Fighting rise of automated cyber threats with people and partnerships

By Hiyal Biyagamage

Simon Green, Senior Vice President, Asia Pacific, Palo Alto Networks – the global cybersecurity leader – was in Sri Lanka recently for a brief visit. Daily FT had the chance to speak with Green about how collaborations and education will play key roles in resolving rising cyber issues. 

Expressing his comments at the outset about Palo Alto Networks true notion as a company, Green said, “The culture of our company and how we are trying to tackle these cyber issues is not about saying to people that we have the answer to everything. The higher order position that we have taken is that we want to collaborate with government and industry. We know that if we come together, we have a better chance.”

“That is why when I visit countries like Sri Lanka, I take every opportunity to meet people from industry and government in order to understand the context. It is not about the numbers but about the philosophy of how we go after this problem. We have got audacious goals to protect your digital way of life. It is a big goal and we want to achieve it with correct collaboration and investments,” Green said further.

Below are excerpts of the interview:

Q: Experts have quoted reports from global research agencies like Gartner where they point out that by 2020, a company’s cybersecurity rating will be much more important than a customer’s credit rating. But the security attacks are on the rise and we cannot keep up with the numbers. Where have we gone wrong? Is it the human error factor or aren’t we having enough solutions or is it just a combination of both these elements?

A: These reports maybe right or they may be wrong sometime. I think understanding your prevention posture and what controls you have put in place in your organisation are very important. It is already very important and will be more important in years to come.

Have we gone wrong? I think as the whole security industry, we have failed to collaborate early and we should have collaborated earlier than we have done before. So I don’t know whether that if it is a failure or a crucial function of time we have missed. Technology has rapidly evolved in all facets of technologies. We are trying to grasp this new application world, cloud world and what we have witnessed is a proliferation of technology. Customers have been in multiple mindsets, defending their best breed of technologies, which have not been communicating with each other properly. 

Therefore, I do not think the industry itself has not necessarily helped this cause. Our challenges today, while moving forward, are very different to what they were few years ago. 

The attack surface is huge now for any organisation because they have their own networks, different cloud strategies and we have a huge device proliferation. Your device is an end point for your company’s network. 

We have a broad attack environment now, we have a very small number of people who are capable in security, and the drain on talent is enormous. Everyone I spoke to in Sri Lanka is concerned about not having enough people. Therefore, we are fighting at people rise against an automatic rise. The attackers are highly automated now and they are using cloud computing. They are leveraging assets all over the globe to attack.

We have to figure out how to automate and solve the talent problem. Therefore, I think we have multiple things that are occurring right now. 

Q: The Asia Pacific region has been vulnerable to many cyber attacks over the past few years. Experts pointed out that many of these incidents never made public. Do you feel that there’s a need that if an attack happens, the stories should go public?

A: Yes, I do. It is never nice for people to be attacked. We never want that on anybody but yes, it should be a mandatory disclosure. In the United States, companies have mandatory breach disclosures and in countries like Australia and Singapore, they follow the disclosure route.

I don’t think the objective would not be to create fear; we do not want to create an environment of fear but raise awareness and visibility to the fact that what is happening out there in terms of cyber attacks is real; letting people know that these threats are real and that we need to come together. We have not been collaborating quickly enough and today, collaboration is of utmost importance to bring the industry, governments and partnerships together to help solve the problem. So yes, I think disclosure is an important piece.

Q: What was the purpose of your visit to Sri Lanka?

A: Palo Alto Networks has a team here and one of the main purposes of my visit was to come down and get to know them. I met some of our customers and it was a good exercise for me to understand the priorities and how we are serving them because they made investments with us.

I am also here because Palo Alto Networks is constantly looking at ways to invest in the region and there are a lot of foreign investments coming into Sri Lanka now. There are lot of highly educated people here. The question is how we get potential access to that talent so it is about solidifying our view on where potential investments should be placed. 

The third piece of my visit was to meet with the government and figure out how we can work together. We are working with the United States government on a concept called ‘Cyber Moon shot’. The idea complements an audacious goal of making the internet safe within the next 10 years. United States cannot do that alone so therefore being able to work with other governments and industries will be an important conversation in the next few years.

So that is the crux of my visit to Sri Lanka – people, investments and partnerships. 

