Users need to take the mindset of being more vigilant. If we continue to say that don’t blame the user, so if something happens, we blame the CIO or blame the CISO, that’s not fair for the CIO or the CISO or the practitioners either. So I think cybersecurity actually starts with everybody. Perhaps you get one free pass, and there needs to be a level of expectation. But the bottom line is that it has to start with everybody.

Moderator – Lucy Hedges:
Go on, Bill.

Gareth Maclachlan:
I think one of the things that we need to start thinking about as an industry is we spent a lot of time doing phishing training, sending out phishing emails, encouraging people to say, did you click on it or not? Click on it. Ooh, tick. Yes, good. You got it. You found the right thing. There’s a little research now, which is almost starting to suggest that that is training people the wrong way. People are starting to feel like they know what the risk is, and they’re missing things. We’ve been doing some experimentation with, yeah, guess what, AI and LLMs to start looking about can you actually generate personalized training? To your point earlier about the social media information, can you go and create a targeted email to train a user based upon information you know about them? And the second bit for me is whilst we tell people, good job, you caught that phishing email, what we tend not to do as organizations is actually also call out when people find real attacks that have come through. You’re encouraged. You see an attack. You think, I’m not sure about this email. I’ll report it to the IT department. The IT department will come back a little bit later and go, yeah, we investigated. Yeah, that was bad. Well done. That’s it. But actually starting to maybe… report to the company as a whole, this month these individuals found these things and kept us safe. You start to encourage that almost kind of behavioral norm of getting people to actually recognize that security is owned by everyone. My comment around don’t blame the user is you don’t want people to feel that if they do inadvertently forefoul of something, that is necessary weakness. You’re right about they’ve got to keep the antenna up, but trying to find that balance and kind of call out successful activity, successful steps, rather than just punishing negative is always good.

Philippe VALLE:
Yeah. Philippe, did you have something to add to that? No, but it’s similar to what you just said, Gareth. I think instead of having this name and blame approach, which is counterproductive, I think the company should create a notion of the quicker I report this incident to the respond team. A fake or true incident, by the way, the better the security response team can act and address the question. So I think it’s very important that in any company you have an emergency number to be called so that you can report it as quickly as possible, because time is really of the essence. If we need to cut the server from the organization and so on, the response team can do it quickly if they know that something is happening.

Moderator – Lucy Hedges:
Yeah. Oh, go on, Bill, if you’ve got something to add.

Prof. William H. Dutton:
Just to say, just comment on, I mean, I don’t mean, yes, the user, first of all, all of us are users, and everybody from the top to the bottom of the organization and across society are internet users, 5.3 billion users in the world. And so I’m not going to let them all off the hook. I mean, the thing is not to pass on the blame to the user and not fix these issues that enable bad actors to get more access. But there is encouraging. growth of what I would call a cyber, I wrote years ago about the need for a cybersecurity mindset among everyone, all users at all levels. And there’s really a lot of signs that that’s happening, that more of us, if I ask somebody over dinner or visit, you know, what do you think of cybersecurity? They’ll tell me what they do and what they’re thinking about and what kinds of emails they’ve gotten and how they protect themselves. This is the kind of thing that has to happen, that we all have to have a more of a cybersecurity mindset where we’re not thinking of doing this once a week or doing that when I’m told to by IT, but then every day that it’s just a normal habitual part of your life that you think through the cybersecurity implications of everything you do, whether you download new software or answer an email or what have you. And there are signs that that’s actually happening. But again, that’s the challenge of the whole ecosystem of cybersecurity, that we continue to build a cybersecurity mindset so that malicious actors have a much more difficult time stealing your information or informing you and misinforming you.

Moderator – Lucy Hedges:
So staying within the realm of this cybersecurity mindset, we’ve just discussed solutions or measures put in place by businesses to try and help detect and kind of counter these kind of attacks. But how can psychologists be brought into this conversation to help support efforts to detect and counter these kinds of attacks?

Prof. William H. Dutton:
Well, I’m not a psychologist, so I’ll answer that. First of all, you know, everyone wants to blame the technology. You’re getting disinformation because you’re in a filter bubble or you’re in an echo chamber caused by social media. media, are caused by the search engine that you’re looking at. Bull! This is not… You are the biggest algorithm, okay? You are the worst algorithm in the lot, because you’re the one who decides not to look at that, but to look at this, to watch a particular channel and not to watch contrary information. So you have to… Psychologists need to explain to users that they have often psychological propensities like confirming their existing biases, and they have to understand that. And if you understand that, gee, yeah, we all try to confirm exactly our political beliefs or what we want is that somebody loves me and I’m a whatever, then you will challenge that more often. You’ll try to diversify the information you see. You’ll try to find counter-information and look at the arguments of the opponents and so forth. So anyway, I think… But psychologists have to tell us about, you know, raise public awareness not about computing, but about ourselves, about what our propensities are in misusing computing. Yeah, go on, David. Is there a way to use psychology to make people not to use social media? Social media is fantastic. Eighty percent of the people in Britain use the internet. Eighty percent of the internet users use social media. It’s fine. It is… But it’s demonized. And I think what we need to do is try not to… Think about it. Even in cybersecurity areas. The internet is fantastic in terms of shopping, in terms of getting information. People believe, have confidence in what they can find online through search, for example, as much as they do in broadcast television news. And I don’t think they’re wrong. But I think we’re in a time frame in which we’re demonizing all media, but I get it. You do see examples of bad use of social media and bad actors on social media. Good practice, people creating private social media groups on WhatsApp, things like that. People are responding to that, adapting to it. And don’t throw away what is really valuable, networking people. Social media allows you to source the people you want to talk to and not to rely on just the people in your office, just the people in your home, just the people in your school. Extremely valuable.

Philippe VALLE:
Yeah. Go on, Philippe. My two cents of psychology here is also to really work on the balance between security and user-friendliness. Because people tend to, if the application is too easily accessible, whatever the application, it’s weak. If the application is too hard to access or to operate, then people will try to bypass. That’s a two cents. That’s a standard psychological behavior. So what is important, I would say, when we design an application as a company, as a product, when we put an application on the market, it’s important that we think about the usability, the user-friendliness, the way it will interact with the people. Obviously, a higher level of security will be required if the transaction at stake is important, but let’s make sure that we always find that right balance between security and user-friendliness.

Moderator – Lucy Hedges:
Yeah. Yeah.

David Chow:
I do want to demonize social media. Sorry, as a practitioner, this is what I have to say. I do, I’m not faulting that people use their, what they need to use to put their personal lives out there, put their professional lives out there. I don’t have social media account except LinkedIn. And I thought that I was safe, right? I don’t have anything, nobody’s stalking me. So, two weeks after I started working at Trend Micro, I got a text from the CEO. Or you mentioned that the CEO was asking for a gift card, Apple gift card, and she said that she’s at a conference. She just doesn’t have time to talk. Her minutes is running out. So, I was like, okay, so I just interviewed with the CEO. She just brought me on board. What do I do? So, what I did was, I thought this must be fraud, but there’s also inkling that this may happen because she travels quite a bit. I call her assistant, and it’s actually because she’s overseas. I was in the US, she’s in Taiwan. So, it was three in the morning. The guy was upset. The guy basically said, yeah, she’s here. She’s not traveling. So, I realized, okay, I made a mistake in terms of getting into believing that this could be possibly true. And I didn’t put anything on social media except that I started my job at Trend Micro, right? So, I think in a way that people are looking for, bad actors are looking for ways to get whatever information. And when we talked about using AI, we talked about social engineering, the more information that you put out there about yourself, the more vulnerable that you actually become. So, yes, I’m not discouraging you from putting your information out there. This is who you are. This is what you want to do. But I’m just saying that you also have to be extra vigilant in terms of the issue that you may encounter. And also, at the same time, that from a practitioner standpoint, yeah, I mean, this is something that it’s actually frowned upon because somebody can actually use AI to create some sort of a personalized email or letter sent in directly. to you, knowing everything about you, which making you to believe that this person is actually sharing the right information. So you’ll probably click on it. All you need to do is just click on something, click on the wrong link, and you can actually gridlock your entire environment. That’s why I’m demonizing the practice from the, more from the practitioner safeguarding standpoint. But if people wanna continue to use it, that’s their discretion.

Gareth Maclachlan:
Yeah, yeah. Go on, Gareth. I’m gonna go back to that kind of question around the role of psychologists, and particularly the role of psychologists in helping us understand the impact and understanding our own biases. I’m going to admit to maybe two of my own biases right now. The first one thing to me is, you know, when thinking about this panel and thinking about the questions, I was thinking about it really from my own fairly myopic view of keeping companies safe. So I was thinking about enterprise security, how do we do that, what do we do for employees? And it’s really, you know, I was last in the kingdom in 2014, 2015. You know, first time back in eight years. And the scale of digital transformation, the changes that have happened in the kingdom are huge. And so the first bit for me was realizing I was thinking about enterprise security. Suddenly you start thinking about what’s the role of trust and bias and kind of cognitive exploitation in a country like this, which is focused on digital transformation and what it means for citizens. You start to understand that there’s a much broader aspect that we need to go think about. So I think, you know, it’s the combination of, yeah, even us sitting up here as technologists, we think about systems, we think about our own little space, we forget to open our minds each time.

Moderator – Lucy Hedges:
Yeah, it’s kind of looking at it from a bigger picture point of view and all the kind of multifaceted nature of these kinds of attacks. And so time’s running low, so I’m just going to move on to the next one. I think maybe offering up a bit of advice might be quite nice. You know, how can organizations and industries collaborate to share insights and- best practices when it comes to addressing human weaknesses? I’m sure the audience would be interested to hear from you guys on this. Anyone can take it.

Philippe VALLE:
Let me start here, if I can. So I would say this is this notion of segmentation. We have different name for it. The fact that we also call it zero trust, in the sense that you need to define with a fairly strong policy, who has access to what, in terms of application, in terms of data, in terms of you segregate really the different access levels. You monitor it, you check it. And this is a possibility, let’s say, to control, to control, let’s say, the level of security. Something that we will never say enough, implement every time you can multi-factor authentication. This is very, very strong advice. Simple technology, you would not imagine how many companies today don’t even have this kind of simple measure in place for all the application, whether you access them inside or outside. And again, this policy of access management needs to be updated, because I mean, when people are changing job within the company, they are also changing responsibility, so this needs to be updated. It’s fastidious, it’s heavy, but it’s usually a good practice to have.

Moderator – Lucy Hedges:
Yeah, yeah, brilliant advice there. Go on, Gareth.

Gareth Maclachlan:
For me, I’d say there’s three things that I would usually say when I’m talking to a CISO. I mean, first of all, I think it’s that concept of how, not who. So when an incident does happen, you don’t blame the user, you focus on what failed in the systems and the processes and the controls that got there, and you learn from that. The second bit for me is actually celebrating or publicizing when an employee actually does report something correctly, because it starts to. Reinforce, but that’s the behavior that’s expected. You want people to protect the organization. We all have a duty to do that But third for me I mean everyone in this room is very familiar with thinking about risk and about controls and manage that and identifying that’s the one place that I do see as As an industry we’ve tended to Maybe ignore or not think about the risk quite so much is some of the business applications that we’re starting to adopt particularly Hosted software as a service as applications whether those are finance systems HR systems customer care systems. We’ve seen so many organizations actually being compromised because a customer has or a customer has uploaded a file which is supposed to be something that affects sending through or a Individual has made a loan application through a banking portal and what they’ve uploaded is a hostile file Yeah, so being able to scan and do the same checks on all applications as you do on email is one thing I’d always call out. Yeah, you guys have anything to add gone David

David Chow:
From my perspective one is that you have to have the visibility of your risks That is you don’t know what you don’t know But what’s critical is that you need to know what’s going on within your environment so that you can start quantifying their risk level and then Prioritize what needs to be addressed, but then also focusing on people process technology I know I sound like IT practitioner, which I’m very proud of it, but you know Set aside the technology aspect you hear a lot from various vendors I’m part of the vendors community, but the bottom line is that people process is actually the You could be a strength it could also be weakness that one needs to explore to make sure that proper education proper expectation But at the same time not having the proper process procedure lay in so that people can really build a cyber awareness culture I think that’s that’s what’s so critical within the environment You know, I agree with the panel members here that, you know, there is a lot of, you know, blaming the users in a way that I think everybody should be on the hook. Perhaps setting the right expectation, but then after the expectation has been set, focusing on, you know, everybody needs to be vigilant and protecting the environment.

Moderator – Lucy Hedges:
Yeah. Absolutely. Bill, final words from you.

Prof. William H. Dutton:
One thing that probably should be said is we did a global survey of people recently about whether they had more cybersecurity problems working from home or working in different locations and so forth. And we found out that actually working at home wasn’t a problem. Most organizations are set up to support remote working and they have a variety of strategies and we asked people whether their corporate or organization or institution supported like their own laptop from the company. Do they use multi-factor authentication and so forth? We are surprised most companies and most organizations are providing a lot of support so that people can work almost anywhere at any time within a safe environment and they have relatively few problems. But in the very smaller, the smaller organizations and with individuals that are outside the corporate sector, if there’s something that can be done to support those smaller organizations and I don’t, but in terms of those in sizable, in small and medium sized enterprises even are fairly well protected and they, companies are doing a pretty good job actually, pretty good security in a sense.

Moderator – Lucy Hedges:
Yeah. So on that note, that brings us to the end of our conversation. Please give a well-deserved round of applause to my excellent, all knowledgeable panelists Philip, Gareth, Bill and David. Thank you for a brilliant and insightful conversation. It’s great to pick your brain. So thank you. You’re welcome.

Dr. Almerindo Graziano

CyberRanges is a leading vendor of CyberRange technology that focuses on providing large-scale capabilities for experiential training and education in the cybersecurity industry. Almerindo Graziano, the CEO of CyberRanges, emphasises the crucial role of leadership, vision, and alignment with company values in ensuring staff retention. Graziano believes that when a company’s vision and values resonate with its employees, they are more likely to stay, leading to increased loyalty and a stronger team.

In addition to prioritising staff retention, Graziano is passionate about creating value rather than solely focusing on profit. He argues that companies should strive to provide value to their employees and society as a whole, rather than just pursuing financial gains. Graziano’s approach aligns with the principles of responsible consumption and production, as outlined in SDG 12.

The analysis also highlights a concerning gap in skills within the security sector. It argues that this gap exists because security education and training have become commodified, with a primary focus on profit rather than the quality of education and the skills imparted to students. The sentiment here is negative, indicating a concern about the direction in which security education and training have been heading.

To address this gap, the analysis suggests government intervention is needed to increase the accessibility of security education programmes. By starting these programmes in schools and making them more widely available, governments can help bridge the skills gap and ensure that security training and education are accessible to all, not just a privileged few. This approach not only supports SDG 4 (Quality Education) but also aligns with SDG 10 (Reduced Inequalities) by advocating for equal access to education.

Overall, the analysis highlights the importance of CyberRanges’ mission in providing large-scale experiential training and education in the cybersecurity industry. It emphasises the necessity of leadership, vision, and values alignment for staff retention. The analysis also sheds light on the need for a shift towards value creation rather than profit maximisation in the industry. Additionally, it draws attention to the commodification of security education and advocates for government intervention to ensure widespread access to security education programmes, promoting equality and reducing skills gaps in the field.

Oliver Väärtnõu

The analysis reveals key points about Cybernetica and the challenges in the cybersecurity industry. Cybernetica is known for creating mission-critical IT systems based on extensive research and development. They primarily serve governments and critical infrastructure providers. In the evolving cybersecurity industry, attracting and retaining talent is a significant challenge. The Estonian government’s investment in cybersecurity has intensified competition. Companies like Cybernetica are offering perks and aligning workplace values and missions to attract talent. Mismatch between words and actions can lead to talent loss. Creating a positive work environment and engaging employees in research projects contribute to talent retention. Estonia has tripled the number of people studying computer science, but attracting individuals to pursue PhDs remains challenging. Industrial degree programs are being established to bridge the IT skills gap. Successful cooperation between the government and the IT industry in Estonia is essential. Overall, Cybernetica’s expertise and the challenges in the cybersecurity industry highlight the importance of talent attraction, retention, workplace values, education, and government-industry cooperation.

Filippo Cassini

Filippo Cassini is the Global Technical Officer for 4inet, a leading global cybersecurity provider with a wide range of products. His primary role focuses on serving larger, strategic customers and partners by offering top-notch solutions. However, one significant challenge he faces in his position is sourcing highly skilled talent from the market with a minimum of 10 years of cybersecurity experience. Once talent is acquired, retention becomes another obstacle for the company.

In order to attract skilled professionals, Cassini is open to forming partnerships in Saudi Arabia. By establishing collaborations in this region, 4inet aims to tap into the talent pool and bring in qualified individuals to strengthen their workforce. This approach aligns with the company’s goal of achieving decent work and economic growth, as well as promoting partnerships for sustainable development.

The field of cybersecurity constantly evolves with the emergence of new technologies and business models. Staying up-to-date with these advancements is crucial for 4inet. Cassini recognizes the challenge of keeping pace with emerging technologies and adapting to new business models. To tackle this challenge, the company understands the importance of involving and engaging their engineering team. By anticipating future developments and actively involving their engineers in decision-making processes, 4inet ensures that they remain at the forefront of the industry.

Furthermore, engineers in the cybersecurity field prioritize work environments that are not only financially rewarding but also involving, engaging, and entertaining. Retention strategies implemented by 4inet encompass investing in future technologies and creating an engaging atmosphere for their employees. By providing an environment that stimulates growth and innovation, they aim to retain their valuable talent.

In summary, Filippo Cassini’s role as Global Technical Officer at 4inet involves catering to their strategic customers and partners with top solutions. The challenges he faces include sourcing skilled cybersecurity professionals, retaining talent, and keeping up with emerging technologies and new business models. The company’s strategies involve forming partnerships in Saudi Arabia, actively involving their engineering team, and creating an engaging work environment to ensure the long-term success of 4inet.

Jess Garcia

In this expanded summary, we will delve into key points highlighted by several speakers. Oney Security, a leading service provider in digital forensics and incident response, is led by CEO Jess Garcia. Oney Security efficiently responds to incidents and effectively confronts adversaries in customers’ networks.

One notable aspect of Jess Garcia’s work is her active involvement in teaching at the SANS Institute for over two decades. Her teaching engagements have spanned various locations worldwide, showcasing her expertise and commitment to cybersecurity education.

Talent retention in the cybersecurity industry emerges as a complex issue that requires special attention. It is acknowledged that HR departments are designed to handle the challenges that come with managing a large workforce, particularly in large organizations. However, the solutions implemented for talent retention cannot be uniformly applied across the board, especially when there is a shortage of skilled professionals in the market.

Furthermore, the importance of tailoring retention strategies to suit the specific needs and stages of employees’ lives is emphasized. Retaining a 22-year-old employee may differ significantly from retaining a 35-year-old employee. Additionally, it is noted that motivation factors for cybersecurity professionals go beyond monetary incentives.

The necessity for tailor-made solutions is underscored, which involves focusing on knowledge growth and considering motivation factors beyond financial rewards. Recognizing this need, Oney Security has adopted this approach by establishing an oversized HR team and creating dedicated departments such as knowledge management.

Upon analyzing these key points, it becomes apparent that Oney Security, under the guidance of CEO Jess Garcia, is proactive in responding to incidents and threats in customers’ networks. Jess Garcia’s extensive teaching experience at the SANS Institute highlights her commitment to cybersecurity education.

Moreover, the complexity of talent retention in the cybersecurity sector is recognized, and the importance of personalized strategies is emphasized. Oney Security’s focus on knowledge growth and factors beyond financial motivation showcases their dedication to developing effective retention methods.

Overall, this expanded summary showcases the various perspectives on Oney Security, its CEO Jess Garcia, and the challenges and strategies associated with talent retention in the cybersecurity industry.

Orhan Osmani

In a panel discussion on cybersecurity workforce challenges, industry experts addressed the growing number of job opportunities in the field, with 5.5 million jobs currently available. Retaining talent has become a significant struggle for organisations due to the high demand for cybersecurity professionals. Filippo Cassini, Global Technical Officer and Senior Vice President of Engineering at Fortinet, noted that the average industry retention rate is around 20%. However, some companies have successfully achieved a remarkably low 4% retention rate by implementing unique strategies. Sharing these successful approaches with others in the industry was also highlighted as important. Almerindo Graziano, Chief Executive Officer and Co-Founder of Cyber Ranges, pointed out that smaller companies also face challenges in retaining cybersecurity talent, despite having fewer resources. They still need to find effective ways to keep their skilled professionals engaged and committed. Jess, Head of Industry and Partnerships Center for Cybersecurity at 1E Security, shared insights into her company’s retention strategies. Although she did not disclose specific details, she acknowledged the value of a well-defined retention strategy tailored to the needs of the cybersecurity industry. Oliver Vartanu, Chief Executive Officer at Cybrentica AS, emphasized the significance of fostering a collaborative and innovative work environment to retain employees. He stressed the importance of providing a platform for professional growth, teamwork, and knowledge sharing within the company. Vartanu also emphasized the need to avoid toxic work environments in order to create an atmosphere where employees feel supported and valued. Akshay Joshi, Head of Industry and Partnerships Center for Cybersecurity at WEF, highlighted the need to address the demand and supply imbalance in the cybersecurity profession. He emphasized the importance of creating a compelling domain for professionals to attract and retain talent through enhanced education, training programs, and awareness campaigns. The panel also discussed the role of governments and educational institutions in stimulating the supply of cybersecurity professionals. They debated potential actions that governments and education systems could take to encourage individuals to pursue careers in cybersecurity. While specific recommendations were not mentioned, the discussion underscored the importance of collaborative efforts between industry, academia, and governments to bridge the skills gap in the cybersecurity workforce. In conclusion, the panel discussion provided insight into the challenges faced by organisations in retaining cybersecurity talent due to high demand. Strategies such as sharing successful approaches, fostering collaborative environments, and stimulating interest through education and governmental support were discussed as potential solutions. The panelists’ insights offered valuable perspectives on addressing cybersecurity workforce challenges.

Akshay Joshi

The analysis highlights several key points regarding talent management in cybersecurity. Firstly, there is a significant shortage of 5.5 million professionals in the cybersecurity field, which has grown by 2.1 million in recent years. This shortage underscores the urgent need for skilled individuals in this sector. The attractiveness of a cybersecurity career is driven by the potential for greater financial gain and exposure to different areas within the field.

Effective talent retention is crucial for success in cyberspace. A survey of leaders found that 60% view talent attraction and retention as the most important factor in achieving cyber resilience. However, retaining talent in cybersecurity is challenging due to the multitude of job opportunities available outside the industry. People leave not only due to organizational factors but also because of the vast opportunities for career advancement elsewhere.

Limited awareness about cybersecurity as a career option among non-technical individuals is a significant barrier to talent management. For instance, none of the 150 MBA students surveyed were considering a career in cybersecurity, highlighting the need to raise awareness and attract diverse talent to the field.

Recruitment practices also contribute to the talent shortage in cybersecurity. Job descriptions often require highly technical skills and entry-level certifications, making it difficult for newcomers to enter the industry. Misalignment between recruitment practices and the demand for cybersecurity professionals exacerbates the shortage.

Creating clear professional pathways and demonstrating job potential are essential for attracting and retaining talent in cybersecurity. By establishing progression routes and showcasing the numerous opportunities available, organizations can incentivize individuals to pursue careers in the field.

Additionally, prioritizing employee well-being is crucial in such a demanding industry. Burnout is common in cybersecurity and leads to high attrition rates. Providing support systems and prioritizing employee well-being can improve talent retention.

Implemented a widely accepted strategic cybersecurity talent framework is recommended. This framework would provide a cohesive strategy for talent management and help address the talent shortage. Adoption of this framework by the industry and government is critical for success.

Promoting diversity by design is also vital in cybersecurity talent management. By introducing gender diversity and reducing inequalities, organizations can build a more inclusive and innovative workforce.

In conclusion, the analysis indicates that talent management in UK cybersecurity is heading in a positive direction. However, challenges such as the talent shortage, limited awareness, misaligned recruitment practices, and employee well-being need to be addressed. By tackling these issues and implementing the suggested approaches, the UK can strengthen its cybersecurity workforce and effectively combat the growing threats in cyberspace.

Orhan Osmani:
and Chief Executive Officer, 1E Security. Dr. Almirendo Graziano, Chief Executive Officer, Co-Founder, Cyber Ranges. Oliver Vartanu, Chief Executive Officer, Cybrentica AS. Filippo Cassini, Global Technical Officer and Senior Vice President, Engineering, Fortinet. Akshay Joshi, Head of Industry and Partnerships Center for Cybersecurity, WEF. Orhan Osmani, Moderator, Senior Cybersecurity Coordinator, Development Sector, International Telecommunications Union, ITU. Thank you. Good afternoon, everyone. Thank you for joining us here today. And we have a great group of panelists here. We are different from previous panel, it was all female, now all male panel. So the topic is interesting. So we’d like to go straight away into the content of it. I just would like to start with a simple fact, which recently, like two days ago, IC2 released a new report on workforce. And at this moment, we are at 5.5 million jobs available in cybersecurity. And this one creates another challenge for speakers here to retain their talent in their organizations. And to start with, I would just start with a question for all the panelists. I would like to take by order from Almerindo towards the end to Filippo. Just kindly to introduce yourself, your organization, what you do, and what are the challenges currently you face in brief, and then we can go to the rest of the questions. Almerindo, floor is yours. Thank you, Orhan.

Dr. Almerindo Graziano:
My name is Almerindo Graziano. I’m the CEO of CyberRanges. We are a vendor of CyberRange technology, which is specialized in experiential training and education. And we deal with the challenge of providing large-scale capabilities to develop the experience and the professionalism of the young and current generations.

Jess Garcia:
Hello, everyone. I am Jess Garcia. I am the CEO of Oney Security. We are a service provider in the digital forensics and incident response side. What basically we do is threat adversaries in our customers’ networks. And whenever there is an incident, we respond to those incidents in the most efficient way possible. I’m also an instructor with the SANS Institute. I’ve been teaching for SANS for more than 20 years now, all around the globe. So it allows me to see the reality also of all the, let’s say, professionals, and in many cases, young people, who are trying to get a career in this space. So it’s a good balance for this conversation we’re going to be having.

Oliver Väärtnõu:
Hello, everyone. I’m Oliver Värtnö, CEO of Cybernetica, an Estonian IT powerhouse. We say that we create mission-critical IT systems. But before I talk a little bit about Cybernetica, what we do, and what kind of challenges we face, I’d like to thank the organizers, the site and NCA, for once again inviting me to this excellent forum on cybersecurity. And I really value the discussions that we’ve had here. But back to Cybernetica. So we say that we build mission-critical IT systems. And in fact, we have kind of three pillars that are really important for us. The foundation of our work is actually research and development. We really commit our organization to do a lot of work on cybersecurity, on information security, and basically, with that, building our expertise in the domain and pushing the domain forward. Secondly, we build systems for our customers, mostly mission-critical systems, mostly for governments or national critical infrastructure providers. And thirdly, we also provide cybersecurity services in order to help our customers to understand whether their systems are resilient and secure. And yeah, of course, we are facing a lot of challenges when we’re talking about talent attraction and retention. This is a very, very highly evolving industry, and especially in Estonia, where, as our president mentioned yesterday, the cybersecurity budget is growing by the government, I think in the last two years, five times. If you look at the increase of, for example, venture capital into Estonia in order to attract talent, then we are, in fact, operating in a super-competitive environment and have to survive there and have to find our way there.

