Podcast Transcript

Welcome to Cyber at the Top, a podcast from RSAC that unpacks real experiences, lessons learned, and practical strategies from CISOs at some of the world's leading organizations.

For years, information security was almost always concerned with protecting confidentiality.

But as our world becomes more digital and dependent on uninterrupted trustworthy information, integrity and availability are becoming just as important and far more challenging to guarantee.

I'm joined by Bjorn Watne, global CISO of Interpol, to explore this change and why it's so fascinating. We'll discuss how it reshapes risks and the new challenges it presents for security teams and how CISOs can balance all three pillars of information security. So let's get into today's conversation. Bjorn, welcome. Thanks so much for being a part of this.

Thank you so much for having me. It's a really interesting topic that we will be talking about today. So happy to be here.

Oh my gosh. It's fascinating. And and let me ask you before we get into it, could you start off by telling us just a little bit about your role at Interpol?

Absolutely. I am a chief information security officer, and most of us know what that entails. We're in charge of looking after the confidentiality, integrity, and availability of of data in our organization. Interpol as an international organization is a little bit different from at least a private company. Our vision together against crime is built on pillars where one of the most important pillars is that we will be the trusted global information hub for law enforcement. That is quite a big elephant that needs to be chopped up to to manage, but that's where I'm currently sitting with a lot of really, really, really competent colleagues.

Amazing. What an important institution to be sitting in that particular role. So I can't wait to to get into this topic with you. And we were talking just before we got started that historically, cybersecurity really was centered around protecting confidentiality. At least that's how it felt. But now there's this growing importance of integrity and availability.

And you're you're always taught, you know, probably cybersecurity one zero one, the triad of CIA.

But with integrity and availability becoming more important now, First, what's driving that shift?

To the biggest degree, the digitalization of society as a whole, and also the convergence between IT and OT. So if we go back twenty years, and we were without Internet, for example, that was a nuisance at most. We would just go on to our BERT files, our Excel sheets, the coffee machine, and we will wait for the Internet to get back. And then we could send emails again.

But today, we are hooked up with almost everything, to the Internet. All of our devices has, some sort of communication with with Internet. If the link is broken and the system is unavailable, it will also cause problems in the physical domain, and that is something that we didn't have before. So I think the the fact that we have the physical digital domain connected drives this shift, and also the fact that we have so much of our systems dependent on these data to operate.

In Norway, for example, where I, where I'm from, we're almost a 100% digital when it comes to paying for goods and services. If that sort of availability is is is gone, then we won't be able to do simple things as as buy food. Yeah. Digital dependencies and ITOT convergence, I think, are two big elements in in why this is changing.

You know, you bring up such a good point and you really bring it down to basic human needs. Like, maybe we couldn't even buy food. You know, this this increased dependency on information feels like it's changed the risk landscape substantially.

I I had a friend, and this was a few weeks ago. There have been, obviously, you're very aware, some major cloud outages over the past few months. There's been some outages of other things before that.

And this person had a pillow top that would adjust temperature, right, just based on how they're sleeping and to keep them comfortable. But it was hooked up to a cloud service to control it. And when the cloud service failed, it defaulted to becoming the hottest it could possibly be. And so the person just woke up in a massive sweat. And it's just an example of what you're saying around even sort of physical things having this dependency on information.

But would love to get a little bit deeper with you on that. How has this increased dependency on data and information and services changed the risk landscape and how you think about risk?

If we look at at the risk back in the old days, I mean, when we when we were primarily focused on confidentiality, it was primarily theft of data that we were worried about. But, and the threats, they were also mostly focused on stealing data. The last few years, we see tendency of of this changing toward systemic disruption instead. So from data theft to systemic disruption.

Ransomware, for example, as a service that is now a very, popular service that you can buy, on the Internet. And these guys are are quite clever because they have double or triple extortion. So they will they will actually steal your data, and then they will render your systems, unavailable. They can hit you with all kinds of extortion and and and whatnot in in multiple layers.

So systemic disruption is is becoming more of an issue and more of a target for for for threats, rather than data theft. Supply chain attacks, for example, that is something we see. And and I also mentioned in the first, in the first question we had here, the the OT, or attacks towards physical infrastructure that, that we didn't have before. There are many, many changes in the threat landscape.

I've gotta ask you, how do you strike then the balance between these things? Because, obviously, and to your point, the confidentiality concern isn't going away. Right? We still we still need to keep data confidential. We do care about the integrity of that data still.

Availability is a point that you've hit on already, how dependent we are on these services being available and data being available.

How does somebody think about striking the right balance of controls and energy around those things, especially when resources and attention tend to favor one over the others?