Q: How does Palo Alto Networks work tirelessly to make your solutions much safer for your customers?

A: Research development plays a key part. We have research and development facilities in the United States, Israel and we have people involved in development in Australia. Who knows where that would be in the future! I think the important thing for us is this collaboration concept. What we have been able to do is create an environment to leverage. What I meant by that is by the end of Q3FY2018, we had 51,000 customers. Those customers send us log information, which we use for our threat intelligence cloud. We have multiples of these clouds and they are constantly using artificial intelligence and other techniques to determine whether a piece of information we are receiving from a customer is a known threat or a non-known threat. If it’s unknown, we’re converting it to known. What we do with that is we reprogram every customer. 

We are constantly moving from unknown to known decisions every five minutes. When the ecosystem becomes bigger, the willingness of customers to come into that ecosystem also gets bigger. That is an important part of the strategy. 

For our threat intelligence cloud, which is not widely know, we receive feeds from other vendors, not just customers. Vendors have now started to collaborate saying ‘here, have my data’, which is becoming a very promising model.

Q: Any specific verticals that you think which contributes to Palo Alto Networks’ business in Sri Lanka?

A: Sri Lanka is really not different to any of our other markets. Telecommunications, banking and finance, manufacturing and critical infrastructure will be important business sectors for us here moving forward. 

Q: You spoke about the lack of cybersecurity professionals, globally as well as locally. How would a company like yours would look and act, helping countries to mitigate this issue?

A: One of the important discussions we had with local organisations was how we work with the education sector and the Ministry of Education to firstly roll out technology across the schools and how we work with the Ministry to secure them. That doesn’t help the talent train but at least it allows confidence in the schools to be out there and promote curiosity and provide a safe environment. 

What we have done is that we have developed an education curriculum. We work with universities and we work with schools on cyber education. We launched a program last year and we think of social bodies like girl guides. We have a program to bring education to young women and not necessarily about cyber but about STEM – Science, Technology, Engineering and Mathematics; subjects to promote diversity. 

We are working with governments and education ministries to educate government executives as well. So we have an executive curriculum, helping boards understand the responsibilities around cyber which is very important as well.

Q: For many years companies like Palo Alto Networks, who have been working in the cybersecurity space, have found it very hard to elevate the issues beyond the realms of IT department. Now, everyone is gearing up to battle this next big battle in terms of cybersecurity which is building digital resilience. Could you comment on the importance of digital resilience as a concept?

A: I think the issue is trust. We have to restore trust and the more attacks that occur, the more trust that is broken and more people won’t be willing to go to digitisation. Education is one element that we have to focus. Educating boards and executives on what their responsibilities are is important as they think about digitisation. Lot of people talk about digital transformation but many of them do not talk about security aspects. Because there is an inherent belief in some aspects that trust automatically build brands. 

I think that making sure that security is absolutely central to the decision process will be credible to digital resilience. That also means implementing good policies and risk mitigation practices. It is not just about technology. There are still going to be people in this process. Someone will jump and pick up your USB drive and sticks it up in another computer. Therefore, we still need to have good people practices as well.

Q: Any comments on the importance of shifting the mindsets of people from the mentality for having one-off solution for everything to becoming vigilant on necessary high-level cyber security requirement?

A: I think it’s important for all. First the country and the industry has to come together to make a decision. The mindset has got to be about prevention and preventing as opposed to defending ourselves. Prevention is about visibility. If you can see it, you can do something about it. Having everyone to start moving towards this concept of prevention and collaboration, will eventually shift the mindset.

Q: What are Palo Alto Networks future plans for Sri Lanka?

A: My visit was about exploring those future plans. As I mentioned, you have a highly educated society, graduating something around 25,000 graduates a year and that acquires a large amount of talent. In an environment where the country is actually appreciated by the surrounding countries, there is an opportunity for companies like us to get access to the talent pool.

Obviously, investments are important. I will leave Sri Lanka with a very positive view and what is possible and I didn’t really know what I was going to expect. I was so pleasantly surprised that the quality of infrastructure that is already here. The traffic management and the ease to get around is relatively easy when you compare with other countries in the region. When I walk out of here, that’s what I’m going to take back. When I sit with an executive team I will say here’s where I think we need to put a grand investment for the next few years.