Akshay Joshi:
Hello, my name is Akshay Joshi, and I lead the broader operations of the Center for Cybersecurity at the World Economic Forum. I feel very privileged to have an opportunity to share some thoughts on the topic today, which is incredibly important, one that we need to address together. We publish the Global Cybersecurity Outlook, a flagship report each year at the World Economic Forum Annual Meeting in Davos. Last year, actually this year, in 2023, when we published it, 60% of leaders that we surveyed came forth and said that they view talent, attraction, and retention as perhaps the single key, most important factor towards cyber resilience. Add to that, Oran mentioned right now that there is a shortage of 5.5 million professionals. It’s important to state that last year, ISC2 shared a number which was 3.4 million. So if we do the math, that number has grown over a period of year by 2.1 million. The shortage is massive, and therefore it generates a supply and demand asymmetry. As long as there is a supply and demand asymmetry, cybersecurity is very attractive for people in the field who continue to pursue opportunities for greater financial gain, and more importantly sometimes for exposure to different areas of cybersecurity. Obviously you want to have dynamic experiences if you’re progressing in the field. So in light of some of these challenges, it puts a disproportionate burden on retention because it’s not just, people are leaving not just because of what you are doing or not doing as an organization, but because the opportunity is so huge. My hope is though that at some point through the public-private efforts, we will be able to reduce this gap, and at that point, I think the single biggest factor that will keep us and be a determinant of how successful we are in cyberspace is essentially a focus on retention, which is what we’re going to be talking about today.

Orhan Osmani:
Filippo?

Filippo Cassini:
Yeah, so my name is Filippo Cassini. I’m Global Technical Officer for 4inet. 4inet is a global leading cybersecurity provider. We do have a large product range. We cover about 40, 45 different technology across our product line, and on my specific role inside the company, it’s essentially focused on our most large and strategic customers and partners, providing top solutions, things which are kind of cutting edge, and considering the span of technology for my company, the challenge is of course to be able to have access to the top people in the market. These people become available to our customers. I’m generally looking for people with at least 10 years of experience in cybersecurity, and of course, once I have them, retention becomes the next challenge, so thanks a lot for having me here. It’s really a pleasure to come and share, and I’m also looking at partnerships inside Saudi Arabia to be able to attract those talent in our company.

Orhan Osmani:
Thank you. Thank you, Filippo. I think I’m gonna go back again to you on a question. How unique is the retention challenge for cybersecurity domain compared to other industries? And considering the new technological developments and so on, as we know, the average of the industry is about 20%. We know some of the colleagues here that have good retention at 4%, and they need to share their secret recipe how they are doing that, but please, from your end, you have 150 staff in your technical team. What are the challenges, and how different are from other sectors? Thank you.

Filippo Cassini:
Yeah, so I would say, as you can see during this event, there’s a lot of discussion about emerging technologies, about what is the future, and that discussion actually forces a lot of interest and a lot of investment in those section, which in turn becomes startup companies. It becomes companies with new business models, with new ideas, and that has a kind of a tendency of attracting the top engineers, those that want to measure themselves and challenge themselves with the new stuff which is available in the industry. So for me, actually, the challenge is actually to preempt that kind of vision, be able to anticipate, and be able to involve my engineering team in what’s coming, something that kind of goes beyond sometimes the immediate interest of the rest of the company, which is, of course, focused typically in selling product. Because in general, engineers don’t only look at the salary, but they also look at how involving, how engaging, how entertaining the environment in which they are is, it is, right? So for me, that’s extremely important, to have a strategy, to work for a company that keeps investing in the future, keeps looking at what’s coming, so that the people inside of it is not just motivated by the revenue, but also by the technology that is coming in.

Orhan Osmani:
Thank you, thank you. Almerindo, your company is smaller than Fortinet. You face similar challenges. Maybe you can give us some insights.

Dr. Almerindo Graziano:
Actually, we are, I don’t know if we are lucky or good, because we actually have a very long tenure in our organization and we retain people very well. My feeling about the retention problem in cybersecurity, which is, I think, much greater than the other markets, because of security being such an important aspect of our life is that many organizations are… I’m sorry, I blame the leadership, as always we should do. And I believe the secret and importance is in leading and communicating the reason why we, as a company, exist and ensuring that we find people that are aligned with our vision and what we want to do. And as a company, our objective is not to make money. Our objective is to provide value. And then you need to find people that believe in that vision in the value that you want to provide. And then you’re gonna have some people that want to be aligned and believe in the vision of increasing the competence level in the world, the education. Some people want to defend the world. Some people want to provide attack tools and offensive tools. And I think it’s in this alignment that you find the strength and the retention, because if we just focus the retention on the financial value, then we compete with each other. But if we focus on the leadership, on the vision, on the value that we want to provide, it will be like auto-sorting algorithms that you see in programming, where people will start to see, okay, I like that leadership. I want to do that. I want to pursue that career. I want to be the best engineer, or I want to be the best trainer, or I want to be part of this team. And that’s where I think the leadership in a lot of organization is losing the focus, because they’re so driven by making money, which is ultimately, obviously, a byproduct of running a business, that they forget the reason why they create a company in the first place. And people, often, the biggest reason why they stay in the organization is because they marry a vision. They marry the culture. And the accumulation of people that believe in the vision makes it much harder then to leave the company, because then you don’t only live in the vision, but you live in a group of people that all believe in the same thing. And I think that’s the secret.

Orhan Osmani:
Thank you, Al. And I have a next question, but, basically, you have touched upon it, so I would like to address it to Jess. Maybe just continue where Al left it, because he opened it very well for you. What are the strategies? How do you do on your end? And so maybe you can share that recipe as well, like Al Merino, the 4% retention rate, which you have it in your company, would be a great story. Thank you.

Jess Garcia:
Thank you very much. I would like to make a differentiation, as we here all come from cybersecurity companies. Obviously, we are biased, right? Obviously, many of you are from other industries, and you may wonder, well, what if my industry is not cybersecurity? So I will make a differentiation. First, I will talk a little bit of how we see things, and then I will try to put myself in the skin of other organizations out there which have the same problem, but are not cybersecurity-focused. So the first thing I think which is very important is to understand that this is a very complex problem. We try, and our HR departments are designed to deal with large amounts of people, especially for large organizations, right? And they need, because of the size, because of how they are structured, to have a homogeneous process for all of them. What is the problem? When we come to a specific area, it may be cybersecurity, but it may be other areas where you don’t have so many people available in the market, you cannot apply the same solutions. And I think that’s the biggest problem we have, large organizations have for retention. If you try to apply the same policies for, let’s say, individuals who are in high demand, you’re gonna be failing, right? So that’s the first step. How do you solve that problem? The first thing is try to build a tailor-made, let’s say, suit for that collective. One of the things is exactly what Almerindo was saying. You need to motivate them. One of the most important things to understand in the cybersecurity sector is that individuals are not motivated by money, most of the times. Second is there is a difference between the different stages in their lives, and it’s not the same trying to retain someone who is 22 than someone who is 35, right? It’s gonna be a very different retention strategy. And you need to understand all these things. What we do specifically in my company, we’ve created, our company has, for instance, I don’t know the statistics, it probably is a very, very oversized HR team to be able to do that retention policies. We have created departments like knowledge management to make sure that they are motivated. They all the time are challenged to get more knowledge, which is one of the things that motivates all of us in the cybersecurity industry. Become a better professional. Tackle more complicated things. Those are the things that are gonna be motivating and retaining your talent. If your process is done, contemplate these specific things, unfortunately, you will not be able to retain them, okay? So my first advice would be, we need to adopt a posture where we focus on the policies that will retain those specific communities, and we make them, as Almerindo was also saying, a leadership thing, right? Because otherwise, HR will just do their jobs, and that’s not gonna be enough.

Orhan Osmani:
Thank you, Jess. Olivia, I think I would like to follow up on what we are discussing here, maybe to add, this is what management can do to provide platform for people to grow inside the organization. But when you provide the platform, how the teams inside do innovation, teamwork, how that one changes the momentum in the company in terms of helping people to stay in the company? Because for sure, you don’t want to work in toxic environment. You want to work in an environment where people work together and share. How do you do that in your company?

Oliver Väärtnõu:
Yeah, first of all, I want to kind of give you a background a little bit about Estonia and the rate of transformation. So ever since Skype was sold to eBay and Microsoft, Estonia has been kind of quoted as the unicorn country in the world. And that has basically created a super competitive environment for talent. As, again, our president said yesterday, we have eight unicorns coming out of a country which is most per capita in the world. And Cybernetica is not a unicorn, but nevertheless, we have to compete in this market. And we have to also service our government and service our e-government ecosystem in order to protect it. So basically, we’ve been pushed a lot by our startup sector, actually, to take on a lot of the schemes for retention and attracting talent. When I came to Cybernetica, that was 10 years ago, the things were not that competitive. But nowadays, we have to offer all kinds of perks to people because they think that if you work in Bolt or Wwise or Microsoft, you expect the same thing to get also from Cybernetica. So we’ve done all that. And then we’ve also worked a lot on our values and on our core proposition to people. So why are we here? What is our mission? What are we doing? So we want to create a better world, a safer cyberspace. And we have to, like was said in the previous channel as well, we have to follow our actions through, actually. So these values, that is super important. When people nowadays see that you are talking one thing and doing another thing, then you’re starting to lose a lot of talent. What else we have done is we’ve started to look at how to bring interesting projects to people. Like I mentioned, we have one arm research, one arm development, third arm cybersecurity services. And nowadays, we are creating these cross-functional, cross-discipline teams inside Cybernetica to work on research topics, applied research topics. Whether it’s in the usage of AI for cybersecurity, whether it’s applying post-quantum encryption to certain, for example, electronic identity technologies, or whether it’s securing AI. So we offer people to work on research projects, to take away from their day-to-day jobs to work with top researchers and also top universities to find a little different way to their day-to-day jobs. This is not for everybody, but this is definitely something that these smart, ambitious people that Filippo was also referring to are actually looking for. And once they’ve done that, they can continue or move back to their day-to-day jobs and work there.

Orhan Osmani:
Thank you, Oliver. Question for Akshay. You mentioned earlier, you mentioned we need to address the demand and supply asymmetry. What actionable measures can be taken to create the cybersecurity as a compelling domain for profession and so on?

Akshay Joshi:
Thank you very much. So you know, it takes me back. I went to business school in the UK, and a few months ago, I was actually back to interact with the students. Obviously, because I work in cybersecurity now, the topic moved towards cybersecurity and how it’s a promising domain. 150 students in the class, eventually you go for an MBA program, you have some amount of student debt, and you’re looking to land a promising career. If you took a guess, how many, what percentage of that group of 150 was considering a career in cybersecurity? Would there be any guesses? Zero. It was literally zero percent. And that’s the point. That you know, there is very limited awareness about cybersecurity as a career option for anyone who is not a technical expert. If you extend it further, and you speak to anybody in the cybersecurity industry, and you know, I mean, at the World Economic Forum Center for Cybersecurity, we have the unique privilege of speaking to some of the best minds in cybersecurity. Every leader has a lot of openness when it comes to hiring people from different domains. What happens when you get down to the job description? The job descriptions, essentially, are very technical in nature, and require certifications such as CISSP, CISM, and others, which an entry-level person trying to make a foray or a lateral move into cybersecurity cannot feasibly have because the way they are designed is they require a certain amount of experience. So we’re not putting money where our mouth is. We’re saying that we are open, we want to bridge that gap, that number keeps on going from 3.4 to 5.5, but at the same time, the approaches that we are taking to bring talent into the workforce are not, I wouldn’t say nobody’s doing it, but we’re not doing it at a scale that we can create opportunities for people. So at one level, there is a need for awareness. At a second level, there is a need for making sure that our recruitment practices are aligned, and eventually, we then need to go on to create pathways for people. And a lot of what my colleagues mentioned was about interesting opportunities. What happens once you enter the workforce? You need meaningful opportunities to be able to develop, and that’s the role of pathways over there. One of the other elements that I want to highlight is specifically around well-being. And that goes towards one of the strategic cybersecurity talent frameworks that we are developing at the Center for Cybersecurity at the World Economic Forum. The fourth element that we want to consider beyond what I spoke about is essentially well-being. This is an extremely demanding profession for anybody who’s gone through the ranks, and I think all my colleagues over here essentially have, can probably attest to the fact that this job comes with a lot of demands. How are we making sure that the people who are working in this domain have their well-being and interest taken care of? Mental well-being, I mean, a lot of people actually leave the industry because of burnout. So how are we creating the right mechanisms for people to join and thrive in the workforce is a big question for all of us. So for me, a strategic cybersecurity talent framework is essential, and it needs wider acceptance across government and industry as a whole.

Orhan Osmani:
Thank you, Akshay. I think, just I would like to ask the panelists here about what do you think about what governments and education can do about supply? Is there anything you can add on on that component? Do you think something can happen in the education industry or governments can do something to stimulate?

Dr. Almerindo Graziano:
Yeah, sorry if I may add. Yes, please. I think that one of the biggest problem that the gap, the skills gap exists today is because over the years, security education and training is become a business with the objective of making money. And we’ve lost sight of the value that it actually provides to society. So accessibility, I wouldn’t say commoditization, but definitely accessibility of educational program at university, starting from earlier age, even from high school or earlier, then university increases dramatically the uptake of security, the skilling. But if we live in a society where the training and education is only accessible to the few, then it becomes very difficult to then elevate the state of security and have more people involved in cyber security. And I would like to see more of that from the government. I can see how great activities being done in this country from that viewpoint. But across the world is not that common or not that accessible all the time. So that’s something that can really make a difference.

Orhan Osmani:
Thank you, El. Oliver, you wanted to add?

Oliver Väärtnõu:
Yeah, so we have in Estonia together with the industry really worked in cooperation with the government in order to have more talent to be brought to the IT sector and the cyber security sector. So we have, in fact, in the last 10 years, I think tripled the amount of people that are studying computer sciences in the Estonian universities, both bachelor’s degrees, master’s degrees. We are having little bit of a trouble attracting people to do their PhDs in computer science because just everybody sees that it’s so much easier to work, that’s number one. Secondly, the community is constantly providing input into the curriculum. So what do we see, what do we want from the universities that these young people should be trained about? So we have actually every year discussions with our IT academies on what are the specific skills that we are looking for in addition to, of course, basic programming skills, math, et cetera, et cetera. And finally, in order to make this smooth transformation, we are putting a lot of effort actually into training programs and even doing industrial bachelor’s degrees, industrial master’s degrees, industrial doctorate degrees. So there is a very, very kind of intertwined community that is pushing this industry forward. And currently it’s working. We are having problems with these top people trying to attract people into doing their PhDs because working is very lucrative at that point in time. But it requires the government to be open and it requires the government to listen to the industry. And we have that trust.

Orhan Osmani:
Thank you, Oliver. I think we’re running out of time. If anyone has something quick to say.

Akshay Joshi:
I think the only thing that I’d like to probably add is that the kingdom is doing this extremely well, but I think there is an opportunity as we bridge this gap and that is to introduce diversity by design. So I’d really encourage us to think about that element as well.

Orhan Osmani:
Sure, thank you everyone. And thank you for listening to us. And if anyone wants to catch up with us, we can be around so we can talk to you. Thank you very much for applauding for the speakers. Thank you very much.

Ken Naumann

The speakers in the analysis delved into the intersection of AI and cybersecurity, exploring various key aspects. They expressed concerns about the potential manipulation and poisoning of AI systems by hackers, which can have negative consequences. Hackers continuously find new ways to access AI and manipulate its data, resulting in erratic or even malicious behavior of AI systems. This highlights the alarming issue of AI systems becoming challenging to control once they have been manipulated.

The analysis also highlighted the regulatory challenges associated with AI technology. It was noted that regulations and standards for AI often struggle to keep up with the rapid pace of technological development. The adoption of generative AI has surprised the speakers considerably over the last year and a half, emphasizing the need for regulations and standards to effectively oversee and ensure the responsible use of AI.

The discussion further addressed the importance of establishing standards for the role of AI in cyber activities. The cyber community was urged to collaborate and develop these standards to effectively harness AI’s potential in enhancing cybersecurity, shaping the ethical and safe implementation of AI in the cyber domain.

Additionally, the analysis explored the significance of secure cross-border data sharing for improving AI. The speakers highlighted the role of data sharing, emphasizing the need to share data across country borders securely. This step would optimize AI capabilities and enable greater global collaboration in AI-driven initiatives.

The analysis also examined the role of leadership in determining AI’s responsibilities. It was agreed that leaders need to make careful decisions about when to entrust more responsibility to AI technology. Safety, honesty, and the protection of current job holders were stressed as paramount considerations when integrating AI into various sectors.

Moreover, the analysis discussed differing perspectives on the timeline and approach to integrating AI into various roles. While some individuals believed AI could take over the analyst role in a short period of three to five years, others argued for a more measured and gradual process.

An interesting observation was made regarding the evolving role of cybersecurity specialists. It was suggested that their responsibilities might expand beyond protecting the environment to include safeguarding AI systems. This evolution reflects the increasing significance of cybersecurity in the context of AI technology.

In conclusion, the analysis highlighted the potential risks and challenges associated with AI and cybersecurity. The importance of addressing the manipulation and control of AI systems, bridging the gap between regulations and rapid technological advancement, establishing standards for AI in cyber activities, and promoting secure cross-border data sharing were emphasized. Additionally, the need for careful decision-making by leaders and the evolving role of cybersecurity specialists in protecting both the environment and AI systems were discussed.

Moderator – Massimo Marioni

Title: The Critical Role of AI in Securing the Future

Summary: The panel discussion titled “AI’s role in securing the future” focused on the importance of leveraging AI to identify and address cybersecurity vulnerabilities in a constantly evolving online landscape. The panelists stressed the need for advanced systems capable of early risk detection and effective communication to individuals.

With the rapid pace of technological advancements, integrating AI is crucial in enhancing online safety. The session highlighted how AI can proactively identify and resolve security issues before they cause significant harm. Dr. Helmut Reisinger, CEO of EMEA and LATAM at Palo Alto Networks, provided impressive examples of how AI is currently being used to address cybersecurity vulnerabilities.

However, Ken Naumann, CEO of NetWitness, discussed the challenges of manipulative tactics used to exploit AI systems. Understanding these tactics is critical in safeguarding the integrity and security of AI systems.

Looking ahead, the panel discussed the potential of AI to make cyberspace safer. They emphasized the importance of talent development to further advance AI capabilities. As AI evolves rapidly, individuals must receive adequate training and education to keep up with developments in the workplace.

The panel also addressed the complex issue of global collaboration in establishing regulations for AI. Despite differing opinions on AI usage, finding a way to set regulations is essential. The example of Italy wanting to ban a specific AI technology highlighted the complexity of this challenge. The panel agreed that international cooperation is necessary to establish and enforce regulations across borders.

The session concluded with a discussion on striking a balance between promoting innovation and mitigating risks. The panelists, as senior leaders, offered insights on implementing rules to achieve this balance effectively.

In summary, the panel discussion emphasized the significant role of AI in identifying and mitigating cybersecurity vulnerabilities. It underscored the importance of talent development, global collaboration, and effective regulation to harness the potential of AI while managing associated risks. Safeguarding the future of digital security necessitates strategic implementation of AI technologies.

Sean Yang

The analysis focuses on the importance of AI governance and training in preparing for AI in the workplace. It emphasizes the need for different stakeholders to receive tailored training and awareness to effectively fulfill their responsibilities. This includes AI users, technical vendors or providers, government regulators, third-party certification bodies, and the public. Stakeholders must have a clear understanding of their roles and responsibilities in relation to AI.

Decision makers, such as executives who make policies and strategies, need to improve their awareness about AI and understand the risks associated with AI applications. A top-down approach to AI governance is often employed, where executives play a crucial role in making informed decisions. Therefore, it is necessary for decision makers to possess a comprehensive understanding of the risks associated with AI.

Furthermore, the analysis highlights the need to review and update traditional engineering concepts, such as software engineering, security engineering, and data engineering, in light of the rapid development of AI technology. The integration of AI into various industries necessitates the adaptation and improvement of existing concepts and practices.

The role of universities and educational institutions is also emphasized. It is noted that many universities still utilize outdated textbooks in their AI and software engineering courses. To bridge this gap and ensure that graduates have the necessary skills for the industry, universities should update their training materials and curriculum to align with current industry practices. This collaboration between industry and academia can help address the skills gap and ensure that graduates are well-prepared for the AI-driven workplace.

Another important point made in the analysis is that AI is a general enabling technology and should be viewed as such, rather than as a standalone product. The focus should not only be on AI technology itself but also on the management of its applications and scenarios. This highlights the need for AI governance to manage the entire AI lifecycle, from design to operations, to maximize its potential benefits and mitigate risks.

The analysis concludes with the assertion that AI is a people-oriented technology. It highlights the potential of AI to support and serve people, as well as the importance of AI governance in improving its applications. This perspective underscores the need for responsible and ethical development and deployment of AI to ensure positive impacts on society and individuals.

Overall, the analysis emphasizes the significance of AI governance and training in effectively preparing for AI in the workplace. It provides insights into the specific needs and responsibilities of different stakeholders, the importance of decision makers’ awareness of AI risks, the need to update traditional engineering concepts, the importance of collaboration between universities and industry, and the people-centric nature of AI. These insights can guide policymakers, businesses, and educational institutions in developing strategies and frameworks to harness the potential of AI while ensuring its responsible and beneficial use.

Helmut Reisinger

The analysis reveals several key points regarding the role of AI in cybersecurity. Firstly, AI is essential in dealing with the rapidly growing cyber threat landscape as it enables faster detection and response. Palo Alto Networks, for example, detects 1.5 million new attacks daily, and with the use of AI, the meantime to detect is reduced to just 10 seconds, and to repair is reduced to one minute. This highlights the significant impact that AI can have in combating cyber threats.

It is argued that reliance on AI for cybersecurity is inevitable due to the speed, scale, and sophistication of threats. In the past, the time between infiltration and exfiltration of data was 40 days in 2021, but AI reduced it to 5 days last year. It is believed that AI has the potential to further reduce this time to a matter of hours, demonstrating its importance in responding effectively to cyber threats.

Additionally, machine learning and AI are regarded as crucial for cross-correlation in cybersecurity. By cross-correlating telemetry data across various aspects such as user identity, device identity, and application, machine learning algorithms can provide valuable insights for detecting and preventing cyber attacks.

The analysis also highlights the need to consolidate security estate for end-to-end security. With around 3,500 technology providers and medium to large enterprises using 20 to 30 different security tools on average, the cybersecurity sector is currently fragmented. This fragmentation leads to a lack of intercommunication between tools, which hinders the effectiveness of security measures. Therefore, it is important to streamline and integrate security tools to ensure comprehensive and cohesive protection against cyber threats.

Challenges arise with the use of open-source components in coding. While open-source coding is prevalent, with 80% of code created in the world utilising open-source components, the presence of malware in just one open-source library can have a significant snowball effect, compromising the security of the entire system. This highlights the need for caution and thorough security measures when working with open-source components.

Furthermore, the analysis underscores the importance of considering regional regulations and governance in cybersecurity. While cybersecurity is a universal topic, different regions and countries may have varying standards and regulations. For example, Saudi Arabia has specific governance on where data needs to be stored. Adhering to and adapting to these regulations is crucial to ensuring compliance and maintaining the security of data.

The analysis suggests that convergence of global standards on cybersecurity, data governance, and AI regulation is expected in the future, although it may not happen immediately. This convergence would provide a unified framework for addressing cybersecurity challenges worldwide and supporting global collaboration.

Real-time and autonomous cybersecurity solutions are deemed crucial in the current landscape. As the time between infiltration and exfiltration of data shrinks, the ability to respond in real time becomes increasingly important. AI is seen as a prerequisite for highly automated cybersecurity solutions that can effectively detect and mitigate threats in real time.

It is highlighted that the effectiveness of AI in security is reliant on the quality of data it is trained on. Good data is essential for achieving the desired outcome of rapid detection and remediation. Therefore, organizations should ensure that they have access to the right telemetry data to maximize the effectiveness of AI in cybersecurity.

Policy makers are advised to encourage the growth of AI in cybersecurity while being aware of its risks. AI is a driver on both the cybersecurity and attacker side, with an observed 910% increase in faked/vulnerable chat websites after the launch of GPT chat. Therefore, policies should address the potential misuse of AI while promoting its benefits in enhancing cybersecurity.

Lastly, the analysis highlights the interdependence of cybersecurity and AI for the safety of digital assets. Both are crucial for providing real-time cybersecurity solutions. However, the integration of AI and cybersecurity is necessary, as AI without cybersecurity or cybersecurity without AI will not be as effective in protecting digital assets.

In conclusion, the analysis emphasizes the importance of AI in addressing the growing cyber threat landscape. It provides evidence of AI’s effectiveness in faster detection and response, cross-correlation in cybersecurity, and the consolidation of security measures. However, challenges with open-source components and regional regulations need to be considered. The convergence of global standards is expected in the long run, but real-time and autonomous cybersecurity solutions are currently crucial. The quality of data used to train AI is essential for its effectiveness, and policymakers should encourage AI growth while mitigating risks. Ultimately, the interdependence of cybersecurity and AI is crucial for safeguarding digital assets.

Moderator – Massimo Marioni:
AI’s role in securing the future. Dr. Helmut Reisinger, Chief Executive Officer, EMEA and LATAM, Palo Alto Networks. Ken Naumann, Chief Executive Officer, NetWitness. Sean Yang, Global Cybersecurity and Privacy Officer, Huawei. Massimo Marioni, Moderator, Europe Editor, Fortune. Hello everyone. Hello everyone. Welcome to the panel titled AI’s role in securing the future. Now, in today’s world, where there are always new online dangers, we really need elite systems to warn us early about these risks. And technology is changing fast. So that’s why AI has become super important in keeping us all safe online. Now this session is all about how AI can fix and find online security problems and identify them before they cause great damage. So we’ll start off by asking Helmut, can you start by explaining how AI can be used to identify and mitigate cybersecurity vulnerabilities? And can you tell us about any cool ways that that’s already been done?

Helmut Reisinger:
Yeah. Good afternoon, everybody. As-salamu alaykum. I am representing Palo Alto Networks. We are a cybersecurity specialist. And just to give you one number, we are detecting every day 1.5 million new attacks that have not been there before. Newly individual identifiable attacks. This cannot be done by humans. So AI is part of the solution. And we have been doing AI machine learning for more than eight years now. We did not start when JetGPT, the generative AI, was announced. And it’s built across our different platforms. And why is that important? Because we believe that the threat landscape that you are facing here in the kingdom, in the region, but also globally, and this has been shared since the morning, is actually exponentially growing. And AI brings three dimensions to it. It’s gonna be more speedy, or it allows for more speed on attack side. It allows for more scale. Ransomware as a service. Now you can even program it and get scale and speed. And it will allow for an even higher sophistication if you think about social engineering. And taking this together with the ingredients what drives the threat landscape that is exposing you as public organizations, as enterprises here in the kingdom, which is geopolitics is a driver. A driver is your supercritical infrastructure that you have here supplying energy to the world. It’s the AI and digital transformation that you’re having. And with that, we believe you need to leverage AI on that. And how do we do that? Is we combine telemetry data of security from firewalls, networks, the cloud assets, and we provide it then into security operation center solution that we provide. And that gives an outcome based on AI, which is basically 10 seconds meantime to detect and one minute meantime to repair. Because the topic is that the speed, the time between infiltration of an organization and exfiltration of data is shrinking. It was about 40, I think I heard it in the morning as well, somebody said it was two months in the OT infrastructure people were wandering around. It was about 40 days, 2021. It’s been five days last year. And with AI, it’s gonna be a matter of hours. So in a nutshell, AI enables what we believe is the future, which is real-time cybersecurity and highly automated cybersecurity. Because we human beings, we cannot deal with all of that at the same time. A borderless space.

Moderator – Massimo Marioni:
So how AI can identify and nip these risks before they happen. Ken, on the flip side, what are some of the common tactics used to manipulate or poison AI systems that we need to be aware of?

Ken Naumann:
Yeah, I think many of the techniques being used now are really not that different from typical techniques that everyday hackers use, right? And what these criminal organizations are doing or nation-states that are pointed in the wrong direction are coming up with ways to access… Sorry, that’s a drone that’s going around. That came up in the last panel I did. Try to ignore it. Coming up with ways to access AI and poison the data. So creating situations where AI is starting to hallucinate, starting to actually act as a bad actor within an organization’s environment. And once that gets out into the wild, it’s really hard to bring back in. So as these organizations become more sophisticated and are able to access the data, controlling the AI and manipulating these models, you are going to start to see AI take on a life of its own that was deployed for the benefit of an organization actually turn against that organization. And hackers are currently working on that today.

Moderator – Massimo Marioni:
Now, looking ahead, what do you see as the future for AI making cyber safe a safer helmet?

Helmut Reisinger:
Well, if I take into account… By the way, that’s a good example here. It’s a very noisy drone. That’s easily identifiable. If you have digital threats, they are not as easily identifiable. And this is why what we at Palo Alto always do is we cross-correlate with machine learning and AI. What do we cross-correlate? We cross-correlate telemetry data for cyber security, as I said, across firewalls, networks, cloud assets, and endpoints. And we cross-correlate the behavior, the user identity, the device identity, and the application. And out of this cross-correlation, which you need to do by machine learning and AI, then you can apply the right models and then you come to the outcomes of 10 seconds mean time to detect and one minute mean time to repair. So this cross-correlation is critical. And what we see, and I think this is for the whole of the cyber security industry that we are all representing here, as a challenge is that today’s system are very, or the industry itself is very fragmented. There’s 3,500 technology providers out there. On average, a medium to large enterprise in the kingdom, in Germany, in the United States is using between 20 to 30 different tools to protect the digital assets. But they don’t talk to each other. This is why we fundamentally believe, what Gartner is also saying, we need to help you on a modular basis to consolidate your security estate so that you have an end-to-end security in whichever cloud you have your workloads, and also from code to cloud. We heard the CEO from Aramco speaking about the importance of OT, and there’s a lot of code being created. The problem is 80% of the code that is created in the world, also here in the kingdom, is using open-source components. Now the problem is if one of these open-source libraries contain malware, you have a big snowball effect. And again here, identity, device, application and behavior cross-correlated with AI. This is the way how to sort it.

Moderator – Massimo Marioni:
Sean, I can see you at the end there. Building a pool of talent is a key factor for progressing AI. So what kind of classes or training do people need to prepare for AI in the workplace, especially when AI keeps changing at such a rapid rate?

Sean Yang:
Yeah, thanks for asking. I think in recent days, and suddenly AI getting very hot. Every country, they start working on AI and AI-related security. And I would like to see, like the GCF, and all the people working here and trying to improve the international consensus on AI governance. But if you’re talking about the real classes, to answer your questions, I would like to see first, we need to think about what kind of structure we need to build. Now, we should like to say AI governance, we need to have different roles. Just like one of the speakers mentioned about, like cybersecurity is a team sport, and same like AI. Now we identify with five rules. First one is AI user, like the enterprise or like anyone who apply AI to their product and to their production or to their daily enterprise operations. The number two is technical vendors or the AI providers. And also the government regulators and the third party certification body and also the public peoples. Because eventually AI’s application will significantly impact their life. Okay, if we identify the different multiple stakeholders, then different stakeholders need to take their responsibility and also they need a different training or different awareness. So I would like to see, in the recent days, I found a very interesting things. And two weeks ago, and we had a discussion in Singapore International Cybersecurity Week. And we’re talking about talent, we say over-knowledge but unskilled workforce. Which means now to get knowledge is very easy, but questions how to apply this kind of knowledge to their practice is a kind of challenge. So from this point of view, I would like to see to fill three gaps. The first one is to see how we can significantly improve the decision makers’ awareness. And for example, if we’re talking about governance, normally it’s always from top to down. So which means the top senior executives who decided the strategy, who decided the policies and needed to have awareness about AI. So which means they needed to know, may not need to know all the details, but they need to know and what kind of risk behind AI’s applications. The second one is working level. I would like to see a lot of situations is pretty similar like cybersecurity. You can see, Ken just mentioned about a lot of thing like open source software. To address all this kind of supply chain security issues, we need to review all this kind of traditional concept like the software engineering, security engineering, data engineering. All this kind of ideas is pretty traditional ideas. However, now we have AI. Then we have to review and also we need to put a lot of new meaning and new concept inside that can absolutely consolidate the cornerstone of the basic abilities in the working lab or technology levels to support the fast growth of the digital transformation and also the AI applications. The third one and probably is like a training inside universities. Huawei worked together with 79 university in China and we figured out a lot of universities do using a very old textbook. So let’s read one. We work together with top 11 universities to see how we can share our practice on a software engineering capabilities together with them then using this way and we train all this kind of training of trainer the young teachers and as well as The young graduate and once we finish the graduation They already understand what is the practice inside industry they can quickly update Quickly catch up the industry practice

Moderator – Massimo Marioni:
Thank you, and now another key issue is is collaboration not just in the workplace, but but across the world And and that’s a complex challenge so Can you explain how different countries can set rules for AI even when they’re not all? Necessarily aligned on how to use the technology for instance you know when chat GPT first exploded Italy Wanted to ban it for it for you know a certain amount of time So it’s a very complex challenge, and I’ve heard people say if you don’t have worldwide Regulation over AI you’ve got no regulation Ken. Do you do you think do you agree with that sentiment?

Ken Naumann:
I do agree with that you know the adoption of generative AI Has surprised me considerably over the last year year and a half and You know for me And my belief is you know the the regulations whether they’re on a country Basis or on a worldwide basis are going to be playing catch-up for the the future and I don’t think we’re ever going to totally catch up through Coming up with a comprehensive set of regulations or standards things that I think we can do are things like what we’re doing today Where we’re sharing information We’re sharing ideas, and I think that the GCF is has done a big service to the entire cyber community Other things we can do is come up with standards as a community not necessarily You know trying to get governments to cooperate with one another, but as a community of cyber professionals on You know what the role of AI should be as it relates to cyber You know standards around modeling standards around data the ability to share data across country borders and Coming up with safe and effective ways to to do that. I think it’s going to be a big step in the right direction and Ultimately you know the the more data that can be shared Honestly and Securely I think the the more likely we are going to be able to catch up with any

Moderator – Massimo Marioni:
Bad use of the technology yeah helmet. What’s your take well?

Helmut Reisinger:
first of all Cybersecurity is a universal topic because digitalization is happening everywhere notably also here in the kingdom On the other hand we should not dream. We should be realistic that we will not have tomorrow Immediately one standard across the globe which means we need to respect different ecosystems of digital space regulation or cyber security regulation for example Sean is coming from Shenzhen We as Palo Alto our sassy solution is fully compliant as well for China active businesses Which means if a German company active in China needs the same security across the globe in Saudi Arabia in China as well as for example in Brazil they get one standard But it fits as well to the local regulation that is needed we need to adapt that same is here You have a specific governance here on data and where data needs to be stored in the kingdom That’s where we need to simply adapt. That’s what we need to respect on the other hand I believe that some areas other areas other Theaters in the world are setting the pace we heard this morning from Barroso Europe was probably setting the pace in GDPR Europe was also quite fast when it comes to AI talking about unacceptable risk AI Sensitive AI foundational model AI and then basically a risk-free AI now This week u.s. Has also issued the first executive order on AI This will help to set the scene to get the discussion going and to get to a better level and of course AI I Think regulation is kind of needed Because there is a big potential of using it for the dark side of the world against your industrial your enterprise your public sector services that you want to provide and I can only see it also in Europe, you know about one year ago President Biden issued an executive order as well on a tech surface management ASM a tech service, but does you step from outside and look into an enterprise? What are your? risk areas and vulnerabilities and he forced Every entity of the federal government of the u.s. To do an attack surface analysis every seven days This is by far not the standard in Europe, but the closer you get to the Ukraine border I can tell you Baltics you heard the lady from Estonia this morning the more alertedness you have on that So I think this will set step-by-step to standard and I think the world will step-by-step converge on that But again, let’s not dream and be realistic

Moderator – Massimo Marioni:
Now you’re all senior leaders within your companies What do you think are the most important things for leaders to think about when they’re making rules in order to strike a balance between? Promoting innovation and Safeguarding against potential risks. I’ll give you all a chance to to answer here. So let’s start with with Sean

Sean Yang:
Thank you for question You know, actually we think is probably First of all, we need to say AI is not a product AI is a general Enabling technology if you compare with the last round of the industry Renovation like the computer science they change everything, right? so from this point view, I would like to see if we’re talking about all the rules and the governance and probably is not need to Focus on AI technology itself, but need to think about how we how we can build the rules structures and governance structures and to manage this kind of scenarios or this kind of product if we not talking about the Application scenarios that we’re talking about AI governance. There’s no meaning because AI technology are evolving, right? They are changing if you took based on a changing technology talking about the governance Sometimes it’s not cannot generate a concrete things. That’s number one number two I think in that we are facing a lot of challenge and probably generate by AI and First of all, we need to say in AI eventually will support or serving the people So which is the people oriented technologies? so the governance or rules and first of all and needed to improve and the applications and so from this point of view and That’s reason why we create this kind of internal governance which define the intention in define the principle and define the scenario and Define the product and how we apply the technology inside of solution or inside of a business of situations I think whatever from the security by design or security by default or security by operations we need to pay attention to the overall for And the life cycles management for AI application that probably it can bring more concrete meaning for AI governance

Moderator – Massimo Marioni:
Can number one thing for leaders to think about when implementing? I think there’s there’s a big decision coming up for

Ken Naumann:
technology leaders, especially Developers of software in the cyberspace And that decision is when you turn over more and more responsibility to the AI technology You know, when when does that shift happen where right now? Or in the immediate future AI can serve as a very good co-pilot but when does it actually become the pilot and I think it’s up to us as leaders of the organizations that are innovating around this technology to Make that determination in a way that a is going to be safe for the people who adopt the technology be doing in a Honest way in terms of being able to recognize What the current state of evolution is around AI and then see do it in a way that’s going to protect The people who are currently doing those jobs And You know, there’s a bit of a push pull in the industry right now Some people think that you know AI technology is going to take over the analyst role in a sock within the next three to five years Other people think that the steps that need to be taken before that happened need to be very measured and It needs to happen over a much more Long elongated period of time the other thing that I would bring up is you know What is the role ultimately going to be of a security? cyber security Specialists and you know, is it going to actually be protecting the environment or protecting AI? and you know to me there’s going to be a lot of a process of be procedures in terms of you know, how you go about doing that what technologies you use to do that and making sure that we put all the building blocks in place ultimately before we turn over our security future to machines

Moderator – Massimo Marioni:
Very well said helmet last word one man

Helmut Reisinger:
Well, if if it’s true that remember the time of infiltration versus exfiltration is shrinking heavily the world will need to have real-time and Autonomous autonomous meaning highly automated Cybersecurity solution that does not come without AI It’s a prerequisite so If this is a prerequisite the innovation will be how can we have the best use of AI? That is only possibly if you have good data So if you want to come to an outcome of 10 seconds meantime to detect and one minute meantime to remediate You need to have the right telemetry data. Remember device ID as well as the endpoint Telemetry data and from the cloud and then apply those algorithms and I think policymakers are very well advised to give space and oxygen to the AI space on The other hand as well to be aware and cognizant that AI is also a driver on the attacker side Just to give you one final number in the first seven months since chat GPT was launched our market leading unit 842 it’s a threat intelligence unit that we have have noticed 910% increase of faked slash Vulnerable chat GPT like websites being created as a trap for people and the public So it’s important for societies for enterprises and public organizations I think AI without cyber security or cyber security without AI vice versa will not work if we want to Keep your digital assets safe in a real-time and autonomous cyber security version

Moderator – Massimo Marioni:
Thank you very much that wraps up our panel everyone There’s a 10-minute break before the start of the next panel so there we go

Moderator – John Defterios

The participation of high-level officials in the Global Cybersecurity Forum (GCF) signifies the importance of secure cyberspace for Saudi Arabia and the Middle East. This demonstrates the country’s recognition that cyberspace is an integral part of the security apparatus, especially in conflict-ridden areas. The Middle East and North Africa region is currently experiencing upheavals due to ongoing conflicts, further highlighting the significance of addressing cybersecurity.

Saudi Arabia also acknowledges the need to address cybersecurity in the Global South. The initial reactions to the start of the pandemic were more focused on protecting one’s own citizens, without considering the global community. However, just like a pandemic, situations in cyberspace can cross boundaries, and Saudi Arabia sees the necessity for the Global South to be protected digitally as they continue to develop. The country recognizes the growth opportunity within the Global South and the importance of safeguarding it digitally.

Emphasis is placed on collaboration and a global perspective when addressing cybersecurity needs in the Global South. John Defterios, a prominent figure, suggests adopting a global approach to tackle the cybersecurity challenges faced by developing nations, particularly within the Global South. He draws parallels between cyber issues and the global nature of a pandemic, emphasizing the need for a coordinated and collaborative effort.

Despite regional unrest, there is trust in Saudi Arabia and the Gulf States’ ability to maintain stability. The Gulf States have a history of 35 years of coverage during which stability has been maintained, and this track record instills confidence. This trust extends to Saudi Arabia’s ambitious 2030 plan, which emphasizes cybersecurity, educational reforms, and global integration despite the prevailing regional instability.

The progress of reforms and the 2030 vision in Saudi Arabia has seen remarkable transformation over the past seven years. Saudi Arabia’s 2030 vision encompasses various reforms aimed at achieving sustainable economic growth and promoting peace and justice. However, there are concerns about the continuity of the 2030 plan amidst the regional uncertainty.

In conclusion, the increased participation of high-level officials in the Global Cybersecurity Forum highlights the importance of secure cyberspace for Saudi Arabia and the Middle East. The country recognizes the significance of addressing cybersecurity in the Global South, emphasizing collaboration and a global perspective. Despite regional unrest, there is trust in Saudi Arabia and the Gulf States to maintain stability. The progress of reforms and the 2030 vision in Saudi Arabia has shown significant transformation, although questions remain about the plan’s continuity in the face of regional uncertainty.

H.E. Adel Al-Jubeir

This analysis focuses on the various topics discussed by H.E. Adel Al-Jubeir, highlighting the importance of cybersecurity, global cooperation, and the future of Saudi Arabia. It underscores the significance of collaboration, international cooperation, and global stability in addressing various global challenges.

One of the main points emphasised in the analysis is the critical role that cybersecurity plays in both local and global prosperity. It is highlighted that cybersecurity impacts every aspect of life, including education and the economy. The argument presented is that cybersecurity is essential for both local and global prosperity. The supporting facts for this argument include the assertion that Saudi Arabia is a major player in the international system, and its success affects global stability.

Another main point discussed is the need for global cooperation to solve world challenges. The argument put forth is that challenges such as climate change and pandemics affect everyone, regardless of their country or religion, and that success in facing these challenges depends on global cooperation and transparency. The sentiment towards this point is positive, and supporting facts include the statement that challenges like climate change and pandemics impact the entire world, and thus, a cooperative approach is necessary.

The future of Saudi Arabia is another significant topic discussed, with an emphasis on diversification and empowerment. The argument made is that the future of Saudi Arabia depends on diversifying the economy and empowering women and youth. Vision 2030, a plan to transform Saudi Arabia by diversifying the economy and empowering women and youth, is referenced as a means to achieve this. Moreover, it is mentioned that the country seeks to attract both domestic and international investments.

Additionally, the analysis highlights the vital role that Saudi Arabia can play as a bridge builder between China and the United States. The supporting facts state that Saudi Arabia has strategic relations with the United States and that China is Saudi Arabia’s largest trading partner. The sentiment towards this point is positive.

The analysis also acknowledges the necessity for a transition from confrontation to cooperation and a shift from competition to a sum-sum game in which all parties benefit. The sentiment towards this point is neutral, and the supporting facts suggest that the international system is better served when the two largest economies, the U.S. and China, cooperate and avoid confrontation.

Another topic discussed is the need for scientific, rational, and logical approaches to addressing climate change and cybersecurity issues, rather than being emotional and hypocritical. The sentiment towards this point is negative, and the argument posits that it is essential to approach these issues using scientific reasoning and rationality. The supporting facts mention the history of climate change discussions and cybersecurity resolutions.

Furthermore, the analysis highlights the pressing need for quick agreements on cybersecurity definitions, dangers, and international conventions. The argument suggests that multilateral cooperation should be accelerated to counter cyber threats. The supporting facts state that cyber issues relate to extremism recruitment, child pornography, money laundering, and the compromise of critical institutions.

H.E. Adel Al-Jubeir is mentioned as viewing the establishment of a center for cybersecurity as beneficial. The supporting facts suggest that the center will play a critical role in highlighting the importance of dealing with cybersecurity, formulating effective measures, and facilitating the global exchange of ideas.

The importance of cybersecurity is further reiterated, with the assertion that it should rank among the top three policy issues. This sentiment is supported by the mention of common reliance on internet access for essential needs and a comparison of cybersecurity with the rising concern for climate change.

The analysis also emphasizes the necessity of global cooperation to combat cyber threats. It highlights the need for a cooperative way forward, as exclusivity does not benefit anyone.

The rapid advancement of artificial intelligence (AI) and emerging technologies is also discussed. It is stated that the speed of technological development and the emergence of new technologies is outpacing our ability to regulate and secure them. The sentiment towards this point is concerned, and the argument suggests that there is a need for transparency and regulation in AI and cybersecurity to avoid confusion and chaos. The supporting facts mention the potential for AI to create simulations of real people saying things they didn’t and the possibility of misrepresenting world leaders.

The analysis also highlights the importance of finding global solutions to cyber protection, particularly for the Global South. It mentions that the world is moving towards globalization and that no single country can solve global problems alone. The sentiment towards this point is positive.

Furthermore, the analysis emphasizes the significance of global collaboration and interconnectedness. It mentions Saudi Arabia’s focus on connecting itself with the world and participating in reciprocal learning, allowing for better understanding, trade, investment, and cultural exchange. The sentiment towards this point is positive.

The stability of Saudi Arabia amidst regional disturbances is also emphasized, with the sentiment being positive. It is mentioned that Saudi Arabia has been consistent in its progress and reforms, regardless of regional unrest.

The participation of Saudi Arabia in global institutions, such as the G20 and BRICS, and the hosting of global events like the World Cup, is also highlighted. The sentiment towards this point is positive, and the argument suggests that there is no contradiction between participating in global institutions and hosting global events.

The analysis further underscores the importance of increased cooperation among nations, leading to better understanding, trade, investment, and cultural exchange. It states that Saudi Arabia is participating in global forums to build bridges and that increased understanding leads to global stability and prosperity.

Lastly, the analysis emphasizes the critical importance of maintaining trust in societal systems, particularly in areas such as e-commerce, aviation, and vital infrastructure like power and water systems. The sentiment towards this point is positive, and the argument asserts the significance of trust in maintaining societal stability.

In conclusion, the analysis highlights the importance of cybersecurity, global cooperation, and the future of Saudi Arabia. It emphasizes the need for transparency and regulation in AI and cybersecurity, as well as the necessity for global solutions to cyber protection. The analysis also underscores the significance of maintaining trust in societal systems and the role of education and awareness. Overall, it emphasizes the importance of collaboration, international cooperation, and global stability in addressing various global challenges.

Moderator – John Defterios:
His Excellency Adel Al-Jubeir, Minister of State for Foreign Affairs, Member of the Council of Ministries, and Envoy of Climate Affairs, Saudi Arabia, John Defterios, Moderator, former CNN, Emerging Markets, Editor and Anchor. Good morning, everybody. It’s nice to see such a terrific turnout. Your Excellency the Governor, it’s great to start the second day here with such a distinguished guest. It’s great to see you. His Excellency Adel Al-Jubeir is the Minister of State for Foreign Affairs. He’s a climate envoy and a member of the Cabinet of Ministers. We’re going to do a 25-minute session looking at creating a cyberspace for all that’s secure, the urgency in which to do so, and then the nexus at which climate discussions and cyberspace meet. And I would add also our reaction as a global community, Your Excellency, to the COVID-19 pandemic. Initially, it was every state for itself, and then towards the end of that process, it became very collective. But how do we get cyberspace and that collective space to begin with? Your Excellency, we were discussing in the Green Room beforehand that the GCF Institute was established by royal decree in 2023, which is quite a landmark. And I think geographically and strategically, and Saudi Arabia being the largest economy in the Middle East and North Africa by a wide margin, also provides an opportunity to build momentum and a consensus, which I’d like to give to. He didn’t hear the formal welcome, but let’s give him a nice Riyadh welcome to His Excellency Adel Al-Jubeir.

H.E. Adel Al-Jubeir:
Thank you. Thank you. Thank you very much.

Moderator – John Defterios:
I think, and we cannot overlook this, but I think it’s incredibly important to see someone at your strategic level within the government and wearing the hat as the Minister of State for Foreign Affairs and the Climate Envoy, and so active within the Cabinet of Ministers, to be at the GCF. What does it tell us, first and foremost, about the importance of a secure cyberspace for all in the kingdom because of critical infrastructure, but also for this region in the Middle East and North Africa, which we have to say is going through convulsions now because of conflict? What does it say about the role of cyberspace in that security apparatus, would you say?

H.E. Adel Al-Jubeir:
It’s very – well, first of all, thank you for having me, everybody. It’s great to be here. It’s extremely important. When you look at cyber, you look at – it impacts every aspect of our life, from education, from paying our bills, from acquiring information. I mean, you name it, it’s linked to it. And ensuring that we have a functioning, secure system that allows us to operate efficiently is very important to us personally, to the economy, and to the global economy. Saudi Arabia is a major player in the international system. We are the largest exporter of oil. We are one of the largest investors in the global economy. We are custodians of the two holy mosques. We have influence and access and throughout the Muslim world, 1.7 billion people pray in the direction of Mecca five times a day. We are geographically located between three continents, Asia, Europe, and Africa. Three of the most important waterways in the world are right next to us, the Straits of Hormuz, the Bab al-Mandab, the Suez Canal. So we are connected to the world, and the world is connected to us. What happens in the international system has a direct impact on Saudi Arabia and vice versa, whether negative or positive. So it is critically important for us that we have a stable, functioning, prosperous international system. That’s how we prosper. When you look at our Vision 2030, the objective of it is to ensure that we are an active player in the international system by transforming our country, diversifying our economy, empowering youth, empowering women. And in order to do so, we need to have an efficient and transparent public sector. We have to have new areas of investment, whether it’s mining, whether it’s tourism, whether it’s recreation, whether it’s entertainment, artificial intelligence, renewable energy, all of these. And in order to have those, we have to have a world-class education system, and we have to have a world-class healthcare system, and we have to have the ability to attract investments both domestic and international. So all of this is part of our package Vision 2030, and we are much better able to achieve our objectives if the international system is stable and secure. And the stability of cyber is critical to this, and the establishment of this center is one means for Saudi Arabia to contribute to making the cyber world more stable and more secure, and also to connecting the world and acting as a bridge between different countries and between different regions in order to have a cooperative approach rather than a competitive approach. We cannot deal with the challenges of our world, whether it’s cybersecurity, whether it’s climate change, whether it’s pandemics, unless we work together. One country cannot do it alone. When it comes to climate issues, rising temperatures do not avoid one country because it’s doing something. It impacts all of us, and so all of us have to work together in order to deal with it. When you look at pandemics, the virus doesn’t distinguish between Muslim and Christian and Jew and Buddhist. It doesn’t distinguish between American and Saudi and German. We’re all the same. And unless and because we worked closely together as a global community with transparency, we were able to overcome this pandemic. The same with cybersecurity. One country cannot do it alone. We have to work together. We have to share information. We have to share expertise, experience, and we have to agree on common terminology in order to be able to deal with the challenges.

Moderator – John Defterios:
Great. Let me just delve into that a little bit more. Geographically, as I mentioned in my opening comments, you straddle east and west and are, as you noted, very connected to Africa now, which is a great growth opportunity for the continent, but also, I think, for the heart of the Gulf here. But does it allow Saudi Arabia to serve that bridge between China and the U.S., which is competing in technology, right, but you want them to compete on fair grounds and also have a dialogue and also work together for a secure cyberspace, specifically because of the Global Cybersecurity Forum and now being an institute? What role can it play as a bridge builder?

H.E. Adel Al-Jubeir:
It can play whatever role it needs to play. It’s very important that we switch confrontation to cooperation, and it’s important that we switch competition from being a zero-sum game to being a sum-sum game where everybody benefits. Saudi Arabia has strategic relations with the United States. China is our largest trading partner. Both relations will continue to grow and prosper. The international system is better served when there is cooperation between the two largest economies, where the international system is not served when there is confrontation, and I believe both sides want to avoid any kind of confrontation. And Saudi Arabia’s role is to work with everybody to try to create a cooperative environment in which everybody benefits.

Moderator – John Defterios:
Good. As a climate envoy, you’re very knowledgeable about the process. My journalistic coverage started in 1992 with the Rio Accord, and yours predates that in terms of the history of the COP process. How do we avoid the missteps of having two distinct camps in the COP process? And we’ve learned post-pandemic that the energy system of today can’t be shut off and you start the energy system of tomorrow, and we don’t want that slow process to filter in to the cyber community. Can you make that comparison what we should avoid as landmines, if you will?

H.E. Adel Al-Jubeir:
I think the most important thing is to be scientific and rational and logical about dealing with issues and not emotional. We see a lot of emotions when it comes to climate change discussions, and we frankly see a lot of hypocrisy, and that doesn’t serve anyone. We have a problem. We need to fix the problem. The temperatures are not coming down. The air is not becoming cleaner. And no matter how much we argue, we need to roll up our sleeves, work together to solve the problems in a rational and effective manner, and we need to do it quickly. I believe with the climate discussions started essentially with the Stockholm Conference in 1972, where the issue of the environment was put on the agenda. And then it took another two decades until we had the Rio summit, Earth Summit, which focused on climate change and the dangers of climate change. Then we had Kyoto. Then we had the Paris summit, which was a small miracle that countries agreed on the path forward and the need to limit rising temperatures. And then we’ve had the subsequent COP meetings. It’s moving towards a more rational discussion, but it’s taken almost 50 years, and that’s too long when it comes to cyber security. Cyber security, the issue of dealing with cyber began really in 1998 at the United Nations. The first resolution with regards to a governmental working group was passed in 2003. That’s 20 years ago. We still have a way to go. I think it’s important that we agree we need to move very quickly because technology is moving much faster. We need to agree on the terms that we, how we define things so that we know what we’re talking about. We need to agree on where the dangers are, and we need to work very quickly in those areas. We have problems with, in terms of the internet, with recruitment for extremism. We have problems with child pornography. We have problems with crime, whether it’s money laundering, whether it’s extortion. Even things as simple as bullying, you can have somebody, one end of the world bullying somebody on the other end of the world. How do you stop it? How do you criminalize it, and how do you prosecute these individuals? We need international conventions for these, and we need them quickly. And we need to deal with other issues that involve cyber. I think the most important thing is agreeing on definitions, agreeing on areas that need to be addressed, coming up with legal mechanisms to counter those areas, exchanging information with regards to how people take advantage of cyber in order to commit crimes, and what is the most effective way of dealing with it. We need to exchange information with regards to the type of viruses that people try to use to damage other institutions. We need to protect the functioning of critical institutions to countries that really have banks, power plants, hospitals, traffic lights. These are important things for day-to-day life, and I think those are areas that should not be as sensitive to national governments as issues that directly relate to national security. So we should be able to find ways of moving forward. I’m hopeful that people recognize the dangers, and that they recognize that multilateral efforts are complicated, they take a long time, but they recognize that the need is urgent and we need to find a way to speed it up. And I believe the center that is established will have a critically important role to play in highlighting the importance of dealing with the challenge of cyber security and coming up with the most effective ways of addressing it and being a platform for people from around the world, as we’ve seen yesterday, to come and exchange ideas and come up, identify problems, and point out certain pathways forward that will help us overcome those problems.

Moderator – John Defterios:
Yes, if you look at today, and this emerged last week at the FII when they did a poll, it’s very interesting what you said about the trust of a system and the quality of life. So they polled the participants and they said quality of life is essential as a number one issue. The threat of inflation and the cost of living was second on that list. Third on the list for those that were a bit older like us was climate, right? And then the youth said, oh, climate is at the top of the category for them because they’re very fearful of the future. Where does cyberspace, a secure cyberspace, which is not in the front and center of our consciousness, but should it belong in the top five in terms of policy and maintaining trust and government collaboration or not?

H.E. Adel Al-Jubeir:
Absolutely, it should be in the top three, if not top two. How many times do you complain when you arrive in a country and you turn on your cell phone and you don’t have internet access? And this is just because of the systems, not because somebody fiddled with it. So how would you feel if you woke up one day and you’re shut out from the world? You can’t access your bank accounts. You can’t access your medical records. You can’t communicate with your doctor. It has a profound impact on your life and on your quality of life. We’re used to things today that were unthinkable 30 years ago or 20 years ago, and we take them for granted. And I think with climate, I mentioned the Stockholm Conference in 1972. Nobody was paying attention to the environment. They thought the environment was picking up trash, but now they see rising temperatures and they see more dust storms and they see more hurricanes and they see rising water levels and they say, oh my goodness, this is having an impact on my life and the life of my children and grandchildren. With cyber, we are now in that phase where people are becoming cognizant of the problem. But heaven forbid, hopefully we never get there, but if you had a shutdown, then people will say this is the number one priority. We need to deal with it. So to your question, it is a critically important issue and I think it ranks right up there with climate change, pandemics, and cyber. I think these are the three critical issues that we face as a global community and we have to pay attention to it and we have to come up with a cooperative way forward because being exclusive or not being cooperative doesn’t help anyone.

Moderator – John Defterios:
Okay, the other thing I was gonna ask you about was there’s an AI conference running in parallel with the Global Cyber Security Forum and President Biden signed an AI executive order saying that we need to have greater transparency and testing by the private sector in collaboration with government. His first executive order when it came to technology was on cyber security four months into office. Does that give us this opportunity to link the opportunity and threat of AI and have it dovetail with policy around cyber security? Because many fear that AI’s gonna move so far in advance that it’ll test the cyber security networks of the world. How do you see that and the actions by the US to put this high on the radar?

H.E. Adel Al-Jubeir:
I think it has to be when you have the ability to take you and have you come out and say things that you didn’t say with real credibility. Imagine if you had world leaders issuing statements that have nothing to do with reality, that they had nothing to do with. What kind of confusion does it create in terms of global financial markets, in terms of perceptions, in terms of it can be chaotic. It will be chaotic, not can be. And so it’s important that we deal with all of these issues. And the challenge with cyber, I believe, and I’m not a technical person, so forgive me if I’m off here, but the way I see it is it’s moving so quickly that we need to catch up with it. And when you think you have a handle on something, something else emerges. And so it’s important that we try to stay ahead of the curve, although I don’t believe we are, but we need to find a way to at least keep up with the changes so that we don’t have miscalculations that happen because of misinformation that we believe to be correct information.

Moderator – John Defterios:
Great. We talked about the COVID-19 pandemic briefly, and I mentioned it in my opening remarks and during the opening panel yesterday, the initial reactions, I have to protect my citizenry, and I wasn’t thinking of the global community. And that also pertains to the Global South when it comes to a secure cyberspace for women, for development, for collaboration. How do we take a role here, a global look at solving this for the Global South? Because as you said, the pandemic crosses boundaries, right? But the same thing could be said in cyberspace. And how does Saudi Arabia see that necessity for the Global South to be protected, if you will, as they develop? Because there’s a great growth opportunity at our doorstep.

H.E. Adel Al-Jubeir:
I think we need to step back and look at the large picture. And what we see is the world moving towards globalization. Everybody talks about it. But the fact is we’re one unit, a small planet. Globalization, in your view, is not dead then. You can reset. It’s, we live on one small planet. And what happens in one end of the planet affects people on the other end of the planet, whether it’s a pandemic, whether it’s climate change, whether it’s cyber. And the solutions to these problems and these challenges have to be global. One country cannot go it alone. So it’s not a, I don’t, I think the world has to move from us versus them, or one section of the world versus another, to we’re all in this together. And when you look at Saudi Arabia, for example, or Vision 2030, part of it, a major part of it is connecting Saudi Arabia with the world and connecting the world with Saudi Arabia. We have sent more than 500,000 of our young men and women to study around the world over the past 15 years or so. Over the past 40 or 50 years, numbers are much higher. And the objective is not only to acquire education, but to learn about the world and for the world to learn about them. Because when you, when they come back and we see it now in the energy and the dynamism that we have in Saudi Arabia, people are connected. They’re aware of the world. They’re aware of their role in the world. And they’re aware of the importance of dealing with the world. We’re proud of our national identity. We’re proud of who we are, but we recognize that we are part of the global community and that the community as a whole has to come together to deal with the challenges that we face, whether it’s cyber, whether it’s climate change, or whether it’s pandemics.

Moderator – John Defterios:
I would love to ask you your thoughts on the continuity of the 2030 plan. And when we have regional unrest like we have it today, how the GCC can remain stable and that vision 2030 on track. Many would probably question, can you continue with the reforms? Can you continue with progress when there’s regional uncertainty? My history after 35 years of covering it is that people have trust in Saudi Arabia and the Gulf States to remain stable. Can you address that, do you think, in this context of trying to create a secure cyberspace? Because the transformation in seven years has been phenomenal. And people want to know if it’s on track and stays on track.

H.E. Adel Al-Jubeir:
We have an objective. We have a whole of government and a whole of society approach towards achieving that objective. We have exceeded most of the benchmarks for that objective. We will continue to pursue that objective because that’s in the interest of our nation. And so we will do this. And we will deal with other challenges as they come up. But it will not deter Saudi Arabia from continuing on its path of progress and reform and implementation of its vision 2030. And our record speaks for itself. Saudi Arabia has been, the Saudi state was first established in 1727. We’re talking more than 300 years ago. And before that, there was a state in Darayya for several centuries. We have seen the coming and passing of many storms in our region. And we have been determined and steadfast and consistent in our movement forward. You will not find, in the history of Saudi Arabia, zigzagging or backtracking. We set an objective, we work towards it, and we achieve it. And then we set another objective and we are fully determined to continue along this path. And we are fully determined to make Saudi Arabia a very dynamic and very efficient and a very prosperous and very stable society as we have been doing for decades.

Moderator – John Defterios:
Great. Final question is, as a member of the G20, the expanded BRICS, which Saudi Arabia joins in 2024, hosting a World Cup in 2034, how do we make sure that globalization and these institutions don’t compete against each other, where the G20 and the BRICS collaborate, they take that collaboration into the UN structure? And I didn’t want to interrupt you, but.

H.E. Adel Al-Jubeir:
No, it’s all connected. We don’t see any contradictions between them. I think the global sports events are very exciting. They bring people together. We’re very excited about hosting the World Cup in 2034. Hopefully you will come and you and I can watch the final game with Saudi Arabia in it. We have a, we believe that the G20 is a forum for countries to come together. With regards to BRICS, Saudi Arabia received an invitation. And we think that we don’t see contradiction between one and the other. We think that the more countries can build bridges with each other, the better understanding you have, the more cooperation you have, the more trade and investment, the more exchange of cultures and people, the better it is for all sides concerned. And we think this is what will contribute to global stability, which opens the path for global prosperity.

Moderator – John Defterios:
Good. Your call to the audience, you know, there’s a lot of trust that’s built in society because our systems work. And these people actually work really hard to make sure that that trust remains, right? If you’re doing, as you suggested, e-commerce, or if you’re flying, the critical infrastructure for power and for water systems. What’s the call to action here for this audience as we conclude our second day later this afternoon?

H.E. Adel Al-Jubeir:
Keep doing what you’re doing and make sure that you educate everybody around you, in particular somebody like me who is not very tech savvy, because what you’re doing is critically important, not only to Saudi Arabia, but to the world. And I think the center will have to, will play a very important role, I have no doubt, in bringing the world together and in making the world a better place and a more stable place. So keep up the good work.

Moderator – John Defterios:
Good. Can we give a nice round of applause for His Excellency Adele Al-Jubeir. Thank you very, very much. Thank you. Nicely done. Thank you very much. We’ll exit here. Thanks, we’ll get the microphone in the back off. Just go to your left, yeah.

Felix A. Barrio Juárez

The European Union’s Next Generation Action public policy aims to stimulate economic recovery through increased investment in research and development (R&D). This policy recognizes that investment in R&D is crucial for post-COVID economic recovery, specifically in the area of digital transformation.

In Spain, one in three euros invested through the Next Generation Action programme is allocated to digital transformation. This highlights the recognition of the importance of digital transformation for economic growth and recovery. Furthermore, Spain has spent over 224 million euros on R&D for small and medium enterprises (SMEs), supporting their role as a successful strategy for market catalysation.

The digital transformation and cybersecurity sector’s contribution to Spain’s economic growth has risen from 12% to 22% in just three years. This demonstrates the significant impact that digital transformation and cybersecurity have on Spain’s national economic growth.

Cybersecurity is not only essential for economic growth but also plays a crucial role in national technological sovereignty. It allows for independence in terms of national technology and ensures the protection of critical infrastructure and sensitive data.

However, there are concerns about standards becoming barriers for smaller businesses and new entrants in the digital market. The establishment of strict standards may put small companies at a disadvantage and limit the entry of new players into the market. It is essential to strike a balance between setting standards and allowing for the participation of new entrants to foster innovation and competition.

Building cybersecurity capabilities is a top priority, and there is a call for the private sector to step up in this field. Felix emphasizes the importance of prioritising the development of cybersecurity capabilities and highlights the need for private initiative in building these capabilities.

Additionally, public services have a role to play in empowering vulnerable sectors, such as consumers, to be part of the cybersecurity solution. By focusing on the more vulnerable sectors and involving the public in cybersecurity efforts, Felix believes that public services can contribute to promoting peace, justice, and strong institutions.

In conclusion, the European Union’s Next Generation Action public policy recognises the importance of investment in R&D for economic recovery, particularly in digital transformation. Spain is investing significantly in digital transformation and supporting the growth of SMEs through R&D funding. The digital transformation and cybersecurity sector are playing an increasingly important role in Spain’s economic growth. However, there are concerns about standards becoming barriers for smaller businesses and new entrants. Building cybersecurity capabilities and empowering the public are crucial aspects of addressing these challenges.

Ir. Dr. Megat Zuhairy bin Megat

In 2020, Malaysia established a cybersecurity strategy with a five-year plan to create a secure, trusted, and resilient cyberspace. The strategy is built upon five pillars: effective governance and management, legislative strengthening and enforcement, innovation R&D, capacity and capability building, and global collaboration. It aligns with the Malaysia Digital Economy Blueprint and the IR 4.0 policy, supporting the nation’s goals of industry, innovation, and infrastructure.

One argument in favor of Malaysia’s cybersecurity strategy is that it supports other nations’ strategies and policies, highlighting the importance of partnerships and collaboration in addressing cyber threats. The strategy also aims to build a strong cybersecurity workforce by promoting it as a career choice among students and collaborating with industry and academic institutions.

However, there is a concern that an excessive focus on standards might impede innovation. While standards are crucial for efficiency and consistency, too much emphasis on them could limit the rate of innovation. Striking the right balance between standards and innovation is essential for an environment that fosters both safety and technological advancement.

In conclusion, Malaysia’s cybersecurity strategy, with its five pillars and alignment with national strategies, reflects the country’s commitment to a secure cyberspace. By focusing on education, industry collaboration, and capacity building, Malaysia aims to effectively tackle cyber threats and build a robust cybersecurity workforce. It is crucial to maintain a balance between adhering to standards and promoting innovation to ensure continued growth in the sector.

Eng. Walid A. Abukhaled

The importance of cybersecurity is highlighted in the provided data, with it being described as a top priority. There is a consensus among the arguments that cybersecurity is of utmost importance and should be taken seriously by organizations and nations alike. Daily cyber attacks targeting strategic companies and assets are a major concern, indicating the widespread risk posed by cyber threats. It is emphasized that no organization is immune from these attacks, with a cautionary message to those who believe it cannot happen to them.

SAMI, a defence system, recognizes the significance of cybersecurity and takes it seriously. It is stated that SAMI develops state-of-the-art technology to ensure independence and incorporates cybersecurity into its day-to-day business operations. This indicates a proactive approach to maintaining a robust cybersecurity strategy.

Furthermore, the argument is made that education on cybersecurity is crucial. It is stated that education is the number one issue, and the role of cybersecurity in educating people is tremendous. This underscores the need for raising awareness and ensuring that individuals are equipped with the necessary knowledge and skills to protect themselves and their organizations from cyber threats.

The data also highlights the vulnerability of Saudi Arabia to cyber attacks. It is mentioned that Saudi Arabia was previously one of the most targeted countries. This demonstrates the need for a robust cybersecurity infrastructure and strategies to protect national assets and interests.

Another noteworthy argument is the creation of a regional or global command and control centre for cybersecurity. The data suggests that establishing such a centre would facilitate the identification, sharing, and prevention of cyber threats. It is also mentioned that this centre would serve as a platform for sharing best practices and regulatory reforms, contributing to the development of future cybersecurity leaders.

The relationship between foreign investments and the safety and security of a nation is brought up as well. The argument posits that there is a direct link between safety, security, and prosperity, emphasising the importance of protecting strategic assets and investments for the future economy.

The role of small and medium enterprises (SMEs) in supporting larger organizations and fostering innovation in the cybersecurity industry is recognised. It is highlighted that SMEs play a crucial role and can bring new and innovative ideas to the table. To support SMEs, the suggestion is made that regulations should be in place to allocate a certain percentage of contracts from large companies to support them. This would create a more level playing field and encourage the growth of SMEs in the cybersecurity sector.

The value of human capital is emphasised, with Vision 2030 in Saudi Arabia prioritising investment in human capital. This indicates recognition of the importance of developing and nurturing talent in the cybersecurity field.

Furthermore, the issue of salary inflation in the cybersecurity industry is raised. It is mentioned that cybersecurity specialists with four years of experience are demanding CEO-level salaries. This suggests a growing concern regarding the escalation of salaries in the industry.

Trust is identified as an integral component of the cybersecurity industry. The data highlights the need for a regulatory framework to earn trust and address issues such as data breaches, loss of personal information, and concerns about privacy infringements through apps.

Lastly, the data points out the benefits of global cooperation in cybersecurity. It is mentioned that the Global Cybersecurity Forum provides an opportunity to learn from global mindsets, indicating the value of knowledge exchange and collaboration in addressing the challenges of cybersecurity.

In conclusion, the extended summary highlights the importance of cybersecurity as a top priority, the need for increased security in the face of daily cyber attacks, and the recognition of cybersecurity by organizations and nations alike. It emphasizes the crucial role of education, the vulnerability of Saudi Arabia to cyber attacks, and the potential benefits of establishing a regional or global command centre for cybersecurity. The relationship between foreign investments and the safety and security of a nation is underscored, along with the support needed for SMEs and the value of human capital in the cybersecurity industry. The concerns of salary inflation and the importance of trust and global cooperation are also addressed. Overall, the data presents a comprehensive overview of the various aspects of cybersecurity and its significance in today’s world.

H.E. Eng. Abdulrahman Ali Al-Malki

Cybersecurity plays a vital role in safeguarding assets and systems, although it can be costly. The protection of these valuable assets necessitates a significant budget allocation. Moreover, constant losses after cyber attacks can be mitigated through proper financial investment in cybersecurity. This perspective highlights the importance of cybersecurity measures despite the associated expenses.

A substantial cybersecurity budget not only ensures the protection of assets but also has the potential to attract global solutions and foreign companies. Nations with significant investments in cybersecurity have been successful in enticing international solutions. Additionally, a strong cybersecurity infrastructure instills confidence in foreign companies, thereby encouraging their investment. This stance emphasizes the positive outcomes of allocating a high budget to cybersecurity.

Furthermore, it is crucial to provide support and cooperation to Saudi Arabia’s Cooperation Council in their leadership role in cybersecurity. Expressing support for their efforts signifies the importance of collaboration in creating effective cybersecurity measures. This cooperative approach fosters positive outcomes in achieving cybersecurity goals.

In Qatar, a comprehensive plan has been implemented to ensure sovereign security at a national level, particularly in relation to the World Cup. This comprehensive plan encompasses a national security framework that extends across all institutions, ministries, and select private sector companies. Vigilant monitoring of the framework’s implementation on a daily basis ensures the highest level of security. Implementing such a plan demonstrates Qatar’s commitment to national security.

During the World Cup, Qatar actively cooperated with international partners, receiving support from teams of other countries. This collaborative approach involved sharing problems and challenges with friendly nations and receiving analyzed data on security threats. This exchange of information and support during the World Cup helped strengthen Qatar’s security measures.

Even after the World Cup, Qatar continues to maintain relationships with the countries they cooperated with. Ongoing sharing and receiving of data on sovereign security exemplify Qatar’s commitment to sustaining these relationships. This enduring partnership remains essential in safeguarding national security.

Building capabilities and licensing workers in the field of cybersecurity is a priority in Qatar. The country has studied two directions in this realm, focusing on enhancing cybersecurity skills and knowledge, as well as licensing workers. These efforts span across different levels, including companies, organizations, as well as individual workers and engineers. By prioritizing these actions, Qatar aims to develop a workforce proficient in cybersecurity.

Identifying and managing risks within the supply chain is critical for maintaining uninterrupted services. Even the smallest entity within the supply chain has the potential to cause complete failure of the service. Neglecting to thoroughly study and address supply chain risks can lead to significant problems. This highlights the necessity of recognizing and effectively managing risks within the supply chain.

In conclusion, cybersecurity is indispensable for protecting assets and systems, despite its associated expenses. A high cybersecurity budget attracts global solutions and foreign companies, promoting economic growth. Supporting Saudi Arabia’s Cooperation Council in their cybersecurity efforts is crucial for collaborative and effective measures. Qatar has implemented a comprehensive national security plan, ensuring sovereign security at a national level. The country actively cooperated with international partners during the World Cup and continues to maintain relationships with these countries. Additionally, building capabilities and licensing workers in the field of cybersecurity is a priority for Qatar. Identifying and managing risks in the supply chain is critical to avoid service failures. These insights shed light on the importance of cybersecurity and collaborative efforts in maintaining security and economic growth.

Moderator

Summary:

Cybersecurity plays a critical role in protecting strategic companies and assets from daily attacks. Saudi Arabian Military Industries (SAMI) is developing its defense system with a commercial mindset, ensuring cyber resilience and extreme protection. Education is crucial in mitigating cybersecurity risks, as people often underestimate the likelihood of being targeted. Clear regulations and policies are necessary to provide a framework for effective cybersecurity. International cooperation and collaboration are key to combating cyber threats, with suggestions for the establishment of regional/global command centers and sharing of threat intelligence. Consumer protection, support for SMEs, and finding a balance between standards and innovation are important considerations. Qatar has a comprehensive plan for sovereign security, while international collaborations during events like the World Cup demonstrate the importance of working together. Building trust, capacity, and capability in the cybersecurity field are also emphasized.

Moderator:
Catalysing cyber Stimulating cyber security market through ecosystem development Engineer Waleed Abu Khalid Chief Executive Officer, Saudi Arabian Military Industries, SAMI Dr. Miqat Zuhairi bin Miqat Chief Executive, National Cyber Security Agency, Malaysia Felix Barrio Juarez, Director General, Spanish National Cyber Security Institute His Excellency Engineer Abdurrahman Al Malki, National Cyber Security Agency, Qatar John Defterios, Moderator, Former CNN, Emerging Markets, Editor and Anchor Okay, thank you very much. It’s great to be back for this session called Catalysing Cyber. So we’re opening session today, we looked at like the five key pillars that the GCF is looking at in 2023, and some of the companies here in Saudi Arabia, which are supporting those different pillars. But what does that mean in practice? And this panel, we have specialists from government that actually run their cyber security authorities, and how they interact with, for example, the finance ministry, the economy, ministry, the Ministry of Defense, we have the Saudi industry of military industries here, which is excellent to show an example of how that sector, the defense sector, takes this very seriously. We’re going to have a robust debate for 40 minutes, can we give them a nice round of applause for joining us today? I’m obviously not Nisha Pillai, who’s… a friend, but John Defterios as they announced, so I don’t know if they can change the board behind us, but I’m happy, and we know this community extremely well. If I may start with you, Engineer Walid, about how do you develop the system, and this is very important because you’re very much, and everybody here on this panel, very much into processes about how you develop a cybersecurity apparatus. And in the conflicts that we see around the world today, most people think of security in the military sense of action, but this is a different, if you will, enemy, but also a different opportunity. Do you want to explain how SAMI as a military industry here in the kingdom sees that development, why it’s so crucial for the security, but also the development of the country? I think that would be great.

Eng. Walid A. Abukhaled:
Please. Sure, sure. No, absolutely. Thank you, John. I just took permission to speak in English because it’s a truly global cybersecurity forum, and I think for all our benefits, first I can’t thank the organizer enough, I can’t thank NCA enough for having us here, because if there’s a topic that is at the highest level of importance, probably it is cybersecurity. If any company in the world, if any organization in the world think they are immune, they better think again. There’s daily attacks on almost every strategic company, on every strategic asset. People who believe this may not happen to them, they better think again. So the presence of this forum is amazing, it’s great, and hopefully it will add great value and I’m sure at the end of it there will be certain recommendation other than the benefits of offering it. of clear networking with subject matter experts. Look, at SAMI, we got to a point, of course we got to a point, I don’t know how much you know about SAMI, but in just 20 seconds or 30 seconds, it’s a national defense champion. It was established in 2018, 100% owned by public investment fund. Although we are owned by the government, we are 100% commercial mindset. We are in it for the business. Our mandate is to be to localize 50% of the defense spend in the Kingdom of Saudi Arabia. As such, it means we have to develop our own system, state-of-the-art technology, to ensure independence that we create our own defense system in the Kingdom of Saudi Arabia. Now, what we know for a fact, the concern is not only cyber attacks on the company for people to take sensitive information, that’s extremely important to our customers, but the system we built have to be cyber protected. So in everything we do, cyber security is part of our day-to-day business. If we are designing a system, a defense system, we need to make sure that this is very resilient, extremely protected, that no one can penetrate it. And we try our best, of course, because as I said, there is no such thing as 100% secure. From education perspective, of course, now we have about 4,000 employees. I can assure you our cyber security function plays a tremendous role in educating. Education is the number one issue, because there are many people still believe that it will not happen to me, it will happen to other people who don’t take care. No, it does happen. It’s unbelievable how many phishing emails we get per day, how many people try to penetrate and get information. And that, I can assure you, is happening to all. So as such, we take this extremely seriously. We built a very rigid, very strong defense system when it comes to cyber. And we can’t thank NCA enough, because they’re doing tremendous work in putting clear regulations, clear policies for all of us to implement, and we ensure that we are fully aligned with them. the NCA in the kingdom.

Moderator:
Yeah, your clarity on this is very, very impressive. Before I call on His Excellency the Engineer from Qatar who speaks fluent English but in deference to our audience, he’s going to speak in Arabic. For our English speakers or if you don’t understand Arabic, do grab a translation device now. I’ll therefore call on our friend from Malaysia, Dr. Magat, and I think we can start with how seriously Malaysia takes this initiative because it’s part of a national cybersecurity plan. And why, and I know Malaysia well, I’ve been there at least 15 times in the last 15 years, why it takes it so seriously as a financial center, as a trade hub, the development of the IT sector along the Silk Road and the Spice Route, I mean, Malaysia has quite deep ties in business. Why did you find it so strategic for Malaysia to have actually a five-year plan?

Ir. Dr. Megat Zuhairy bin Megat:
Bismillahirrahmanirrahim. Assalamualaikum warahmatullahi wabarakatuh and a very good afternoon, ladies and gentlemen. First of all, I would like to express my gratitude for inviting me here today, especially after two months of holding this post. Before this, I was involved in digital transformation, I was not in cybersecurity. Just to answer to your question, John, I think we established our Malaysia cybersecurity strategy in 2020. It was a five-year plan, which fight with five pillars. The first one is effective governance and management, which we established NAXA, National Cybersecurity Agency of Malaysia, which I am right now heading. Number two is legislative, strengthening legislative enforcement, of which we will establish our cybersecurity bill next year in March, which we will table in the parliament. Number three is all about innovation R&D. Number four is all about capacity, capability building, awareness, and also education. And number four is global collaboration. To respond to your Malaysia cybersecurity… strategy, its vision is to establish a secure, trusted, and resilient cyberspace. It’s just not that, it’s actually supporting our Malaysia Digital Economy Blueprint, our IR 4.0 policy, as well as the other policies. One is our science, technology, engineering, and math policy, promoting students to go into these four fields, and some other strategies. So the reason that Malaysia’s cybersecurity strategy is very important, we see it as very strategic because it supports the other strategies and policies that have been established before.

Moderator:
If I can bring in His Excellency from Qatar, and if you can drive home, it’s very interesting, if I can use an analogy, Qatar was the little engine that could, right? It’s grown so rapidly off of the strategic decision in 1992 to develop natural gas, and then to have that pervasive development in the state. Your view on the link between a robust cybersecurity system, if you will, and the ability to foster growth on the ground locally, but how that makes Qatar a global player in this idea that Saudi Arabia’s building an international hub here. Qatar’s been doing the same. Why is the cyberspace component so vital, would you suggest, Engineer?

H.E. Eng. Abdulrahman Ali Al-Malki:
Thank you, John, for that. First of all, I would like to thank the organizers of this conference for all their efforts, and we all support the Saudi Arabia Cooperation Council to move forward in this field and become the leader in cybersecurity. Back to your question, Mr. John, in terms of cybersecurity, from a general perspective, everyone knows that cyber security is very expensive. Everyone says that securing the systems and securing the sites costs a lot of money. It leads to a shortage in budgets for some ministries or even for private companies. In terms of leadership, we see it in two ways. The first way is that if you have an appropriate budget for cyber security from the beginning, you can protect your assets or systems from the greatest risk, which is the constant losses after the attack. The losses lead to the return of the system or the systems to work again. This is a much bigger loss than the initial budget for cyber security. This is one perspective. The second perspective is that the countries that made big budgets for cyber security benefited from the short and medium term, and even the long term, by attracting global solutions and providing the appropriate infrastructure for new projects and new ideas that will be applied in the future. This led to the attraction of companies, because when companies study a new topic or a new project, the infrastructure is enough to protect their investments in this project. We see from this perspective that having a high budget is not a bad thing, it is excellent. In terms of attracting foreign companies to work in these countries, and at the same time, the protection of the very foundation that is inside the country from an attack and greater impact on the return of services.

Moderator:
And I’m sure that must have been a challenge of a lifetime from a cyber standpoint. So the preparedness afterwards, if you can think about it, I’d love to get your thoughts on what was set up to make sure you could withstand a global event of that sort of scale. Felix, you’re so respected in the business. It’s great to have you with us today. I would like to discuss the role of R&D, and you could use the Spanish example or extend it out to the European example. This is a cost, so what’s the cost-benefit analysis of making the investment in R&D and how it feeds into the rest of the Spanish economy? And how did you structure the institute? Because I think it would be wise here because the GCF has its own institute now, and I think that sort of information sharing could be very useful. Please.

Felix A. Barrio Juárez:
Thank you very much, and thank you for the invitation to participate in this amazing new edition of the Global Cyber Security Forum. Congratulations. First of all, in the European Union, we have, since three years ago, public policy, called Next Generation Action, that pretends how recovery of the economy can be boosted after the COVID pandemic. And in this time, we have learned that the main successful experience has been, in fact, to invest directly in research and development in digital transformation. In fact, in the case of Spain, one of each three euros invested through this program of next generation is allocated to this purpose of digital transformation, and in particular it is very important to invest in research and development in the SMEs. Small and medium enterprises is the successful vector for this catalysing of the market, because at this moment we depend to extend all delays of provision of services and solutions in cyber security in a peripheral movement. In fact, we lack of enough small and medium enterprises to reach all the requirements that we are putting on the table around the European directives. So important is that in three years, in Spain, we have moved from 12% of our national economic growth to the 22% of the growth is depending on this purpose of digital transformation and in particular cyber security. It’s very important. This year we have spent more than 224 million euros directly in research and development for SMEs, with more than 140 different projects, and the condition is you have to be led by a small and medium enterprise, and this is directly linked to something that Mrs Abu-Halef mentioned before. He said independence of the country. We have to talk about national sovereignty in terms of technology, and cyber security allows this.

Moderator:
So interesting. I’m glad you brought it up. And I think I’d love to have this question for the entire panel, so I just want us to be very direct. That was brought up in our opening plenary session today. How do you get the… balance right between international cooperation and protecting national sovereignty? And where does international cooperation really go deep enough to the challenge of today? This is, you’re introducing AI, generative AI, into a system when we don’t know whether we have the thresholds of protection ready. Do you want to touch on that, Waleed, and where you think collaboration, you came from an international defense player, so you know the role of international cooperation, you want to use that model?

Eng. Walid A. Abukhaled:
No, no, absolutely, Rick. I believe, not long ago, I’m not sure about the statistics now, but I know for a fact Saudi a couple of years ago was one of the most targeted in a country, maybe in attacks, cyber attacks. And maybe this is 10 years ago, I saw lots of statistics, and it was definitely one of the most targeted. I believe there’s lots and lots of lessons learned. And I hope we can set up here in the kingdom a command and control global or regional command and control centers, where there are various countries who are joined or part of this command and control, and they can all share threats, they can all share the attacks, the type of attacks. Because these days, the minute you identify an attack, and of course you put the prevention where there’s another one in the way, and that’s going to be continuous, nonstop. So if there is a regional stroke global command and control center set here, with various countries included, and where we can share regulatory reforms, where we can share the type of threats that’s coming, and I can assure you it varies. Some attacks here are common in other countries, but some are different. And really put some regulatory framework where how can we develop the talents of the future leaders when it comes to cyber, how can we share best practices, and so on. I believe this will be a win-win to all. and will definitely benefit. There is a direct relationship between safety and security and prosperity of any nations. Foreign investments always link to safety and security of any nation, so if a country wants to invest in another country, they look at the safety and security of that nation. Make no mistakes, the future is all about cyber, and this is the huge security about protecting strategic assets, protecting investments, and so on. So I totally recommend and support having a regional hub, stroking global, where they can share best practices and learn from each other.

Moderator:
Good. Does it make a difference? I think this is a great question for you, Dr. Magat. To have somewhere geographically that straddles east and west and north and south, and I’m thinking of Saudi Arabia, I’m very aware of the Islamic roots going down to Southeast Asia, so this is a commonality, right, on the spice route. Could you see the kingdom serve as a bridge between the U.S. and China where they compete fiercely on technology, where you can at least, as the engineer was suggesting here, have a commonality is that we have to have the common good of protection and to share knowledge. Is that possible that could happen here in your view?

Ir. Dr. Megat Zuhairy bin Megat:
Well, I think global collaboration is always the fifth pillar of Malaysia’s cybersecurity strategy. We have been communicating or collaborating with our cybersecurity entities around the world, the globe. You are already? Yes. Oh, that’s great to hear. We have been seen as the middle ground country. We have received threat intel from ASEAN, EU, the U.S., China, and however, although with the abundance of data information, we could only respond to that with the necessary capacity and capability. We have our command center in Malaysia. We share our intel for Singapore, Indonesia. and the rest of the world. However, without capability and capacity of us receiving the information, we will not be able to translate that, whether that is a real threat or not, for example. So, coming to that, I think, unless a point of view, we see that we need to invest a lot on capacity building. In fact, for a statistic, for example, we aim to have about 25,000 or 30,000 of cybersecurity knowledge personnel in Malaysia, but we only have about less than 15,000. So, to do that, we have to do certain initiative of promoting people or students coming into Malaysia. I mean, in Malaysia, choosing cybersecurity as their career choice and their education choice, that relates to, again, science, technology, engineering, and math, promoting students from primary school, or secondary school, to choose cybersecurity as their field, then going to the industry, and then we’ll be able to have enough knowledge personnel to then translate, to receive that intel and information from which we receive from the globe, so that that intel can be translated into a real decision. So, although global collaboration has been somehow successful in Malaysia, we have not get much from that value because we do not have enough talents to use that advantage.

Moderator:
Good. Very quick follow-up for you, then. What’s the relationship between the government, the private sector, and the universities? Because I’ve always seen successful PPP models where you have industry saying, I’m lacking that expertise, we need to put this in the curriculum. What are you doing on that front in Malaysia?

Ir. Dr. Megat Zuhairy bin Megat:
It’s good that we seize that, everything that we do right now. especially in digital transformation, anything related to new policies or new direction, collaboration with the industry’s academic institutions has always been part of the strategy. So, in fact, when we draft our cybersecurity bill, number one is always about getting inputs from the industries, getting feedback from the academicians to give inputs so that our cybersecurity bill does not just look into the aspect of governing, penalising, setting standards, setting direction, which government thought we could behave and govern the industries and the stakeholders. So, it is very important, in fact, collaborating with the industries. When we draft the Malaysian qualification agencies, when it drafted the requirement of approving certain programs in the universities, they must prove, the universities have to prove that there are inputs from the industries. So, without that, that program will not be approved.

Moderator:
Okay. For those who need the translation devices, I’m going to call on engineer Al-Maliki here. And the role of international cooperation, can you answer whether it’s real? Now, we heard two regional examples, the collaboration between Saudi Arabia, UAE, Qatar, for example, the GCC collaboration, even extending, I would imagine, to the Middle East, North Africa. Dr. Mergat talked about the collaboration in Southeast Asia and the ASEAN countries. Do we have a model that works in Qatar? And you see the international cooperation, and if you want to answer this question about the World Cup, what sort of cooperation were you getting internationally on such a major event? if you can

H.E. Eng. Abdulrahman Ali Al-Malki:
and the the the for the We started with the issue of putting a comprehensive plan to see what are the problems of the sovereign security at the level of Qatar. This vision was based on what they call the national framework, which was applied to all institutions, bodies, ministries, and even some private sectors or private companies that have direct contact with the government. We started the application, but it was not just a matter of putting a framework, or a national sovereign security framework. No, we put the framework and started to monitor it on a daily basis. There is a direct monitoring with all the parties that implement it or not. Until we got closer to the date of the round itself, or the World Cup. During this period, we started our contacts with friendly countries. We had a lot of friendly countries that wanted to participate with us in the event. We all participated with them. We shared the problems and the challenges we had. Thank God, we were able to provide a working team from some countries that were present in Doha during the World Cup. They provided us with support in many ways, especially in the case of the attacks coming from the countries themselves. They were always analyzed and gave us the data. In some countries, they shared their data with us directly. The good thing is that we are still in this relationship with these countries. We receive data from them and provide them with data on sovereign security.

Moderator:
Very interesting. I didn’t realize the level of collaboration was so great. Felix Barrio Juarez, I think it would be great to talk to you about can we move this conversation to the next level, right? What I mean by that is can we harmonize standards where we have this collaboration that we talked about here in the region, Southeast Asia, the European Union. which you singled out in your first answer. How do we get harmonization in the cyberspace where we’re speaking the same language, we don’t have redundant systems that we’re putting in, the investment has a channel where you see it’s gonna be robust for four or five years in a very changing markets. How do we share those harmonization ideas, do you think, Felix?

Felix A. Barrio Juárez:
Maybe it’s the main challenge we are facing at this moment in terms of reshaping of this global market that is the cybersecurity and the digital market in a broad perspective. Because standards maybe can become a kind of barrier for the entrance, not only for foreigner vendors and providers, it’s a threat in terms of we are setting some kind of barrier for small and medium enterprises. And this is the question. In European Union, we are boosting all the moment through the standardization process in order to establish a strong lay of requirements. This morning, President Barroso explained it very well, this and how this has a purpose to accelerate the digital change, but in other hand, we have to, we should to think on the third countries. This is very real, not only for North and South countries, but also inside European Union because it’s very different the market in the Eastern countries and the Western countries and we have to work in a level where standards allow new entrance of this new generation of SMEs. In the past debates around the MIS-2 directive, the European Union Act for Cyber Security, past November, it was suspected that we will need more than 150,000 new SMEs. in Europe in order to have the capability to provide this kind of new services in cybersecurity with these new requirements of standardization. And the problem is what happens if we set some kind of standard that is a barrier for this new very small company that is based, for example, in a small town, and you depend only about the foreigner providers and big companies, big firms. So we have to work in these two different ways in order to combine.

Moderator:
What a great point. If I can share this idea, and Dr. Magat, I see you want to interject, how do we make sure this is inclusive? Because you know, Asami is a beast, right? It’s running the military sector and you’re bringing, you actually made an acquisition of a cybersecurity company, which you can bring up. Dr. Magat, you know, you have this disparity of wealth and you don’t want, the SMEs create the most jobs, but you don’t want them vulnerable. Do you want to pick it up?

Ir. Dr. Megat Zuhairy bin Megat:
I think I would like to comment on the aspect of standards itself. Sure. Although standards may actually improve efficiency when it comes to communicating and information sharing. However, I would like to relate to, I’m from the engineering, before this I was in the construction industry. And we always, our reason of not moving or change to a different, in other words, innovating. Because in construction industry, standards is all about safety, health and quality. And when you want to move away from the standards, no, we cannot do that because we are compromising these three aspects. This is similar, I think, if we, however, the bad part of it is that it actually demotes innovation. Similarly, I feel that if we are too much focused on standards, although they’re positive. The advantage of that in terms of communication and efficiency, however, it may deter or demote innovation. So you wanted to keep the innovation engine moving is what you’re suggesting. Number two is that when you are, with the standards established, and we are actually exposing ourselves that the threats knows what the standards are, and we’re actually exposing ourselves for more threats. And they know that we are not innovating, we are not improving ourselves, we’re not transforming because we are too much focusing on standards.

Moderator:
So there’s a balance between the two is what you’re saying. What a great debate. Engineer Walid?

Eng. Walid A. Abukhaled:
No, no, sure. Look, SMEs in any industry, not only cyber, play absolutely crucial parts in supporting the bigger organization and the bigger mandates of any industry. Part of my career when I was working in defense once, I was with the global, one of the largest global defense company globally. And I was with the head of strategy and he said we’re going to go acquire a company so let’s go together and just take a look to start our due diligence. And I genuinely thought we’re going to go to a huge headquarter, a huge company, big factories. He ended up going to a home and that home had a garage and we went inside the garage to see an individual who built something that’s very innovative. Where was this? That’s in the US. Wow. It’s like a Bill Gates story. Genuinely. And that was a global defense company. So you can imagine, when it comes to cyber security industries, without support of strong small and medium enterprises, I think we can kill innovations. I can tell you we are big corporations. Innovation, we try to implement as much innovation as possible, but exactly as Dr. said, sometimes you have certain standards, certain compliance issues, quality and process and policies that prevent quick innovation, quick thinking and so on. So I believe we definitely have to develop SMEs, support them, and I think we should support them by regulations. And I hope we can implement a policy where you say, if we give a contract, one of our company, advanced electronic company, SESAME Advanced Electronics, that 10% of this contract should go in supporting SMEs or 15%, whatever. I hope that we can build this in the regulatory systems where we really encourage SMEs. They are the engines for any economic community or economic strength. So I believe that’s going to be extremely important.

Moderator:
Great. I’m going to do the final question, and I want you all to chip in on this final question with no more than a minute each, because then I want to ask a question about trust at the very end, which I think is very important. It’s like, how do you maintain consumer trust? If you get onto an app and you’re trying to do a business transaction or e-commerce for a small business, you don’t have trust in the system, because of cybersecurity, we have a problem. So think about it, because that wasn’t in our list of topics. But I think trust, we assume that the companies have our back, the government has our back, but the challenge is always changing. So would you say is your biggest priority, Felix, on your side today, if you’re going to look, if we sit down for GCF in 2024, what’s going to be the priority that you have accomplished this year?

Felix A. Barrio Juárez:
Yeah. Despite we need more than ever from the private initiative in order to build this level of capabilities in cybersecurity, we have to put all the public service focused in the more vulnerable sectors, and the consumer is the main. So we built three years ago a hotline, 017 telephone number, that attends every citizen, every small and medium enterprise, every professional is suffering some kind of cyber attack, or they are suspecting they can reach us every day of the year. This is very important. We receive more than 2,000 calling demands per week. And this is the way to say to the people the message that everybody is part of the solution. are not protected by the public sector. This is a very lucrative field.

Moderator:
Very interesting. It’s very consumer-facing, I think. Engineer Al-Maliki, do you want to tackle? What’s your key priority this year?

H.E. Eng. Abdulrahman Ali Al-Malki:
First of all, we need to understand, in order to know the important things, we need to know the risks, we need to study the risks and know where they are. Of course, the risks vary from one country to another. The risks for one country are not the same as the risks for another. In Qatar, we studied this issue. We had two directions. The first direction is to build capabilities. In addition, we need to find a mechanism to license workers in the field of cyber security, at the company level, at the level of the organization, and even at the level of the workers or engineers. This is the first part. After studying this, we discovered that the biggest risk we face today is the supply chain. The chain… I don’t know how to say it. Anyway, I think the previous session discussed this issue in detail. But we found that not studying the supply chain for any service or organization causes us the biggest problem. This has happened all over the world, but for us, we discovered that the smallest entity in the supply chain can cause a complete failure of the service.

Moderator:
Excellent. Thank you for the answer on that. The two of you are going to finish up, Dr. Magat and Engineer Waleed. Quite extraordinary. 60% of attacks are on airport infrastructure, so we take for granted that our skies are secure. 66% of healthcare organizations hit by ransomware attacks. Critical, right, if a hospital goes down, the threat. 86% of global CEOs believe there will be a catastrophic event in their cyber operations. So this is a trust game and it’s a race. How do you approach it as your priority? Dr. Magatan will finish with His Excellency Waleed. Thanks.

Ir. Dr. Megat Zuhairy bin Megat:
Malaysia always feels that it’s all about secure, trusted, and resilient cyberspace. My priorities right now is all about capacity and capability building. In fact, when you promote, Malaysia always promotes digital transformation, when we establish trust, more people will come into the cyberspace. More machines, people will be coming into cyberspace. It can be a positive is what you’re saying, right? Positive, but then we have to create more resilient, more approach, more people to protect, to establish a peaceful and resilient cyberspace. So capacity building, capability building is a continuous effort, we could not stop, we cannot stop because, again, innovation, the generative AI, establish a totally different cyberspace environment, which we may not know what the solution today. So capacity, capability building, that’s my priority.

Moderator:
Great. We’re going to have a session this afternoon, just after two o’clock, on widening the lens. What’s the role of media in the process of supporting government and the consumer? Because you have to educate people to know of the potential threat and the opportunity, as we’ve all talked about. Engineer Waleed, you have the last word.

Eng. Walid A. Abukhaled:
Thank you so much. Look, His Royal Highness, the Crown Prince, have been consistent from the day of launching Vision 2030. The biggest wealth the kingdom have is its people, the youth, the human capital. It’s all about developing talents, specifically I’m talking on the domain of cybersecurity, having the right talents. But we have issues. I have, and I don’t know how NCA can help us and help other companies in this. When I have a cyber security specialist Saudi nationals who probably four years of experience they ask for a salary They’re the same as mine as a CEO of this company We we have we have that’s true inflation. That’s true inflation. God bless them. I wish I wish life can go back I would have got into cyber security specialist, but genuinely developing the right talents And regulating the market and I think we need a lot a lot more and really when I discuss with my fellow CEO From global companies. It’s no exception. I mean this this issue is not only in the kingdom. It’s issues globally So so that’s something I hope we can put certain emphasis on I totally agree with capacity and developing the right talent but when you mention trust Trust as you know is gained rather than so so MCA can put all the regulations if and we can comply 100% but still if I’m always penetrated and There’s information Lost then there is an issue that we really need to look at it The same applies for any applications if I talk to my friend and this happened recently I was telling him I’m interested in buying new car lucid and all of a sudden all the advertisements appear about lucid Should I trust this application anymore that that’s listening to me? So it’s really in my view trust is gained. We need the right regulatory framework. I genuinely hope And I’m sure that this global cyber security forum Will let will learn a lot from it I think there are global mindsets in here and I truly believe this this has been extremely beneficial to all I look forward to the next one. Yeah knowledge is power absolutely, right?

Moderator:
Absolutely, and this is one of these things where I think we have to bring the consumer along for the ride you know because if they don’t know what the Their role is in this and you have to as you said earn their trust to make sure that the government But the private sector and academia has their back in a big big way Can I thank you again for the an excellent assembly of fantastically good minds? governor to tackle this from the cyber authorities, the institutes that we have here, the government standpoint in having such an important sector such as the military. Can we give them a nice round of applause? Thank you very, very much. Thank you. Thank you. Thank you so much. Thank you. Thank you so much. Terrifically done. Thank you. Excellent. Thank you. I appreciate it. Really excellent. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you. Thank you.

Dr. Albert Antwi-Boasiako

The issue of jurisdiction and sovereignty in cyberspace poses significant challenges. With the advent of the digital transformation, traditional concepts of jurisdiction in physical spaces clash with the borderless nature of the internet. This creates difficulties in defining jurisdiction in cyberspace. The lack of clear boundaries makes it challenging to attribute cybercrimes to specific individuals or entities. The growing use of IP spoofing and AI-enabled systems in cybercrime further complicates attribution. As a result, identifying and holding cybercriminals accountable becomes increasingly difficult.

To effectively combat cybercrime, there is a need for international cooperation and legal harmonisation. Ghana’s membership in conventions and treaties, such as the Budapest Convention and the African Union Convention, highlights the importance of global collaboration. By joining these international efforts, Ghana recognises the necessity of unified action against cybercrime. Moreover, the mention of an international treaty to counter the use of information and communication technologies (ICT) in cybercrime underscores the significance of a coordinated global response.

Unfortunately, bureaucratic responses to cybercrime often lag behind the speed of hackers. The slow pace of decision-making and lack of urgency from world leaders hinder the effective addressing of cybercrime challenges. Ransomware attacks and organised criminal networks continue to thrive due to the insufficient urgency exhibited by policymakers and officials. There is a clear call for faster action and a more proactive approach from world leaders to tackle the ever-evolving cyber threats.

Addressing cybersecurity requires concerted efforts at multiple levels. Countries need to establish strong national legislation to combat cyber threats effectively. However, aligning this legislation with sub-regional and global instruments is crucial for comprehensive cybersecurity measures. Ghana’s recent passage of a cybersecurity act in 2020 demonstrates its commitment to addressing cyber risks at the national level. To further strengthen cybersecurity, collaboration and coordination are needed at sub-regional and international levels.

The difficulties in accessing data from big tech firms also raise concerns about data governance and sovereignty. Domestic laws may be enacted to compel these companies to keep data within the country, asserting data sovereignty. Balancing the need for cooperation with big tech firms and the desire for self-reliance in managing data poses a complex challenge for governments worldwide.

The private sector’s cooperation with states is essential for progress in tackling cyber threats. Recognising that the private sector possesses valuable expertise and resources, collaborating with them can enhance cybersecurity measures. This cooperation can pave the way for more effective cybersecurity strategies and the identification of emerging threats.

Ghana’s hosting of the Global Conference on Cyber Capacity highlights its ambition to lead cybersecurity efforts on the African continent. The conference, organised by the World Bank in collaboration with the World Economic Forum, GFC, and Cyber Peace Institute, brings together international delegates to explore and promote cyber capacity building. Ghana’s hosting of this significant event aligns closely with its vision to play a leading role in strengthening cybersecurity in Africa.

In conclusion, the challenges of jurisdiction, attribution, and legal harmonisation in cyberspace demand international cooperation and proactive measures. Efforts at multiple levels, from national to international, are required to effectively combat cybercrime. Collaboration between states and the private sector is vital for developing robust cybersecurity strategies. Ghana’s involvement in international conventions and its hosting of the Global Conference on Cyber Capacity underpin its ambition to lead cyber capacity building on the African continent. Overall, it is clear that addressing cyber threats and safeguarding cyberspace is a complex and multifaceted task that demands a unified and coordinated global response.

Prof. Marco Gercke

Jurisdiction is a crucial aspect of cybersecurity, allowing for the fight against cybercrime and ensuring overall security. However, the jurisdictional limits of enforcement agencies are often defined by national borders, which can create limitations in cooperation between countries. This is especially true when countries have different classifications of crimes, leading to limited cooperation in criminal matters.

Cooperation plays a significant role in addressing cyber threats, extending beyond the criminal field. It can take various forms, such as information exchange and collaboration in cybersecurity. Fostering collaboration across sectors and disciplines is key to effectively addressing these threats.

Jurisdictional limitations also serve a purpose by allowing different criminal systems worldwide. Different countries can criminalize activities that may not be criminalized elsewhere, addressing issues based on their societal needs and values.

Both regional and global cooperation are seen as potential solutions to tackle cyber threats. Regional cooperation has already shown positive results, with successful collaborations between governments in different parts of the world. Prof. Marco Gercke advocates for private sector involvement, highlighting the benefits of multinational companies assisting law enforcement agencies in accessing crucial data.

The advent of cloud services has brought both opportunities and risks to cybersecurity. Initially, there were concerns about restricting access to suspects’ data. However, law enforcement agencies soon realized they could approach cloud service providers directly for necessary information, opening new possibilities in data sharing and investigation.

Solutions for cybersecurity challenges can be pursued at national or international levels. Some propose addressing issues through national legislation, while others suggest involving larger international organizations such as the United Nations. Combining different approaches may be the way forward.

Cooperation at various levels, sectors, and regions is vital in addressing cyber threats. Ghana’s Cyber Security Act of 2020 demonstrates the importance of national-level legislation in bridging gaps in cybersecurity. Sub-regional instruments, like those implemented by ECOWAS, contribute to enhanced cooperation. While global expectations should be realistic, basic cooperation frameworks remain essential.

Efforts to establish effective cooperation frameworks require exploration and evaluation. Existing frameworks and avenues for cooperation can be assessed to develop more robust mechanisms. If negotiations for cooperation fail, it may be necessary to reassess and develop new strategies.

It is important to note that cybersecurity is linked to various areas of concern, from attacks on critical infrastructure to child sexual exploitation. Each area presents different levels of cooperation required and unique challenges.

While regional cooperation has yielded positive results in cybersecurity, a comprehensive global approach is still needed. Many emphasize the need for broader international cooperation to effectively address cyber threats.

In conclusion, jurisdiction is a critical aspect of cybersecurity, enabling the fight against cybercrime and ensuring overall security. However, jurisdictional limits at national borders can limit cooperation. Cooperation plays a significant role in addressing cyber threats and can extend beyond the criminal field. Jurisdictional limitations allow for different criminal systems worldwide. Regional and global cooperation, along with private sector involvement, are potential solutions. The advent of cloud services brings both opportunities and risks. Solutions can be pursued at national and international levels. Cooperation at various levels, sectors, and regions is vital. Efforts to establish effective cooperation frameworks require exploration. Cybersecurity is linked to various areas of concern. While regional cooperation has shown promise, a comprehensive global approach is still needed.

Sheikh Salman bin Mohammed Al Khalifa

The analysis examines different perspectives on the importance of cooperation and legal protections in tackling cybercrime. It cites an example of cooperation between the Kingdom of Bahrain and the UK to address online child abuse, highlighting the positive sentiment towards cross-border collaboration in combating cybercrime.

Effective cybercrime cooperation is believed to be achieved through inter-regional, international, and cross-regional agreements. The GCC agreement in Bahrain is presented as an example that supports the investigation and resolution of online crimes, reinforcing the argument for effective cross-border collaboration.

Some argue that there is no need to wait for the UN to address cybercrime, suggesting that regional bodies and cross-regional cooperation can take the lead. This neutral stance indicates confidence in the effectiveness of regional collaboration without relying solely on international organizations like the UN.

The significance of legal protection for companies sharing information in cybercrime cases is emphasized. It is noted that private sector companies may face legal consequences, such as being sued under the General Data Protection Regulation (GDPR), if they share information without proper authorization. This underscores the need for proper authorization and legal safeguards when combatting cybercrime.

Furthermore, there is support for establishing global or regional mechanisms to minimize the legal risks faced by companies in cybercrime cases. It is seen as a positive step towards SDG 16 (Peace, Justice, and Strong Institutions) and SDG 17 (Partnerships for the Goals). However, no specific evidence or supporting facts are provided in this regard.

The importance of international cooperation in combating ransomware attacks is also highlighted, with 40 countries signing up for collaboration to stop paying ransomware and share critical information. The ability to respond quickly to attacks through inter-regional cooperation is also emphasized.

There is a negative sentiment towards cybercrime due to its impact on individuals and companies globally. The need to extend laws and regulations to protect organizations and individuals from cybercrime, particularly ransomware, is emphasized. It is mentioned that laws supporting cybercrimes related to children are already in place.

In conclusion, the analysis emphasizes the significance of cooperation between countries and regions in addressing cybercrime. It highlights the importance of legal protections, agreements, and regional collaboration as effective strategies in combatting cybercrime. The negative impact of cybercrime on individuals and organizations necessitates the extension of laws and regulations to safeguard against these attacks. Overall, the analysis offers valuable insights into various perspectives on cybercrime cooperation and legal protections.

Bernardo Pillot

In this discussion on cybercrime, the speakers raise concerns regarding jurisdiction and the challenge it poses in addressing cybercriminal activities. They highlight the complex nature of cybercrime, with perpetrators operating in one country, using infrastructure located in another country, and victims scattered across multiple countries. This leads to difficulties in the law enforcement community in navigating and effectively addressing such crimes. The argument is made that jurisdiction is a significant problem in cybercrime.

However, Interpol is recognized as playing a vital role in facilitating collaboration and the exchange of information across jurisdictions. As an international organisation, Interpol has 195 member countries, each with a national central bureau for communication. They emphasise that Interpol’s role is to establish programmes and provide training to law enforcement agencies worldwide to enhance their capacity and knowledge in fighting cybercrime.

Cultural differences are also acknowledged as affecting international cooperation on cybercrime. The speakers note that the handling of this issue varies due to differing legal frameworks and regional challenges. Interpol adopts a regional model that provides tailored support addressing specific challenges and threats in each region.

The speakers express support for Interpol’s role on the UN Ad Hoc Committee as the global law enforcement voice, giving a voice to the law enforcement community. They highlight Interpol’s active involvement in the UN Ad Hoc Committee process. However, they also acknowledge that in such negotiations, many countries are represented by diplomats rather than the people directly involved in using the mechanisms being discussed.

The potential of public-private partnerships is explored as a means to aid in cybercrime investigations in the absence of a global legal framework. The speakers mention Project Gateway, which involves collaboration between Interpol and 13 companies. These companies possess the intelligence necessary for law enforcement agencies to push forward with investigations. The evidence presented supports the argument that private sector involvement can be beneficial in addressing cybercrime.

The speakers place an emphasis on immediate cooperation in cases related to child sexual abuse, which is considered a top priority. They mention that child sexual exploitation material is handled with utmost priority by Interpol.

On the other hand, challenges related to information exchange during ransomware attacks are highlighted. Law enforcement agencies often face limitations when it comes to sharing essential information, indicating the complexity surrounding such incidents.

In conclusion, there is a consensus among the speakers on the need for improved trust and cooperation among international organisations to effectively combat cybercrime. They believe that addressing the challenges of jurisdiction, cultural differences, and information exchange will require collaborative efforts and the active involvement of organisations like Interpol. The speakers’ insights shed light on the complexities of cybercrime and the importance of international cooperation in effectively combating this global threat.

Prof. Marco Gercke:
Good, welcome to the audience and to this session. I have excellent experts here with me to answer questions that we’d like to discuss with you. I’m gonna be just making some brief statements. Jurisdiction is the holy grail of cybersecurity, to be very honest. If we four would be able to solve the issue of jurisdiction or we all together in this room today, we’d made a major step forward. I don’t think this is gonna be possible. And I think what we need to do is we need to distinguish between two topics. There is the topic of jurisdiction, which is usually related to crime, to criminal investigations, to cybercrime. And there is the more broader topic of cooperation. Cooperation can take place outside of any criminal field. It can be cooperation in cybersecurity, exchange of information. So we’d like to address both topics. They’re intertwined, but I’d like to separate them for a moment. And I’d like, as a criminal law professor, to maybe make one comment. There are a lot of people who say jurisdiction is one of the key problems, one of the obstacles to successful fight against crime, against cybercrime, and ensuring our security. I’d like to caution you a little bit. Jurisdiction is what we understand when we’re saying there are limitations to the authority of an enforcement agency within a country. So the enforcement agencies in Saudi Arabia will find their limits in general at the border. That means if a crime is happening outside the country, they will not be able to enforce it unless there is certain agreement of cooperation in the criminal field. There are very few cases where you wanna claim jurisdiction outside your borders. These are very, very rare cases. And in general, jurisdiction and the limitation to jurisdiction serves an important purpose. It allows us to have different criminal law systems in the world. It allows you to criminalize things which are not criminalized in other parts of the world. And cooperation in general finds its limit if countries have to work together and they realize we are not talking about a criminal offense in both countries. If one country criminalizes something, the other country does not criminalize it, the possibilities for cooperation in criminal matters is very much limited. Therefore, if we had jurisdiction or one of the conditions for closer cooperation in criminal matters is actually that we would align our criminal law systems as well, we would criminalize the same things. Okay, that as a general remark. We have excellent experts here and I’d like to pass on the question to Bernardo maybe from Interpol as you are one of the organizations that is closest associated with the first part, fighting crime. What’s your view? What is hindering effective fight against cybercrime? Is it the problem of jurisdiction? Lack of cooperation in general? Is it missing criminalization? What’s the issue?

Bernardo Pillot:
Sure. Thank you first of all for having me here. I’m honored to be here representing Interpol. This is our third year participating in the Global Cybersecurity Forum so I’m thankful to be here on behalf of Interpol. That’s an excellent question. I think it hits different points. Jurisdiction is a big problem. Cyber is not your traditional crime area where you have law enforcement responding to a crime, initiating evidence collection, interviews. The jurisdiction is in the country and an example of traditional crime. In cybercrime, it’s global. It transcends borders. You could have a cybercriminal operating in one country, you could have infrastructure in another country and then you could have victims in a third country so it’s very complicated navigating that environment in the law enforcement community and that’s where Interpol comes in. We have 195 member countries around the world. Each member country has a national central bureau which is the way that Interpol member countries communicate so our role is basically to collaborate and bring countries together to look at cybercrime in particular how to exchange information across jurisdictions and then when we see there’s a lack of perhaps capacity or knowledge in cybercrime, then we do capacity building where we set up programs to train the law enforcement around the globe on fighting cybercrime.

Prof. Marco Gercke:
Can I just follow up with a brief issue? As you are working with so many different countries, do you believe that culture is an issue that we have a lack of cooperation in certain areas because of a lack of culture or is it just that we’re lacking an international instrument that we have in other areas for example organized crime where we have a UN convention? What’s the difficulty?

Bernardo Pillot:
Well, the difficulty can be cultural. For our cybercrime program, we recognize that we can’t treat every country the same. We have 195 member countries. Cybercrime is unique. There’s some similarities but as was mentioned, there’s different legal frameworks in different areas so we look at a regional model where we break the country up, the world into different regions and focus on providing our support for that particular region looking at the challenges that they face and the threats that are important to them and I think that’s the unique way that we have been handling this issue as far as collaboration. You know, the Budapest Convention I believe is 22 years old next month. Obviously, a lot has changed in 22 years. We have a lot of advancement in technology. Interpol has been heavily involved in the UN Ad Hoc Committee process. We’re there to serve as the global law enforcement voice. Obviously, this is negotiations between countries to establish a new way of working which can be challenging obviously based on a lot of geopolitical conflicts but we’re hopeful that by us being part of this forum that we can give a voice to the law enforcement community which are the ones that actually have to do the work. A lot of countries are represented by diplomats and maybe not the people that are actually gonna be using the mechanisms that are being negotiated at this point.

Prof. Marco Gercke:
Perfect, thank you so much. Albert, before I come to you, one issue. It was last year’s forum here where we discussed the UN approach towards cybercrime, the discussion negotiation about a convention. I think we were all hoping that at this stage we would be at a different place. The negotiations were not as successful as we were hoping here last year with a lot of encouraging comments for this. Let’s see where this is heading. The process is not over but it’s definitely at a difficult stage. Albert, with your experience taking this beyond just jurisdiction, the question of jurisdiction going into corporation, where do you see the key challenges at the moment and where do you see the solution for the discussion in cybersecurity field?

Dr. Albert Antwi-Boasiako:
Prof. Marko, thank you for the question. First of all, on behalf of my country, the Republic of Ghana, our appreciation to the kingdom, to the National Cybersecurity Authority in particular for extending an invitation to us. This is the second time participating, this is the last time I was with my minister and I think it’s been a sight. We appreciate the hospitality of the kingdom. I think the issue of jurisdiction, sovereignty, cooperation is an important one whenever the subject of cybercrime comes into the picture. Prof., I think you alluded to the issue earlier. Traditionally, not just law student, but once you came across jurisdiction, then understand there’s a physical space, isn’t it, with a certain boundary. But in the cyber sphere, how do you then define the jurisdiction? When somebody could be in Saudi Arabia and still be able to commission an act targeting IT infrastructure, certainly in Ghana. These are some of the challenges that we’ve seen in this particular area. So, digital transformation is now interrogating the concept of jurisdiction as the law applies. Of course, if you’re talking of cybercrime, then the law is also very important here. But, Prof., one area of difficulties, also attribution, is another huge area. Beyond the techniques of IP spoofing and others, even the advent of artificial intelligence, I think we are interrogating how do we establish attribution when AI-enabled systems are actually behind certain crimes. So, it’s a kind of important discussion. From our perspective, Ghana as a developing country, I think we are heavily dependent on consuming technologies which are hosted elsewhere. Those days of data localization, that also raises its own question. Data governance, data protection, and how to lawfully assess data to support criminal investigation. But, of course, I think at the end of the day, the question you raise is also the variability of domestic legislation. Because if you have the concept of jurisdiction implicates a law governing that particular space. And that has been a challenge in terms of legal harmonization that a particular cyber act will be designated as a crime in Ghana. And that same act will also be seen as a crime in another jurisdiction. I think the world is moving towards that angle. Ghana is a member of the Budapest Convention, which Bernardo mentioned about. It’s among a few African countries, about six or seven, which is a signatory to this. And we’ve also signed up to the African Union Convention just to address those sort of gaps. But Budapest Convention membership is just about 60. But it has been a good foundational international cooperation instrument. And I think I also wanted to add up to the UN resolution that has necessitated negotiations on international treaty to counter the use of ICTs in cyber crime, which Ghana has been participating. So I think, I do believe the world is moving towards that direction. But we are not moving quicker. You know, hackers move with the speed of light. But the bureaucrats, whether the EU, African Union, UN, you know, the pace by which we are, and as a technical person, after such negotiations, I’m like, you get annoyed. You know, we need to move because you see the issues happening. You see the ransomware. You see the organized criminal network acting. And you expect the world leaders to also act in a manner that is equally giving that sense of urgency to address the issue. But unfortunately, it doesn’t work like that. But I do believe, I’m quite optimistic that recent developments at the regional level, at the sub-regional level, but international level is moving us because we do not have a choice. I think it’s an imperative that we find international cooperation arrangement. Of course, we can agree on everything, but the baseline, understand them, and mature mechanisms of cooperation is required to be able to address cybercrime as a transnational crime in this particular manner.

Prof. Marco Gercke:
Prof, thank you for the opportunity. Oh, absolutely. So you see, again, there is great unity in the call for some kind of closer cooperation and having those frameworks in place.Sheikh, it’s a pleasure having you here with your experience. So we would like to benefit from this. When you’re looking at cybersecurity, and again, going beyond only the issue of jurisdiction, which is a more legal thing, but cooperation, if you’re looking at the region, if you’re looking at it globally, what’s the path forward? How can we get to a closer cooperation that we’re not standing there and just looking at crimes and attacks happening, but that we can respond in due time?

Sheikh Salman bin Mohammed Al Khalifa:
So I do see cooperation on the ground. So we cannot just say it’s negative all the time, but there is real examples of successes. For example, we had a case where there was child abuse, online child abuse stemming from Bahrain to the UK. And the cooperation between Kingdom of Bahrain and United Kingdom enabled us to cooperate, track, monitor, and collect the evidence necessary to prosecute the criminal in the Kingdom of Bahrain. Collaboration is a tool and allows us to resolve our problems, even if we don’t have jurisdiction. We can make it as difficult as we would like it to be, and we can simplify it if we choose to simplify it. But I think there is the intent between countries to resolve certainly certain crimes that are common to all of us. And I think as human beings, seeing people being abused is something that we all reject. Seeing crimes committed across the border is something that we all strive to stop. And I think establishing one-on-one relationship is one way of solving that problem, but also we have international cooperation and regional cooperation. For example, the GCC has the GCC agreement that we can, any crime that happens in one country, we will support another country in investigating and resolving it in all online crimes. And that’s the kind of collaboration you want. You want inter-regional, international, and maybe cross-regional agreements. So if we can’t, we do not need to wait for the international community to agree so the GCC can work with the African Union as well, so that we can harmonize our cooperation and utilize each one’s jurisdiction to resolve that cybercrime. So we don’t need to wait for the UN to solve our problem. I think we can have it happen at a regional level and cross-regions, and then eventually maybe the UN will catch up.

Prof. Marco Gercke:
That’s a very good point. I think it’s important to highlight that I had the pleasure of working with a lot of governments in different parts of the world. I’ve been in Africa. I’ve done a lot of work with countries here in the region with the GCC. There are those instruments in place already. We see it. We had the former president of the European Commission here. So in the EU there is regional cooperation. The Council of Europe Member States, there is regional cooperation. We have it in Africa. We see that there is a great degree of cooperation in GCC. We see it also in Southern Africa, sorry, Southern America and the OAS. There is a cooperation. So we see those regional instruments. What is currently still lacking is the global dimension that is adding something to it as cyber threats are truly global. Bernardo, I would like to ask you again on one of the issues. How about the private sector, the public- private partnership? Can that add to it? Can that, even if there is no legal framework, no global legal framework in place, can the fact that we have those large international, multinational companies that are based in the United States, for example, help law enforcement agencies around the world to get access to data that they need, even if there is no legal framework in place?

Bernardo Pillot:
Sure, absolutely. We at Interpol have a project called Project Gateway where we connect with the private industry, public-private sector. We have 13 companies that have signed on to this agreement and the idea is to exchange intelligence. Obviously these big companies are protecting their clients but they hold a lot of the intelligence that law enforcement needs to move forward an investigation, to identify different threats. So this collaboration that’s been ongoing with Interpol and these companies have allowed us to provide that intelligence to countries to act on it. The idea is to have actionable intelligence where countries can actually take action on cyber threat actors that have been identified. So we recognized early on that as law enforcement, especially in cybercrime, companies, big industry hold that data that we need. They have the expertise, the tools and what we need to do is leverage on that and it would be not just for the benefit of the companies but obviously for the benefit of our member countries around the globe.

Prof. Marco Gercke:
So did you want to add to it? Okay but I’d like to have your view on this on this issue as well because there is an opportunity certainly with global companies supporting the work of law enforcement or the fight against against cyber attacks. Is this something that we need to enforce where we need a forum like this one where we need to involve the industry and ensure that there are maybe global standards, a protocol, something even if it is not legislation in place that there is some some kind of mechanism in place that we can improve this cooperation with nation states? For example if you need to access data in the United States do you have the right tools or do you believe this needs to or

Sheikh Salman bin Mohammed Al Khalifa:
should be improved? I think that is a difficult ask because there are legal ramifications to that. If for example private sector companies took action or shared information they were not supposed to. For example take Europe, that’s part of GDPR and by sharing information without the consent of the companies or the information owner they can be sued. So and I think there needs to be some kind of protectionism given at the global level or at least at the regional level should the information shared in cases of cyber crime and we can focus on just that aspect of it and minimize the risk that they have to bear from a legal perspective so that they cannot be sued from the information owner or from the governments in the region.

Prof. Marco Gercke:
Okay that’s a that’s a very interesting point. I still remember discussions with law enforcement agencies at the time when cloud services started to pop up and they were really afraid that they said we will not be able to go to the premise of the suspect anymore and seize material there because they’re all stored in the cloud and that makes it significantly more difficult for us to get access to the material. However after a short period of time they realized okay but there is a centralized cloud provider and instead of having to search at the suspects premise I can simply call the cloud provider and say give me the data and I don’t even need to enter the suspects premise. So there are certainly two sides to each of the issues. There are opportunities and risks. I’d like to discuss a little bit the way forward. We only have nine minutes left. I’d like to to try to look out where do we need to to put the focus. Do we need to do it on the national level? Do we need to solve the issue there? Where do you see where we should take action? Where the focus should be? It can be again as we did last year call for the United Nations to take action. It can however also be to say okay let’s clean up our house first and make sure that we have the instruments.

Dr. Albert Antwi-Boasiako:
Prof, I think there is interrelationships around us. You can’t address this issue. It is only at international level, at a sub-regional level, without looking at domestic level. So I think at each level we need to make some tangible progress. Certainly the minimum is at a national level you need a legislation that is fit for purpose. So for example, Ghana in 2020 passed a cyber security act that tried to address some of this gap. You need to. I think as a rule of law country that is a baseline that you need to. Of course the alignment with a sub-regional instrument is also key and I think from my region ECOWAS has got instruments on cyber crime to facilitate collaboration. It is needed. At the African Union level working with Malabo Convention, the African Union Convention on Cyber Security and of course at a global level. I don’t think we should be overly ambitious with expectation of what to achieve at a global level. But I think at a domestic level, at the sub-regional level, there is that opportunity to agree on basic cooperation framework that we can address this issue. And I think it’s an evolving situation, there’s no doubt. And my last example, what’s the refusal or the difficulty for countries like Ghana to access lawful access to data from the big tech firms is leading to what we call, you know, data governance and what? And sovereignty. You are likely to do a domestic law that will compare service providers, institutions to rather invest in keeping their data within the country instead of keeping them out. So I think the environment is opening up and I think, you know, linking to the private sector issue, I think the private sector needs to be aware of what is happening and cooperate with the states so that we can make progress in this particular area.

Prof. Marco Gercke:
I mean, you heard during the opening presentation and those of you who are following the discussion already knew before that there is now a GCF Institute and maybe that would be something that the GCF Institute could look into and have a look at different frameworks that are already there, different ways of cooperation and maybe to see if it is possible to build upon this. Maybe we have to go get back to the drawing board when the negotiations in the room don’t work. Bernardo, there are different areas that we are associating with cyber security and cyber crime. From a perspective that was discussed here very frequently of critical infrastructure, there are attacks against critical infrastructure, but that’s not the only problem. We can go all the way down to, for example, child sexual exploitation material, which was mentioned here by Mr. Sheikh Salman before. So, what are the areas where cooperation works, where you see that’s something where it’s happening frequently and it’s happening routinely at a high speed, and where are areas where we’re finding it more challenging? Because I think this is really important. If you’re a provider of critical infrastructure and you’re realizing chances for cooperation are limited, that’s where the pressure starts to build up.

Bernardo Pillot:
From an Interpol perspective, the cooperation that we see that happens pretty quickly is anything having to do with children. Obviously, that’s important. Anything related to child sexual abuse material is almost immediate. Everyone collaborates, everyone works together, including private companies, obviously giving access of their information to law enforcement to take action. I don’t see that as an issue. I think the issue that we’re seeing is when you look at a ransomware attack, how are countries working together and exchanging information? A lot of times what we’re seeing, and it’s a tendency in law enforcement, is keeping things to themselves and not sharing with other jurisdictions that potentially can help mitigate the attack or find a way to attribute that attack to an actual person. So I think we need to work together in a better way, a more organized way. I think this is where Interpol plays a big role. We’re a neutral organization. We have 195 member countries, like I mentioned, around the globe. We’re not taking sides with one country or another. Our idea is to facilitate that exchange of information, but it has to come from a place of trust. I think it’s inherent in law enforcement that we don’t trust each other, so we need just to do a better job at that.

Prof. Marco Gercke:
That’s a good word, almost a good final word. We met here twice. This is the second time we’re meeting. When we’re meeting again, if we’re meeting inshallah next year, what will have changed? What are you hoping for as a realistic target? What could we have achieved over the next year when it comes to cooperation? Do you think there is anything where you see there is going to be a breakthrough, or do you believe it’s the small things that you do not necessarily see on a daily basis where agencies are working together, which will make most of the difference in this year?

Sheikh Salman bin Mohammed Al Khalifa:
I see two things. With regards to ransomware, we’ve seen 40 countries sign up for cooperation in order to not only stop paying ransomware, but actually sharing critical information about decrypting certain information. Now, if the whole countries started sharing how to decrypt that ransomware and sharing those keys, we would have less crime. That trend I can see happening. I see greater regional cooperation, so inter-regional cooperation between, say, the GCC and the African Union or South American countries. This inter-cooperation will also enable us to better respond in probably sometimes with the support, obviously, of Interpol, allows us to move faster, and I think that’s what we should see, more inter-organizational established relationship to rapidly respond to these attacks. Yes, you know, cybercrime related to children is an emotion that everybody supports and the laws support it, but we need to extend that as well to ransomware that can destroy organization and the livelihoods of individuals and companies globally.

Prof. Marco Gercke:
Thank you so much, Albert. If I can ask you, if you can make a 30-second wish, you only have… Here we go.

Dr. Albert Antwi-Boasiako:
I was going to ask you, Prof, thank you. Ghana is hosting an international event later November, the Global Conference on Cyber Capacity, being organized by the World Bank in collaboration with the World Economic Forum, GFC, also Cyber Peace Institute. We are expecting close to a thousand international delegates in Accra, and the team is capacity with Ghana’s vision to lead cyber security on the African continent, and we look forward to see some of you, if you receive your invitations already. Other than that, we’ll also be happy to engage on this going forward.

Prof. Marco Gercke:
Thank you so much for basically inviting the people in the room over to the next conference, which would be definitely a pleasure. The only thing I can do is I can carefully close this session, this panel, by thanking the panelists, thanking the audience. I think we have seen that there is already progress, that maybe we do not necessarily focus on when we’re only looking at the big global developments with the discussion about the UN Convention being stuck. We heard various examples of successful regional corporations that we can maybe learn from. We’ve heard that there are areas where cooperation works, because everybody’s interested, like the protection of children, where we’ve heard from successful examples where this cooperation takes place. Do I personally wish for more? Do you think we should wish for more, that we get this broad approach? Yes, I think it’s realistic, but maybe on the way there we need some more research, getting back to the drawing board, and maybe the GCF Institute can play a role there. With this, I would like to thank you all, and please enjoy the rest of the conference, and maybe see you all in Africa.

Excellency Mr. Yusuf Albanyan

Mr. Yusuf Albanyan, a former minister of education with a background in the energy and chemical industry, aims to enhance global cybersecurity through public-private partnerships. He sees himself as a catalyst between the public and private sectors and wants to target the enhancement of global cybersecurity issues. This aligns with the United Nations’ Sustainable Development Goals (SDGs) 9 and 17, which focus on industry, innovation, infrastructure, and partnerships for the goals.

Mr. Albanyan believes that cybersecurity education should be integrated into the education system as a change management program. He argues that the current youth generations are dealing with cybersecurity daily in their communications and learning materials and that their future lives are linked to cybersecurity issues. By incorporating cybersecurity education into the curriculum, students will be equipped with the necessary knowledge and skills to navigate the challenges of the digital world.

Furthermore, Mr. Albanyan emphasizes the role of families and the community in developing responsible online behavior. He believes that a lack of awareness and a weak sense of caution are major challenges to cybersecurity. Therefore, community contributions to the entire transformation plan are important. This highlights the need for collaboration and cooperation between various stakeholders in society, including families, to effectively tackle cybersecurity issues.

The Saudi Arabian government is also prioritizing cybersecurity. It is focusing on creating an ecosystem to address these challenges, and the Ministry of Education is actively involved in this effort. This demonstrates the recognition of cybersecurity as a crucial aspect of national security and the development of a future-ready workforce.

In terms of the education system, teachers play a fundamental role. Development programs are being set up to provide teachers with the necessary training and knowledge to handle cybersecurity issues. Additionally, digital literacy and AI are considered essential tools to enhance teachers’ skills and research capabilities.

The use of distance learning and digital tools is expected to be an integral part of the future education system. The COVID-19 pandemic has highlighted the importance of these tools, and the view of digital education needs to evolve from an emergency model to an integral part of the educational experience.

Private sector involvement in education is seen as a necessity rather than a luxury. Mr. Albanyan believes that the private sector and government should work together and complement each other’s roles to provide quality education and prepare future generations for the challenges of the digital era.

In conclusion, Mr. Yusuf Albanyan’s vision for enhancing global cybersecurity through public-private partnerships and integrating cybersecurity education into the education system reflects a proactive approach to addressing the challenges of the digital world. The emphasis on collaboration, cooperation, and value-driven transformation highlights the importance of involving all relevant stakeholders, including families, communities, and the private sector, in ensuring a safe and secure digital environment for everyone.

Moderator – Nisha Pillay

In the discussion, the importance of cybersecurity education and awareness was emphasised. Living in an age of increasing cyber threats, developing a cybersecurity mindset is critical. Education was seen as crucial in improving cybersecurity, but it was also recognised that implementing cybersecurity knowledge can be challenging due to various addictions, such as internet and social media. The addictive nature of social media poses a hurdle in adapting to a cybersecurity mindset.

Starting cybersecurity education from an early age was deemed fundamental as children need to be introduced to cybersecurity as soon as possible in the face of burgeoning cyber threats. Efforts should be made to educate young people about responsible online behavior given that they are born into a digital world and often take it for granted. The addictive nature of much of social media makes it challenging for them to develop responsible online behavior, but it is still crucial to teach them about responsible digital citizenship.

Several programs are in place to enhance cybersecurity awareness. One program mentioned is AMIN, which involves the National Cybersecurity Authority (NCA), the Ministry of Education, and the Saudi Arabian Vision 2030 Cybersecurity Center (SAVIC). The program includes conducting nationwide exhibitions, providing virtual and physical lectures, and having ambassadors spread the importance of cybersecurity.

The approach to cybersecurity needs to change, viewing it not just as a system or policy issue but as a personal responsibility for the safety and future of individuals. It was proposed to instill values in security awareness programs, making it more of an emotional appeal rather than just a list of dos and don’ts.

The idea of banning phones in schools to increase student engagement was raised. Excessive phone usage can distract students and hinder their engagement, so limiting phone usage in schools could lead to increased focus and participation.

When it comes to education and awareness, the focus should shift from policy enforcement to cyber education and awareness. The younger generation is born into a digital era and views it as business as usual. Therefore, efforts should be directed towards a transformational awareness program that educates and empowers individuals regarding cybersecurity, rather than relying on fear tactics.

The role of teachers in a digitised education system was highlighted. Teachers may not have grown up in the digital age and may need additional support to effectively teach cybersecurity. Therefore, it is important to address the role and needs of teachers in a digitised education system.

Furthermore, the value of digital literacy and cybersecurity training for teachers was discussed. A comprehensive program is in place to provide teachers with the necessary training and support, covering topics such as digital literacy, cybersecurity, and the use of artificial intelligence (AI) in education. Equipping teachers with digital skills is essential for them to effectively teach cybersecurity to their students.

The potential benefits and ethical implications of AI in education were explored. AI can enhance the skillsets and research capabilities of teachers and university faculty, but it is important to balance the opportunities and threats associated with AI in the learning environment. With proper control and implementation, the risks of educational technology can be minimised.

Ethical considerations in AI implementation were mentioned, with global leaders expressing concerns. A strong platform is needed to manage the risks associated with AI and ensure its ethical use in education.

The role of the private sector in cybersecurity was also discussed. Private companies collaborating with the government are crucial in enhancing cybersecurity measures. The private sector plays a significant role in developing innovative solutions and technologies to tackle cyber threats.

Additionally, the value of digital education, particularly during the COVID-19 pandemic, was acknowledged. Distance learning has played a vital role in ensuring the continuity of education during challenging times.

Overall, the discussion highlighted the importance of cybersecurity education and awareness in combating cyber threats. It emphasised the need to start cybersecurity education from a young age, develop responsible online behavior, and introduce values into security awareness programs. The role of teachers, the potential benefits and ethical implications of AI in education, the role of the private sector, and the value of digital education were also discussed. Collaboration between stakeholders, including the government, private sector, and educators, is crucial in achieving cybersecurity goals and ensuring a safe digital future.

Moderator – Nisha Pillay:
Excellencies, ladies and gentlemen, welcome to Building Resilience Through Education. I’m Nisha Pillay. I’m very pleased to be your moderator, and I’m even more pleased to welcome the Minister of Education for the Kingdom, His Excellency, Mr. Yusuf Albanyan. So you may be asking yourselves, ladies and gentlemen, why is education so high up on the agenda of this year’s Global Cyber Security Forum? Why? Well, the reason is clear. Living as we do in an age of exploding cyber threats, it’s imperative that we catch them young, that we develop a cybersecurity mindset and attitude as early as possible. It’s obvious, right? But how do you actually do it? It’s not so easy in this age of addictions, internet addictions, media addictions, social media addictions especially. That’s going to be the topic of my conversation with His Excellency. So if you don’t mind, ladies and gentlemen, and Your Excellency, I’d like to start with a personal question. Is that all right?

Excellency Mr. Yusuf Albanyan:
It’s fine. Go ahead.

Moderator – Nisha Pillay:
As you know, His Excellency was a really top business leader. You had a commanding private sector career until very recently. So what made you change? And what do you think is the challenge for the government sector in being nimble, especially in the face of these kind of threats?

Excellency Mr. Yusuf Albanyan:
Well, initially, I don’t know whether I have a choice or not, but I think it’s – by the way, this is my first time to get introduced on a business setting as really a minister of education. And at the same time, I think this will be a great opportunity for me to meet with our public and private forum. Coming from the energy and chemical industry, we have a very important role that catalysts to play. And I think at this point of time, I look at myself as a catalyst to play between public and private, and hopefully we can achieve our target to enhance our global cybersecurity issues.

Moderator – Nisha Pillay:
How do you see the importance of cybersecurity education then in the education system? How do you embed it?

Excellency Mr. Yusuf Albanyan:
Well, I think – let me start with the points. I think the previous panel have really struggled with the fact that how can we bring global security into the top agenda? I would propose to the expert in the global security to do a change management programs because I think linking security with cyber, this is really box the cyber issue around only security. In my view, the global cyber issues, it’s beyond security. And if we continue – What do you mean? How do you mean? Because I think the issue with the global cybersecurity is not system, is not policy. I think it requires huge change management programs. And this is why in education, we feel as of today, the youth, the current generations, they’re born in digital. So they are basically dealing with cybersecurity on day in, day out, and their communications and their learning materials. And this is why I think we need to program ourselves into the mode that cybersecurity is not only security. It’s basically every day in the morning, we wake up, we do unconsciously a risk management. So dealing with a cybersecurity issue, it has to do with individuals’ future life. In the same time, it’s very important to understand they need to integrate this as part of the skillset requirement in order for them really to survive and their business community. My view, we need to focus on change management. And this is why in our education system, we feel there are very important elements that we need to focus around curriculum. And as of today – Give us some more details. I will give you more details. As of today, we are heavy on knowledge base. We need to have a much better balance between skillsets and values. Say that again. A better balance between? Between knowledge and also skillset requirement. Skillset. So they’re different. And values as well. Okay. I think looking at cybersecurity, it’s not only a skillset issue, but also it has to be an integral part of our value system because we need to protect ourselves, our family, our society, and the entire community we operate in.

Moderator – Nisha Pillay:
So to almost bring young people on with a sense of responsibility to the wider setting.

Excellency Mr. Yusuf Albanyan:
Absolutely. Absolutely.

Moderator – Nisha Pillay:
That’s fascinating. I want to ask you, how do we develop online, responsible online behavior when our young people, our children are bathed in this? They’re born into this digital world. They take it for granted. And when so much social media is so addictive.

Excellency Mr. Yusuf Albanyan:
I think now being on my current role for almost a year, I think we need to make sure that we involve ourselves within the classroom, either in school or university, is only one piece. The other important piece is the community contributions in the entire transformation plan. And specifically, families. And if you look at the challenges poses against cybersecurity today, one of it is lack of awareness. The importance of cybersecurity. But the second, also we need to see within our children, we have weak sense of caution. Children has sense of anxiety and curiosity exceeded their sense of caution. So by default, they will be dealing with social media and gaming in a more aggressive and excessive way. And if they don’t really being cautious, then it will be an issue.

Moderator – Nisha Pillay:
So what can we do to help parents and families, do you think?

Excellency Mr. Yusuf Albanyan:
I think we have a very interesting program. I mean, if you look at the government of Saudi Arabia, we focus on the ecosystem. You see NCA and its role, and you see Sadaia. And I think both of them are creating the right ecosystem to make sure that the entire public and private sector operates on the proper dynamics to tackle the issues. And what do we do? I think we have a very great programs that is basically between NCA and Ministry of Education and SAVIC. And they came up with a very sophisticated programs, AMIN, which basically touches five important elements. How can we enhance the awareness program? We have a lot of exhibitions across nation, make sure that they understand what cybersecurity all about. We have also virtual lectures that we are providing people, they can have access to it. We have also physical lectures either in schools or universities. And in the same times, we have ambassadors that they are going around the nation to make sure that they spread the importance of cybersecurity. But I want to go back also to my initial remarks. We need to expand the view on cybersecurity. It’s in a different approach. This is for you as much as it’s for me. And I think if we look at it only from a compliance perspective or basically a system issue, continuously we’ll struggle. But if we spin it on a different way and we tell individuals, especially young generation, this is for you. This is for your own safety, for your own future. And I think you will see more buying into it and they will be more receptive to it. Because the issue is not a system or policy.

Moderator – Nisha Pillay:
As you were saying, to bring values into the core of it, which is a sort of emotional appeal almost, isn’t it? Into the core of it, rather than do this, do that. Make it more appeal to the heart.

Excellency Mr. Yusuf Albanyan:
I mean, let’s face it, in Saudi Arabia, we have basically asked students not to bring their phones in school. You know, lately for the last year, we see other nations, they are really following what Saudi Arabia have done. But why we have done it? The purpose of banning phones, cell phones with the students, basically we would like to increase their engagement with their teachers and the classroom. Not only this, we would like to make sure that they have also addictions to screen. Internet usage has to slow down, has to basically brought into the proper level. And this is a very important policy that we have introduced. And I think we need to look at it from a different aspect from only policy compliance, as much as this is for the sake of the student themselves. And we see a good level of compliance in the school because of that. So the ban on mobiles in schools brought in a couple of years ago, do you think it’s made a difference to protecting young people in the education environment? Again, I think let’s move away from the terminology security or protection. I’m not a fan of this because you cannot really operate on a fear factor. You need to operate on a more sophisticated transformation awareness program. And I think you need to communicate with the young generations. And by the way, they born it. They are basically born in the digital era. So maybe for us, we look at it differently. But for them, it’s really business as usual. And this is why we need to show the value rather than just look at it from really policy enforcement.

Moderator – Nisha Pillay:
So then it begs the question, what can you do to make cyber education and cyber awareness, let’s say, more appealing, less about the rules and more about the possibilities?

Excellency Mr. Yusuf Albanyan:
This is a good question. If you look at our strategy, we would like to have our education system, both K to 12 and university, to have a pipeline of talent that they are not only competitive domestically, not only regionally, but also on the global scene. Therefore, we look at the global citizenship. The cyber security is a global issue, is not really a regional issue. This is one aspect. The second, if we agree that in order for us to move into a much better space around cyber security, we need to enhance the knowledge and awareness program. This is why in our curriculum, we are re-basically classifying our curriculum programs where it has knowledge base, skill base, and value base. And if you look at knowledge, skills, and value, they are all needed for cyber security awareness program. So if you look at the global citizenship and the programs and curriculum transformation, and basically they will emerge into a very sophisticated environment that hopefully will allow our current and future generations to look at cyber security as basically not as a policy again, but as something that they have to do it, one, for their own safety. They need to feel they are responsible for it, and at the same time, it has become also a skill set requirement for their future workforce.

Moderator – Nisha Pillay:
Essential. So as cyber security, as you say, is a global issue, is there a role for multilateral action for governments to work together, to collaborate, and to cooperate?

Excellency Mr. Yusuf Albanyan:
Well, as you know, the government of Saudi Arabia has really participated on drafting basically the generative AI on 2021, on UNESCO. In the same time, Saudi Arabia has also a committee where basically look at this in a more sophisticated way, and Ministry of Education as basically the largest participant is a member of the committee. As you know, we have more than 6.5 million students on K to 12. We have more than 1.3 million students in universities. We are touching every single members on the society, and tell me about it. I’m getting this pressure every day.

Moderator – Nisha Pillay:
You know, we’ve talked about parents, we’ve talked about the ministry, the education system, cooperation with other governments, but we haven’t talked about yet with the teachers themselves. Now, many of them, like someone like me, would have grown up in a non-cyber age, not born into a digital world. What kind of help and support do teachers ask for, or do you think they require?

Excellency Mr. Yusuf Albanyan:
Ma’am, I think we need to recognize that you cannot have education system above the quality of your teachers. So I think it’s very important that the teachers are really the foundation for any success on an education system. Therefore, we have a very sophisticated program at the last stage at this point of time where we will develop all teachers who needs to go to the classroom. They will go into basically development programs similar what we used to use in our chemical industry engineers in order for them to move to the plants. They have to go through very rigorous programs in order for them to get qualified to go and manage plants, even though they graduate from two universities. And those programs will be basically touches every aspect of their developmental need, and one of it digital, because teachers has to be digitally equipped in terms of knowledge in order for them to deal with the current and future generations. And cybersecurity is going to be part of it and other. For example, how can you use AI from the aspects of positive side? As you can see today, people are sometimes cautious around using AI, but let’s remember, any new technology has its own risk. But as of today, I think we have a very strong technology innovation in educations. They are more or less in control environment. They will be less risk than others, but will allow teachers and also faculty in universities to enhance their skill set and research using AI in a more safe way.

Moderator – Nisha Pillay:
Can we explore that a little further, Your Excellency? So schools around the world are grappling with how to use AI, because if the schools don’t come to term with it, certainly the children will. They can use it for research purposes, a big plus, but they can also use it to write their entire script, which is maybe not such a plus. So I wanted to ask you, what are your reflections on the opportunities and the threats? How does one balance that as a whole new way of learning?

Excellency Mr. Yusuf Albanyan:
One thing I learned from business, if you wait to check the old boxes, you will lose the opportunities. You need to calculate your risk. You need to really basically go ahead and make sure that you are having a very sophisticated calculated risk matrix and move on. As of today, for example, I bet you there is no single individual can tell you what is the implication of AI tomorrow. They just think and they predict, and there are different models that is running. As of today, we are in the ministry. We formed a team to look at how the school looks like in 2035 and 2040. Is it going to be a similar school model we have today? I don’t know. That question remains to be answered, but I do believe technology and AI is going to play a major role on this. How do we view digital? Is it really just for an emergency model or is it going to be an integral part of our educations? Because during COVID, I think distance learning have played a major role for all education systems to continue. But as of today, we view it, some view it as an emergency model, some view it as a blending knowledge on our educations. If you bring this all together, cyber security is going to be an integral part of it and AI is going to play a major role. How do you view AI, Your Excellency, in the education system, a threat or an opportunity? In fact, just as soon as I leave this room, I have a meeting with some of my team because we use AI, by the way, just three weeks ago on different schools in the kingdom. And you will be surprised. We have very innovative teachers who really have leveraged it on their own scale. Imagine if we bring it on a national level, how is it going to look like? But at the same time, we need to be cautious on the implications. And I think from my engagement with the global leaders, the issue in AI is not the functionality, the issue in AI in ethics and values. How ethically we will be able to leverage AI and how can we create a strong platform to manage the risk of AI?

Moderator – Nisha Pillay:
Ethics and values. Very interesting because that’s what you said when talking about broadening our approach to cybersecurity as well. So finally, I’d like to ask you, Your Excellency, about the role of the private sector and the huge cybersecurity industry out there, small and large companies, how can we bring them together with educators and the education ministry to develop new approaches, maybe innovations?

Excellency Mr. Yusuf Albanyan:
Well, again, before I used to use this terminology. How can we bring them together to play their roles on the entire community? I think my duties today are coming from private sector and working on governments, specifically in a very important role where basically influence the future generation. How can we bring a clear understanding that private sector and governments, they are not different. They are one, playing together. Each one of them play its role to complement the end of the day what 2030 Vision really inspired for. I personally see this on the private sector. I see it today in the government when I come into Ministry of Education. Private sector role in Ministry of Education is not something that’s nice to have. It’s going to be something that we have no choice, but each one of us has to complement what really bring us at the end into a success to achieve our 2030 Vision.

Moderator – Nisha Pillay:
Your Excellency, it’s been a pleasure to meet you. My mindset has already started changing. What did you say? Abandon the fear factor. It doesn’t work. Embrace ethics and values. It’s really been a pleasure. His Excellency, Mr. Youssef Albanyan.

Excellency Mr. Yusuf Albanyan:
Thank you very much. Thank you. Thank you. Now, sir, I mean, which is correct, first and last name. Yeah. Thank you.

Kersti Kaljulaid

The analysis examined several significant topics related to technology, cybersecurity, and regulation. One key point raised was the increasing threat of AI in military systems and cybersecurity. The speakers highlighted the potential harm that AI worms could cause to military systems, as well as the planting of false data. The risks posed by these threats require proactive actions to address and mitigate them.

Another important topic discussed was the lag between the legal cycle and the tech cycle. The speakers emphasized the need for a better-functioning legal framework that can keep up with the rapid advancements in technology. They highlighted the challenges posed by emerging technologies such as predictive AI, 5G, 6G, and space technologies.

The manageability of current cyber attacks was also examined. The analysis revealed that Estonia experienced approximately 2,500 serious cyber attacks in the past year, with only one causing disruption in train ticket purchases. While the situation is considered manageable, it comes at a growing cost.

Cooperation and standardization were highlighted as crucial factors in addressing cybersecurity challenges. The analysis noted that countries like Saudi Arabia can play a significant role in promoting positive technological developments by encouraging industry adherence to set standards.

Corporate transparency and the voluntary sharing of development details with governments were emphasized. It is important for companies to share information about their technological advancements with relevant authorities to enable effective regulation.

The speakers also expressed support for imposing sanctions on companies that interfere with political processes. They argued that mechanisms should be in place to hold such companies accountable and negatively impact their share prices.

The European Union’s AI act was seen as a positive development. It was recognized that the General Data Protection Regulation (GDPR) became a de facto global standard, and the speakers believed the AI act should do the same. Global adherence to this act is seen as crucial for ensuring industry security, preventing conflicts, and addressing regulatory queries.

In addition, having a certain set of standards for investment security was highlighted. Regulations play a vital role in preventing potential conflicts and questions in various countries. The importance of basic principles such as human rights and the rights of nation-states was reiterated, as well as involving more women in the cybersecurity sector.

Overall, the analysis emphasized the need for proactive measures to address the increasing threat of AI in military systems and cybersecurity. It highlighted the importance of a functioning legal system that keeps pace with technological advancements, the manageability of current cyber attacks, cooperation and standardization, corporate transparency, global adherence to the European Union’s AI act, and involvement of women in the cybersecurity sector. It concluded that basic principles and compassion should guide the development and application of technology, defining the future of humankind.

Jose Manuel Barroso

The analysis highlights several key points regarding cybersecurity and global cooperation. First, advancements in fields like artificial intelligence and quantum computing pose challenges for maintaining a high level of cybersecurity. This is because these developments can make it difficult for security measures to keep up with new threats, leaving data and networks vulnerable to cyber attacks. The supporting fact provided is that developments in sectors like artificial intelligence and quantum computing might make it difficult to maintain a high level of cybersecurity.

Second, confidence and sincere cooperation among major powers, such as the United States, China, and Europe, have been decreasing. This lack of cooperation is a negative sign for global cybersecurity efforts, as collaboration and shared knowledge are essential in combating cyber threats effectively. The supporting fact is that there was a level of cooperation between major powers such as the United States, China, and Europe when Barroso was in the European Commission, but it might not be the case today.

Furthermore, cyber criminals do not stop at borders, highlighting the need to view technology as a global public good. This means that efforts to ensure cybersecurity should not be limited to individual countries but should instead involve international collaboration and cooperation. Some powers may resist supranational regulation, which emphasizes the need for shared responsibility in addressing cyber threats. The supporting facts provided are that cyber criminals do not stop at borders and that some powers may resist supranational regulation.

Moreover, Saudi Arabia, as an important member of the G20, has the potential to play a significant role in fostering dialogue and cooperation in cybersecurity. By leveraging its position and influence, Saudi Arabia can offer spaces for dialogue and collaboration in addressing cyber threats. The supporting facts are that Saudi Arabia is an important member of the G20 and can offer spaces for dialogue and cooperation in cybersecurity.

In the context of public health, while COVAX successfully distributed 2 billion vaccines across 146 countries, disparities in vaccine access between developed and developing countries were observed. This highlights the need for equitable distribution and access to vaccines to ensure global health security. The supporting facts are that COVAX distributed 2 billion vaccines and that disparities were seen in vaccine access between developed and developing countries.

A multi-stakeholder approach is deemed necessary for addressing global challenges like public health and cybersecurity. This approach involves the participation of governments, businesses, research institutes, and civil society to collaborate and find effective solutions. However, not all countries may be willing to share their expertise in cybersecurity due to defense and war implications. Public-private partnerships can reduce cybercrime, as the cost of cybercrime is expected to reach $10.5 trillion in two years. The supporting facts are that Gavi uses a multi-stakeholder approach involving governments, businesses, research institutes, and civil society, and that public-private partnerships can reduce cybercrime.

Saudi Arabia, with its good connections with both China and the US, can serve as a bridge between the two countries in technological aspects. This can facilitate cooperation and dialogue, leading to advancements in cybersecurity measures. The supporting facts are that Saudi Arabia has good connections with both sides of global arguments, is a member of G20 and BRICS+, and is developing capabilities in the field.

On the subject of regulations, there are some countries that do not support supranational regulation and binding agreements on cybersecurity. This presents a challenge in establishing cohesive and universally applicable cybersecurity measures. The conventional wisdom is to follow the principles of international law on cybersecurity. The supporting facts are that there is a stalemate in the United Nations on cybersecurity and that the conventional wisdom is to follow the principles of international law on cybersecurity.

In terms of strengthening cybersecurity, like-minded countries can forge ahead and extend areas of consensus. By finding common ground and cooperating, these countries can work towards improving cybersecurity measures on a global scale. The supporting fact is that like-minded countries can forge ahead and extend areas of consensus to strengthen cybersecurity.

Another noteworthy observation is that the implementation of GDPR initially faced criticism but is now considered a significant improvement. GDPR, a data privacy regulation introduced by the European Union (EU), has set a global standard, with California following closely in its footsteps. This highlights the positive impact and influence of global standards in regulating and safeguarding data privacy. The supporting facts are that GDPR faced criticism initially, businesses in Europe now agree that GDPR was an improvement, and California followed closely EU’s GDPR, setting a global standard.

Despite the difficulties and time-consuming nature of establishing global standards, they are deemed beneficial and necessary. Negotiation and consensus-building are essential in creating these standards, which may present challenges. However, having global standards is preferable to each country making its own regulations and can contribute to greater international cooperation. The European Union is cited as a good example of successful cooperation. The supporting facts are that creating global standards requires negotiation and consensus, the European Union is a good example of successful cooperation, and despite the difficulty, global standards are preferable to each country making its own regulations.

Cooperation and scale in regulations are crucial for global competitiveness. By cooperating and creating uniform regulations, regions like Europe gain the necessary scale to compete with major players such as the United States, China, and India. This emphasizes the importance of collaboration and the creation of a level playing field in global markets. The supporting facts are that all countries in Europe are considered small, cooperation gives them necessary scale, and cooperating and creating uniform regulations like GDPR allows Europe to compete with the likes of the United States, China, and India.

Furthermore, cybersecurity is a specific but crucial part of overall security concerns. The European Agency for Cyber Security estimates that Europe needs 200,000 cyber experts, highlighting the growing importance of addressing cybersecurity risks. Although there has not been a major catastrophic event globally in terms of cybersecurity, it is seen as a prominent and emerging threat. The supporting facts are that the European Agency for Cyber Security estimates that Europe needs 200,000 cyber experts and that until now, there has not been a major catastrophic event globally of cybersecurity.

In conclusion, the analysis emphasizes the challenges and importance of cybersecurity in a rapidly evolving technological landscape. It highlights the need for global cooperation and collaboration in addressing cyber threats. The involvement of multiple stakeholders, equitable access to resources, and the establishment of global standards are deemed crucial. Additionally, the potential role of Saudi Arabia in fostering dialogue and cooperation, as well as the significance of GDPR and the multi-stakeholder approach, are underscored. Solutions to cybersecurity challenges require proactive measures, efficient risk management, and increased public investment. Overall, the analysis calls for collective efforts to safeguard data, networks, and global security in the face of technological advancements.

Shyam Saran

Shyam Saran emphasises the need for international collaboration in tackling pressing issues such as cybersecurity and climate change. He argues against the competitive negotiation frameworks that are currently in place and advocates for a more collaborative approach. Saran believes that competitive frameworks often lead to compromised results, whereas a collaborative approach can yield optimal results in dealing with cybersecurity and climate change.

Saran also highlights the challenges and opportunities presented by the digital space. He stresses the importance of inclusion in India, where the digital space has enabled a degree of inclusiveness. However, Saran acknowledges the tremendous assault on cyberspace by malevolent forces, highlighting the need for measures to protect against such attacks.

The scale of the cybersecurity challenge is exemplified by the thousands of cyber attacks on sites associated with the G20 summit. This serves as a clear indication of the magnitude of the challenge that nations face in protecting their digital infrastructure.

India stands out as a proactive player in tackling cyber threats, actively collaborating with various partners to address the growing menace. Saran argues that the current international system seems insufficient in dealing with the cyber threat, making collaboration all the more necessary.

One of the key challenges in regulating technological advancements lies in the gap between policy makers, decision-makers and the pace of technological innovation. This gap makes it difficult to develop effective regulations that can keep up with the rapid changes in the digital landscape.

Saran highlights the importance of forums like the Future Investment Initiative in creating awareness among decision-makers and policymakers. Recent initiatives by President Biden and the European Union are mentioned as steps towards tackling cybersecurity issues, indicating a growing recognition of the need for action.

The advancements in the digital space have both positive and negative societal impacts. While it has enabled inclusiveness and positive changes, there have also been negative effects, including infringements on women’s rights. Preventing these negative effects requires proactive measures, including the active participation of women.

Recognising the value of women’s participation in the digital landscape, Saran emphasizes its importance in addressing negative trends and contributing to economic growth. He also calls on universities to actively participate in supporting changes brought about by technology and fostering gender equality.

Despite the usefulness of digital technology as a tool, Saran cautions against allowing it to dominate human beings. He highlights the importance of maintaining a balance and ensuring that humans remain in control, rather than being controlled by digital technology.

In conclusion, the need for international collaboration to address cybersecurity and climate change is crucial, according to Shyam Saran. He emphasises the importance of adopting a collaborative approach, rather than relying on competitive negotiation frameworks. Saran also brings attention to the challenges and opportunities posed by the digital space, urging inclusiveness and vigilance against cyber threats. The scale of the cybersecurity challenge is exemplified by the attacks on the G20 summit. India’s proactive collaboration efforts and the value of women’s participation in the digital landscape are highlighted. Saran encourages universities to support technological changes and promote gender equality. Lastly, he reminds us to maintain a balance and ensure that digital technology does not dominate human beings.

Introduction

The plenary session titled “The Evolving Dynamics of Cyberspace” began in Riyadh, with a distinguished panel of experts comprising Jose Manuel Barroso, former President of the European Commission and Prime Minister of Portugal, Kersti Kaljulaid, former President of the Republic of Estonia, and Ambassador Shyam Saran, former Foreign Secretary of India. These esteemed individuals were invited to share their extensive knowledge and insights on public policy and governance in the context of cyberspace.

During the 45-minute session, the panelists had ample time to delve into the complex intricacies of cyberspace and its far-reaching impact on societies worldwide. They discussed the shifting dynamics and emerging challenges within this rapidly evolving domain, while also highlighting the opportunities it presents for governments and policymakers.

Jose Manuel Barroso stressed the necessity of effective regulations and cooperative frameworks at the national and international levels to combat cyber threats, such as cyberterrorism and cybercrime. He emphasized the importance of governmental collaboration and the sharing of best practices to ensure the safety and security of citizens in an interconnected world.

Kersti Kaljulaid emphasized the significance of prioritising cybersecurity as an integral part of a nation’s overall security strategy. She shed light on Estonia’s pioneering efforts in this field, highlighting proactive measures such as investment in IT infrastructure, public awareness campaigns, and strong public-private partnerships.

Ambassador Shyam Saran elaborated on the geopolitical dimensions of cyberspace and its implications for national sovereignty. He underscored the need for robust international cooperation and adherence to norms to maintain an open, secure, and trustworthy cyberspace.

The panelists’ insightful discussions deepened the audience’s understanding of the complex issues at hand and fostered a constructive dialogue on innovative approaches to addressing the challenges of cyberspace.

The session was skillfully moderated by John Defterios, who facilitated the conversation, allowing each panelist to articulate their perspectives and engage in productive exchanges. John’s expertise in the subject matter and his ability to steer meaningful discussions contributed to the success of the session.

In conclusion, the plenary session on “The Evolving Dynamics of Cyberspace” provided a platform for world-class experts to share their knowledge and insights on the challenges and opportunities within this ever-changing domain. The panelists highlighted the importance of international collaboration, effective regulations, and proactive cybersecurity measures. The session served as a catalyst for further exploration and dialogue on how governments and policymakers can navigate the complexities of cyberspace to protect their citizens and harness its transformative potential.

John Defterios

The analysis explores various aspects of cybersecurity and its global implications, emphasising the Kingdom of Saudi Arabia’s role as a convener and active participant in cybersecurity discussions. With its strategic geographical position, the Kingdom is well-positioned to effectively address cybersecurity challenges.

One key finding is the increasing prevalence of cybersecurity as a global issue. Increased awareness and collaboration are needed to counter evolving threats in cyberspace. The full attendance at the panel session indicates growing interest in the topic. The Kingdom’s role as a convener demonstrates international recognition of its active involvement in addressing cybersecurity concerns.

John Defterios emphasises the importance of international collaboration in tackling global issues, including cybersecurity. The analysis highlights the need for a more collaborative approach, as existing negotiation frameworks often yield minimal results.

The analysis raises questions about how to balance the opportunities and disruptions brought by rapid advancements in artificial intelligence and cyber innovations. This emphasises the need for careful consideration and proactive measures to manage their impact on cybersecurity.

The analysis also acknowledges the mixed results of international cooperation in addressing the COVID-19 pandemic. While initiatives like COVAX have distributed a significant number of vaccines globally, there are disparities in vaccine access between more developed and poorer countries. Additionally, vaccine nationalism has led to excessive accumulation of vaccines by some countries. This highlights the challenges and complexities of international cooperation in addressing global crises.

Another key argument is the necessity for collaboration between countries and corporations in the field of cybersecurity. The expected increase in cybercrime underscores the need for collective efforts to combat this growing threat.

Saudi Arabia is recognised for its potential role as a bridge between China and the US in geopolitical matters, including cybersecurity. Its neutral stance and convening ability position it as an influential player in facilitating dialogue and cooperation between these two superpowers.

The analysis also underscores the crucial role of cybersecurity in digital development and the corporate sector. Proper implementation of cybersecurity measures is essential to protect and foster growth in countries like India and Nigeria. Neglecting cybersecurity could erode the progress these countries have made.

Furthermore, the analysis highlights the positive trend of increased female workforce participation. Female participation in the workforce has risen to 37% and continues to grow. This prompts examination of universities’ role in keeping pace with technological changes and ensuring gender equality in the workforce.

In conclusion, the analysis provides insights into various aspects of cybersecurity and its global implications. It emphasises the need for increased awareness, international collaboration, and proactive measures to effectively address the challenges posed by cyberspace. Saudi Arabia’s role as a convener and its strategic geographical position make it an influential player in cybersecurity discussions. The analysis also underscores the importance of balancing opportunities and disruptions brought by rapid advancements in artificial intelligence and cyber innovations. Additionally, it highlights the mixed results of international cooperation in addressing the COVID-19 pandemic and advocates for increased collaboration in tackling global issues like cybersecurity. Finally, the analysis emphasises the significance of cybersecurity in digital development, the corporate sector, and ensuring gender equality in the workforce.

Introduction:
So let’s get into it. Allow me to introduce our plenary session, The Evolving Dynamics of Cyberspace. Over the next 45 minutes, we’re all going to listen and hear from some of the world’s foremost experts on public policy and leading government. So please join me in putting your hands together and give a warm Riyadh welcome to our esteemed panelists, Jose Manuel Barroso, former President of the European Commission and Prime Minister of Portugal. Kersti Kaljulaid, former President of the Republic of Estonia. And Ambassador Shyam Saran, former Foreign Secretary of India. And Your Excellencies, ladies and gentlemen, our moderator today, my good friend, John Defterios. John, the floor is yours.

John Defterios:
Please, if I can get my microphone up. Thank you very much. It’s great to see you. Ryan, thanks for the kind introduction. And it’s phenomenal to be back for a second time. And as Ryan was suggesting, the room is full for a reason, because cybersecurity is taking greater prevalence than ever before. I think it’s commendable, by the way, that the Kingdom is serving as what I like to call the Intel chip inside the computer, if you remember the ad campaign from the 2000s. It was the chip that was driving the computer at the time. I think the Kingdom has a very unique role to play as one that convenes everybody, like we are doing today, lead from behind to take action for the future. And I would suggest geographically, straddling north and south and east and west, it has a particularly strong position in which to do so. Governor, it’s great to see you. And thank you for the opening remarks. And it’s nice to be in Riyadh again. I think I’m here 10 times a year because of the transformation that’s taking place. Can we give a nice round of applause for the excellent panel that’s been assembled today? And we’ll get right into the debate. We have 45 minutes in which to delve into these very key issues. And you all three sit at the nexus of geopolitics and geoeconomics. If it’s okay, Governor, I think it’s also worth noting that we should recognize the global crisis that we’re facing today when it comes to conflicts, and we’d love to see a solution. But our role here at the GCF is to hone in on cybersecurity and a safe cyberspace for all. So we’d like to see solutions, but at the same time, clearly, not in this room because everybody works in cybersecurity, but globally, awareness needs to raise about the opportunities and the threats because cyberspace knows no boundaries. And because you’re both specialists in geoeconomics and geopolitics, how do you see, President Barroso, the forces driving the change in this sector today, and what we should be aware of? Because it’s, what would you call, extreme complexity in the world, there’s no doubt about it.

Jose Manuel Barroso:
Thank you. Thank you, John, for your introduction, Your Royal Highness, Ministers, Excellencies, dear friends. I believe the developments are quite worrying, to be very frank, in terms of cybersecurity in the sense that we have, on one side, technological change in some sectors, like artificial intelligence, generative artificial intelligence, and what we can call superintelligence, and also quantum computing and other areas that will probably make it more difficult to keep high level of cybersecurity. So this technological change is a challenge for the protection of data, protection of networks and cyber systems. And on the other side, as John, you mentioned, there are the very worrying geopolitical developments. From that point of view, I can share with you my experience. I remember when I was in the European Commission that, for instance, in the G20, by the way, where Saudi Arabia is a very important member, there was some level of cooperation and sincere cooperation between the United States, China, Europe, and others. I’m not sure, to be very frank, this is exactly what’s happening today. So the level of confidence and sincere cooperation globally is going down. Technology should be seen as a global public good because, as you said, cyber criminals, they don’t stop at borders. They are threatening all of us. But the reality is that because of the links to technology, some powers, they will try to keep as much as possible their prerogatives. They will resist any kind of, let’s say, supranational regulation or system. So that’s why I think it’s very important to find spaces like this one here in Saudi Arabia. And I’m not saying that just to be nice to you, most of you here coming from Saudi, but because I think Saudi Arabia has a good place globally, being also a member of the G20, to foster some dialogue, being realistic, what can be achieved at some level between all the powers of the world and in other areas, being more, let’s say, precise about what we can develop further. But it’s going to be a very challenging task from a geopolitical point of view. Good.

John Defterios:
Madam President, we had a founder of CNN, Ted Turner, who said he was in cable before cable was cool, right? He was an entrepreneur that wanted to break new boundaries. And Estonia was very much an early mover and an early example of both e-government but also recognizing the role of cybersecurity. I’d love to have you share your perspectives of the key factors you see at play today. Number one, we’ve come out of COVID-19 with record spending by government, right? And high debt. Ten years before that, we had the global financial crisis. And one of the things you noted is that we have to be very aware of what’s going on in society, but you’re seeing the cost of this to fortify industry, academia, our civil society overall in terms of day-to-day living. What are you seeing here as a cost driver and the importance of getting deeper collaboration amongst governments?

Kersti Kaljulaid:
Well, I’ve used an example for about eight years to start these kinds of discussions. And this example tells you about the little AI worm. It’s a little worm which is specifically designed to enter military systems, weapon systems, maybe even nuclear systems. And it is able to gather all the data which you have in that system and hurt it, destroy it. This is how it is trained. But now imagine this system is somewhere and somebody has contaminated the data set of that system by using a computer which also was used to browse the World Wide Web. And therefore, our little AI worm finds some information which shouldn’t be there. And guess what? That information is a press release by United Nations which says United Nations is getting ready to vote on banning and destroying artificial intelligence in military capabilities. Now what our little AI worm will do, having had this information? It does know it is an AI system in a military capabilities. Therefore, my question is, will this little worm do what it was planned to do, destroy the system or take a name at UN Global Headquarters? When I started telling this story, most people would have considered technology part of this as a fantasy. Nowadays, most people think that it is a fantasy, that UN can never come to a global conclusion to ban AI from military systems. This is what we have seen just in 10 years’ time. And of course, I mean, trying to contain these kind of risks, we need to think about singularity. Because if we think about singularity and take into account that our tech cycle is so much quicker than our legal cycle which deals with our international law space, only then can we protect us from the current level of risk where we have predictive AI only, 5G, 6G, space technologies. But you asked about costs. Estonian National Cyber Security Authority budget in last five years has risen five times. I’m really worried.

John Defterios:
You know, you raise a fantastic point because in this week we saw President Biden sign an AI executive order. When he came into office, four months into office, he signed an executive order for cyber security. But Shyam, I’d love to get your thoughts as a former foreign secretary and ambassador. And Madam President talked about it. There’s 21 international laws that touch upon cyber security, but it’s not a holistic legislative bandwork. And at the same time, countries want to maintain their sovereignty, right? So this is the challenge. So how do we advance this idea to protect sovereignty but also protect our society today in the cyberspace? It’s not an easy balance. And you can use the Indian example as president of the G20 this year.

Shyam Saran:
Thank you very much, John. And it’s a pleasure to be back here, Excellencies, distinguished guests, ladies and gentlemen. You mentioned the Indian experience and, of course, the chairmanship of the G20. Our effort was to try and see that in an international landscape, which is today extremely polarized, very fragmented, how do we also at the same time try to keep alive a sense of international solidarity, a sense of collaboration in dealing with issues which are really cross-national in character. They are cross-cutting in character. Cyber security or climate change, if you take some of the examples, these are challenges which no country, no matter how powerful it is, can hope to resolve by itself. You need collaboration. And I think what we are unable to find is that our whole negotiating frameworks are very competitive frameworks. If I go as a diplomat to a negotiating forum, what is my brief? My brief is give as little as you can, extract as much as you can. That is what we operate on. If you operate on that basis, should it come as a surprise to you that we always end up with a least common denominator result, when actually what you are looking for are maximal results, not minimal results. That is what cyber security is, because it is advancing so quickly that you are out of date before you even start trying to tackle it. So how do we ensure that for issues of this kind, we have a global collaborative mechanism in order to deal with this challenge? Today, we are finding that the whole landscape, as I said, is very fragmented. You mentioned the global financial and economic crisis. Since then, we have not had any kind of crisis where the world has actually come together to try and really address the issue. So going forward, how do we bring this about? And I think in that context, a forum like this, and what our hosts have been able to organize, still provides a forum where people from across the divide can still come together to try and see how we can deal with these problems. So going forward, I would say a lot of opportunities, because we have seen in India itself that the digital space has actually allowed a degree of inclusion, which we have not had before. So it is a very powerful tool. But we have also seen that there has been a tremendous amount of assault on the cyberspace from inimical forces. And how to keep that balance is what is going to occupy us going forward.

John Defterios:
Okay, if I can ask a question here on the comparisons of what we’ve seen, and I’d love to get both of our other panelists involved in this. You sit on the board of Gavi, which is in charge of global vaccines, right? We had the Rio agreement in 1992 to the foreign minister’s interjection here, and very little action for the first 25 years, and we still struggle to have cohesiveness when it comes to climate action. Can we use those two examples and say, how do we not make the same mistakes as we develop policy for cybersecurity? How do we accelerate? Because AI is moving so quickly, and it could be an opportunity, but it could also be a great disruptor. Kirsi, do you want to start, and we’ll come to President Barroso.

Kersti Kaljulaid:
Frankly speaking, our academia has been telling for a long time that the only way of dealing with it is to agree that all our analog legal space applies in a cyberspace, exactly the same things which you cannot do in analog space, you cannot do in cyberspace. And we should simply decide that this is how it is. Also, the UN working groups regularly come to the same conclusion. So what you cannot do in the real world, the same things you cannot do in the digital sphere. But as we follow the practices nowadays, for example, the physical situation doesn’t seem so bad. Estonia last year had about 2,500 serious cyber attacks, which we detected. Only one went through to the extent that real people couldn’t buy some train tickets for a while, but all the rest was captured. So it can be done, but as I demonstrated, at the spiraling cost. So if we want to really spend on health care, education, what makes our world generally better, there is nothing else, I mean, which takes us forward than to decide if this is not to be done in analog, this cannot be done in cyberspace. In practice, we have already diverged nowadays because we do not have anywhere to go and complain about these attributions, worthless, because you don’t have a security council where you can then go and complain. We should actually make our analog system, of course, work better, but then we should simply apply it also to our cyber systems.

John Defterios:
Good. President Barroso, were you a bit frustrated sitting at Gavi and seeing that the global south was not getting the vaccines fast enough? Can you apply that to the lessons here as we develop the institute further, as Saudi Arabia convenes people to take action? What would be the advice, if you will, from your personal experience, and you lived through the financial crisis as well as a leader?

Jose Manuel Barroso:
Exactly. So first of all, the results of the pandemic in terms of international cooperation were, let’s say, mixed. We created COVAX, and COVAX was in some sense very successful because we were able to distribute more than 2 billion vaccines in the world in 146 countries. But it is true that there was a difference between the more developed world and the developing poorest countries in the world. So why? Because while in theory everybody recognizes that global public health is a global public good, because there should be no borders when it comes to fight against the virus, because the virus does not know borders, so we should have a common action, the reality is, and I’m very sincere, the advantage of being… I’ve left politics some time ago, so my level of sincerity is increasing day by day. I’m telling you very frankly what I think. The reality is that we saw vaccine nationalism. We saw some countries accumulating many more vaccines than they needed. We saw disparities. At the same time, to be fair, we saw also great generosity. So some of the biggest donors increasing their donations, including in financial terms. So it’s a mixed action. But one thing I believe is important as a lesson for the future is to have a multi-stakeholder approach. I think it is okay, by the way, Gavi, that I have the honor to chair, chair of the board, is based on that concept. So we have the governments, governments of the richer countries but on developing countries, but we also have the pharmaceutical companies, we have the private sector, we have research institutes, we have civic society organizations. I think this is very important. Because on the issue of cybersecurity, I think it’s going to be even more difficult. Why? Because cybersecurity, let’s be frank, is also linked to defense matters or war. And so some of the global powers will never share all the expertise they have in cybersecurity. They may share some, but not everything. For instance, against cybercrime in business, that’s possible. According to the best statistics, it means eight trillion US dollars per year, the cost of cybercrime, expected to go to 10.5 in two years’ time. I think that’s an area where different geopolitical interests and ideology, they can cooperate against this kind of cybercrime. But let’s be realistic. There are areas where the countries will cooperate, others will not. And we need to bring also the know-how of the more prepared corporations in the world. We need also to apply here a concept of public-private partnership. That will be my advice.

John Defterios:
Good. I want to get a quick follow-up from you, if I may, in my opening remarks. I’ll be brief. I was talking about Saudi Arabia serving as a convener. It could lead from behind, but I think geographically and strategically, with the transformation that’s taking place, and to put this into an institute and policy, can it be a bridge between China and the US, where, as you know, in technology, it’s very fierce competition? And Madam President, if you can follow up as well, please, President Barroso.

Jose Manuel Barroso:
I think so. I think, for instance, Saudi Arabia, during their presidency of G20, was doing a very important job. Now, Saudi Arabia is a member of G20. At the same time, it’s a country of this BRICS+. It has good connections with both sides of global arguments. So I think it’s a great place to have a global conversation. That’s why we are here, by the way. And at the same time, Saudi Arabia is also developing real capabilities in this field, and other countries in the region as well. So yes, I believe we need places like that that can offer a platform for cooperation, and I hope that that can be developed so that this global conversation, and not only conversation, hopefully some action can take place. But I’m realistic about what we can achieve, as you understood. And you mentioned it yourself, John, in the United Nations now, there is a stalemate on this. Let’s be frank. There is a stalemate. The, let’s say, conventional wisdom is that we have to follow the principles of international law on cybersecurity, okay. But when it comes to an idea of having some supranational regulation and forced binding agreement, then people don’t, some countries do not agree. So what we can do is, in what I call variable geometry, some, let’s say, like-minded countries can go forward and hopefully extend as much as possible the areas of consensus to have, I mean, a possibility of reinforcing our cybersecurity.

John Defterios:
Good. Madam President, you wanted to provide some follow-up as well. Go ahead.

Kersti Kaljulaid:
Yeah, absolutely. I’m quite sure that countries like Saudi Arabia can catalyze positive developments. Like, for example, my own country certainly has catalyzed digital development in European Union cross-border, because we have digital identities, Stone Age, if we talk nowadays technologies. European Union has decided that all EU countries have to offer all their citizens digital identities. And in addition, they have to interoperate. So absolutely, this country can be a catalyzed of the positive things. What needs to be catalyzed right now most is that we have to understand that if we compare 20th century to 21st century, in 20th century, most technological development always happened under control of the government. Internet happened under control of government, nuclear weapons similarly. Nowadays, far more of this development, which affects our cybersecurity, is company-led, happens in the private sector, in the industry. And here I see the great role for countries like Saudi Arabia to cooperate and call also for industry to apply the set of standards, to define the set of standards together with governments. And the first ones who are able to define these standards will normally prevail for the global standard-setting body. And by the way, these standards could give industry quite a lot of leeway in developing, which they’re anyway doing. They have more resources than governments nowadays. But it also should invite them to voluntarily share with government what needs to be onboarded all the time into the regulation because governments cannot regulate if they do not know what is cooking in the industry. And also, I think, thinking also of some incidents from the last year, if there is one company which is capable to play the government’s game, affect your political decisions by withholding their service from one party and not from the other party, there should be a mechanism which will make sure that the share price of that company tomorrow is very low. Because otherwise, we cannot keep the sovereign’s task only to the sovereigns. I’m sure Saudi Arabia understands these problems very well and can catalyze the positive process.

John Defterios:
Good. We have the benefit of having His Excellency Amin Nasser from Aramco as one of the four partners that Ryan mentioned here. So they have the corporate sector very involved in cyber security, which I think is quite crucial at the front end of this process. Minister Saran, I’d love to get your thoughts on the ability to leapfrog through digital technologies. We saw the Indian example today, called it the belle of the ball at the Future Investment Initiative because there’s so much attention, so much growth. But how do we prevent the fact that if we don’t get the cyberspace correctly, it erodes all that growth we saw in India, where you take a case like Nigeria leapfrogging away from the hard line into mobile? What’s your view of the global south and why it is so important to make sure we get this right on the collaboration our two other speakers have been highlighting so acutely?

Shyam Saran:
So just to give you an example that while the G20 summit was taking place in New Delhi, there were probably several thousand cyber attacks on the various sites which were associated with the G20 summit. And it was a huge challenge trying to protect our systems from such attacks. Now, it has just been mentioned that today, if you look at the UN system, where actually you should have a kind of collaborative responses to these kind of threats, you have actually the entire trend is going backwards. Because we started with a document which was about 40 pages, and now it is more than 70 pages. Many of the issues which had been resolved have come back again, and some new ones have been added. So we are in a situation where it doesn’t seem as if we can, for example, as India, can really depend upon the international system in order to provide us with the kind of capabilities that we need in order to deal with this situation. So this is where, at least over the next several years, our effort is really to try and see whether we can collaborate wherever it is possible, and we are doing that with many of our partners. Also, I think the importance of the forum of this kind is that, how do you regulate if you don’t understand what the problem is? And I think today, the gap between policy makers, decision makers, and the technology, the fact that, as it was mentioned, that it is the private sector which actually is leading the advancement in this technology, unless you are able to get that information, get that knowledge across to decision makers, across to policy makers, there is very little hope for regulation. So you mentioned the fact that a start had been made by President Biden’s announcement. The European Union has also, in fact, made some advance. We are trying to do that in India as well. But it is fora like this where that knowledge which is required by policy makers, that knowledge which is required by governments, perhaps this is the kind of forum where that kind of sensitization, that kind of awareness, at least, can be advanced. And that would be a very, very crucial component.

John Defterios:
What an excellent panel we have here, because you are going deep into the key topics that are faced with today. I would love to tap, President Barroso, your experience as the European Commission President and the general data protection regulations, the GDPR, if I remember correctly. We have assumed that as the norm, which is very interesting, right, because if you open a website today, it says, do you want to accept cookies or not? And people were pushing against that GDPR, but it did take public-private partnerships to kind of determine the roadmap, if you will. So it can be done, can it not, in cyber?

Jose Manuel Barroso:
Yes, it can, but it’s difficult. In Europe, and now I’m with the experience of the European Union, I think the first proposal we’ve made, it was my first commission, 2006-2007, but it was not entering into force before 2016, because we had to put together all the governments of the European Union. At that time, we were 28, before Brexit. And the reality is that in Europe, there is always this trade-off between scale and speed. The best thing is that we have scale, and that’s a great example for globalization, because you have to put together 27 different countries, and among them, there are cultural differences as well, economic difference and interest. But at the end of the day, usually in Europe, we come to a compromise. So we have the scale of 27 countries. But of course, it’s different to have 27 countries agreeing, or 190 in the United Nations. In Europe, it takes time to come to a consensus of these 27 countries, but it’s better than to do it only alone, each country on its own. As we very often say in Europe, at least I’ve been saying, in Europe all countries are small. The problem is that some have not noticed it yet. Because we need that scale. In Europe, we want to be on the same level as the United States and China, or India in terms of popularity. We need that scale that the cooperation gives. So I think from that point of view, it’s a very good example of trying, through negotiation, to overcome differences. But to be honest, it also takes time. It’s slower than if each country takes its own decisions. But at the end of the day, it’s better. And now, when GDPR was launched, General… data protection regulation, in terms of data privacy, it was very much criticized. People said, oh, once again, the European Commission comes with all that bureaucracy. But now, all business in Europe agree that was an improvement. Can you imagine in business in Europe, if each country in Europe, from France to Germany, from Italy to Sweden, from Netherlands to Spain, if each country had its own regulation? Of course it would be a problem. And that’s why, as you said, John, now, for instance, California, they followed very closely our GDPR. So in a way, it was setting a standard. So I think it makes sense, with some, let’s say, common sense, it makes sense and wisdom, if we try to, in some areas, to have global standards. And the European Union can be a contributor for that.

John Defterios:
Good. Madam President, you had your eyes looking at me. You’re ready to jump in. Go ahead.

Kersti Kaljulaid:
Yes, just a little advertisement. The European Union is now cooking AI act, of course. And indeed, GDPR became a de facto standard globally. But I’m sure that we need AI act to become a de facto standard globally quicker even. So I would invite all like-minded countries who want to be part of it to kind of support similar standards and adhere our practices to this act when it comes out. I’m sure this is extremely important. On the other hand, it is also important that we have this regulation for the industry, for the surety of the investment. Because if you are investing into the Wild West where you don’t know, you end up in explaining in some countries’ parliament, we’ve seen it, I mean, in the first phases of tech development. Why did you do this? Why did you do that? Because you didn’t tell us what is the regulation. And that is why I believe it is also very important in this region, which is also quite rich and important market, to come out with a certain set of standards to guarantee the security of the investment. This is extremely important. And this is what this country can do when others close here. I would also like to say that in my understanding, all we have to do is to go back to our very basic principles and values and apply them for every generation of technology. Not we have this one, we regulate this and so on. And these are human rights, the rights of nation states to organize their life as they please, that we do not force each other’s borders, all these basic principles. And simply to agree that never mind technology, this kind of decency, which we collectively have known for thousands of years, since Peloponnesus wars, basically, that this decency which applied then applies now and will apply at every new technological level.

John Defterios:
Interesting. Before I bring in the former Foreign Minister of India, I’d love to, if I can, Madam President, this is a key issue. And it’s one of those pillars that we talked about at the opening of the GCF in 2023. I say this kind of a jest, I have two daughters and they always say, that woman is impressive. She’s a girl boss. You know, she knows how to lead. I mean, you are the ultimate girl boss, president of Estonia. And it was a leader when it comes to technology. But why is it important, in your view, to get women more involved in cyber? And how do you match the curriculums of today? Because I always find, now that I’m a practicing professor, I find that it’s the business sector that goes to universities and says, we need this out of the pipeline. We need this sort of skills. And we need women engaged in this. And what’s the relationship between government and universities and the private sector? Do you want to tackle that for us? And Shem, I’d love to have you jump in as well, please.

Kersti Kaljulaid:
Well, I am an honest believer in market forces. And if Estonian technology sector, and we, by the way, have 10 unicorns per 1.3 million people, this is double the density of United States. If this sector comes together and establishes Unicorn Squad, which is the tech training only for girls, then there must be something in it. And you know, I think what there is, is what has nothing to do with cyber or digital technologies. It so happens that half of the populations are women. Therefore, half of the good ideas come into the heads of women. And if you do not tap into that reserve and these resources, then you are losing 50% of your capability. And this is a too big chance to lose for the markets. That is why Estonian tech sector has come together and done this work for the government.

John Defterios:
Good. But the universities, and I’d like to have Shem do that as well. Yeah, it’s worth noting that in the last six years, we’ve gone from almost zero female participation in the workforce to 37% and rising. It’s changing very quickly here, right? But Shem, do you want to cover this role of the universities to keep pace with the change in technology at the same time?

Shyam Saran:
You know, the big challenge really that I’m talking about the Indian experience. You know, at the end of the day, what are you trying to do? You are trying to wrap your analog mind over a digital space. And that’s very challenging. How do you how do you do that? And in that respect, you know, the participation of society in this whole endeavor, not something which is top down, but something which we see happening in India, it’s a very traditional society. And yet you see that because of these advancements in the digital space, there are good things happening. But there are also bad things happening, including as far as women’s rights are concerned. So this is something which really sort of makes you very much focused on how do you prevent those kind of negative things from happening. And participation of women in a very active way in this space is one of the ways that you can actually address those negative trends. You know, I am very impressed by the fact that in our host country, as a result of recent reforms, you have a very educated, you know, women constituency, 50%, which whose brain power has suddenly been added to this economy. And that’s a huge, huge resource, which has been brought into play. And I think in terms of cyberspace itself, if I’m not mistaken, women in Saudi Arabia are playing perhaps a very, very important and critical role. So this shows how, you know, in this space, having women as equal participants really kind of changes the societal impact of what is this technology doing to us. We have not really focused attention on the societal impact. There are, you know, impacts on the human psyche. There are impacts as far as society is concerned. And while we are very much focused on technology, perhaps we sometimes, you know, are guilty of forgetting about those kind of impacts, because we are so much dazzled by the technology that we don’t really look at the human aspect. That’s why I said with analog minds, you know, trying to manage cyberspace is not very easy.

John Defterios:
Okay. I’m going to circle back afterwards, Madam President, on your foundation before we finish the session, because you’re starting to study the impact on society of technology, which I think should be a very important component. Oftentimes you look at, you know, the cyberspace and AI and speed and access to information, it should be a calculation of the societal change. But I wanted to get the panel’s view. We did a podcast for the GCF, which is a phenomenal series, but we looked at it through the media, obviously, because of my experience. And I was suggesting cybersecurity should be a top five issue of society today. And then we had a debate within the GCF Institute saying, well, maybe over time, in a very near period of time, it should be a top three issue, because it touches everyone. Do you want to share where you think? Because it doesn’t seem to be on the top radar. If you poll people, they say inflation, worried about climate change, cost of living, right? Security, conflict. Where does cyber fit into that, President Barroso?

Jose Manuel Barroso:
I agree with your concern, because cybersecurity is more specific. It’s related to other issues that are very important top concerns, namely security. The word security. And now in the world, people, besides, of course, the economic situation that is affecting so many people, they are worried with security in general, and cybersecurity is part of that. But I believe it’s going to gain preeminence. It’s true also that in spite of the very important costs, namely for business, that are paying a big cost because of all the disruption, intrusion, all the problems that we are seeing in the business sector, the reality is that until now, knock on wood, there has not been a major, let’s say, catastrophic event globally of cybersecurity. Until now. For two reasons. Those who have the power to create it are not willing to create it. I mean, the governments that have the power to create a major disruption until now have avoided it. And also those who could create it that have not the capacity. I mean, non-state actors. Because if you think about terrorist organizations, or even, let’s say, criminal networks, that could be extremely disruptive until now, apparently, they have not yet the skills, the technical capability to create that major event. But what we have to think, in terms of risk management, is what happens if one of the biggest global players, state player, decides to create a real disruptive attack globally? Or if one terrorist organization or one criminal network is able to acquire that technology and we are not yet there, I hope we will not be. So but in terms of prudent management and risk management, in terms of wisdom, if I may use the word, what we have to do is to prepare for that situation. That’s why in linking to the last question we have put, I think it’s so important that the governments of the world, responsible governments of the world, they match the technological developments with the investment, public investment, including in skills. For instance, in Europe, the European Agency for Cyber Security estimates that we need 200,000 cyber experts. We are lacking men and women, of course, men and women. But we are lacking that. So we need more investment to manage the risk that can come from cyber security threats.

John Defterios:
Okay. I’m going to wrap it up. We had a longer time here, so I’m going to just ask for two final thoughts and we’ll conclude. Madam President, and then Cheyenne, please, very quickly.

Kersti Kaljulaid:
You mentioned my foundation. President Kaluulaj Foundation was set up to understand how Estonian society, which for 20 years and slightly more, is now receiving all public service online, how this has changed our society. And guess what? This year, we understood we have to establish Academy of Democracy for our youth. You know why? Because we came to understanding that when we went to school, you and I, then we learned our emotional intelligence from interacting with each other. And we for 10 years thought that we need to prepare our children for life in tech, surrounded by tech, in teaching them tech. But it’s actually counterintuitively that we have to teach them how to remain compassionate human beings. Yeah, absolutely. And this is the most valuable conclusion. Technology is not going to make us safe and secure. Being compassionate human beings, knowing how to remain a society through all the challenges, this is which finally defines the future of humankind. Maybe somebody is disappointed. It’s not technology. It’s still us. Thank you.

John Defterios:
Yeah, trying to find that balance is important. I completely agree. And I’m sorry to rush this, but Cheyenne, your final thoughts, and then we’ll say our thanks to you.

Shyam Saran:
Well, I would only say that at the end of the day, we are still physical beings, flesh and blood. And I think while we take the digital space as an instrument, it should not overwhelm us. I think that’s very, very important. Thank you.

John Defterios:
Good. What a fantastic session. I really appreciate the depth in which you gave the thoughts of all the major topics that we’re going to have over the next two days. President Barroso, thanks for the time yesterday. We had a deep discussion of where we’re going with cyber. So President Barroso, President Khadjajad, it’s nice to see you. Thank you very much. I’ll say Madam President and Minister Chiran, great to see you again here at the GCF. Can we give them a nice round of applause for the participation? Thank you. Well, thank you to our esteemed panelists. Let’s give another round of applause for what I think was a very frank and insightful discussion. We heard the former president of the European Commission there talk about the sincerity with which he was speaking. And I think all of our panelists, and I certainly appreciate that. I think that was a great start, not just to our two days here, but for all of us as we begin down the journey in building a safer and more resilient cyberspace. So let’s keep that in mind over the next two days, that we’re here to unite across industries and countries to forge that safer and more resilient cyberspace. Thank you, Your Royal Highness, for joining us this morning. Thank you, all of you, for being here so far. We are now going to take a little break before we tackle the big issues for a little coffee and tea, and then re-energize. We’re going to come right back here and reconvene in, let me say this nice and loudly to all of you, we’re going to reconvene right here in 15 minutes. Thank you.