It's a very good question, and it's a very good answer to it as well, I think. Because what we've been taught over many, many years is that we should always have a risk based approach. Because if we try to protect against everything and every risk, we will fail our objectives. So so the same the same works here, but we need to think about risk classification a little bit different. I have a colleague in Norway, a professional colleague. He has this, talk that he's been doing a few years where he has a a bit of a dark joke. He says that he has a condition, and he might get ill.

And what happens if he is driving his car and he he he gets ill? He goes off the road, and the paramedics, the first responders are coming. But they cannot go online to read his, medical record because there is, too much privacy protection, between the paramedics and the and the hospital. So they end up administering a drug to which he is allergic. So instead of helping him, they actually kill him on the spot. And then they see that the next the next photo he puts then on the, on his presentation is a is a tombstone with his name and his, his his his date and it and and and description below, at least his data was kept confidential.

Oh my gosh. That's the way to start a presentation.

Yeah. Exactly. But but but it's very impactful, and it makes people think. Right? So so back to how we make this right... The right balance, we need to classify whether availability of a system outweighs the need for confidentiality or integrity or vice versa. So we need to not just, as we always have done, classify information according to their confidentiality level, but we need to classify systems in... According to their availability needs or integrity needs, for example, in financial services, stock markets, etcetera. So to have this classification of systems dependent on their uptime requirement or integrity requirement and then prioritization of the different systems, which one needs to be up first, which one has to always be accurate, but can be offline more or less, and and how important is confidentiality up in all of this compared to, for example, availability and integrity?

You're right. It's it's sort of not not an unnatural motion, but it's different than how people typically articulate security. It's usually this is very confidential data. It's personally identifiable, for example, or it's health care data. So we know to put bubble wrap around it. But this availability piece and the integrity piece, it just doesn't feel like there's the same level of rigor around metrics and risk. And I I gotta ask, what's the biggest challenges your team and other cyber leaders might face in ensuring that integrity and availability happen and are prioritized across complex systems?

Yeah. I I think there's a keyword in in your question right there, complexity. Because if you look at any organization today, it has exploded more or less into tiny, tiny bits and pieces that are now connected on a global scale. So your supply chain used to be internal, but now your supply chain is completely global, and it's very difficult to get the visibility across these huge, landscapes.

So to maintain visibility, to track every change and component required to keep your systems online, that's very difficult. To test resiliencies, it also becomes more and more difficult because you need to involve so many third parties. And another thing that that that we've seen, especially with the introduction of of cloud computing, is that configuration drift or changes in in, infrastructure is also becoming a problem. We like to say that the cloud platforms are the most secure place where you can put your data.

I will not go into argument there, but at the same time, we have seen a lot of data leakage issues from from cloud platforms. And and, I know there was a survey done by Gartner a few years back that tried to find out what is the cause of of breaches in cloud platforms, and I think more than 90% was due to misconfigurations.

Yeah. It it it brings some challenges, and and we always have the human element into these things.

But, yeah, you know, you really made me think because if you if you wind the clock back even three or four years ago, what you said is...

Was was a big problem. Configuration of cloud, you know, Drift, for example, in that configuration, maybe even additional suppliers that your supplier has taken on that you may not even know.

But I was just thinking about what you said in the context of rapid AI adoption and automation.

How do you see this problem changing, or how do you see this kind of adoption influencing your approach to maintaining integrity and availability?

Yeah. I I think that it's double sided as with many things. So these technologies that you described, they are essentially enablers. Cloud computing, for example, great for enabling increased availability.

You can have, data centers across the world. You can have a hot standby. You can spin up new servers when others go down. It's super nice. Automation, for example, very good at enforcing policies and security levels on a continuous running scale. AI machine learning, very good at spotting anomalies, unwanted behaviors, and react appropriately. So, yes, all these technologies, are definitely enablers that will improve, if done correctly, on integrity and availability.

But they do also come with some challenges. Let's take Agenetic AI as an example. If you look at a chatbot of old and you try to implement controls in this chatbot, it was mostly controls to make sure that it didn't say something wrong or or that the output wasn't profane or or or wrong. But with the agentic AI, it might actually do real damage. So it might pay out money, for example, to the wrong wrong account, and that is completely different threat this time around. So you have to handle it with with care. Think it's early to see early to say how this is gonna impact on the wider scale, but but I would say those techno... Technologies are definitely enablers and that they will improve or help us improve both on integrity and availability, but that it comes with a with a bit of a, like, a warning sticker that wear your seat belt and do not speed.

Yeah. The the wear wear your seat belt comment really resonates with me because I I I think about, you know, the time and just reading about when that was introduced and how much of an education campaign that it was for the public. Right? Here's why you should do it, and here's why you need to do it, and here's why it's important.

So put... Putting the technology aside, how do you educate and foster a culture that values integrity and availability and tries to anticipate some of the things that you're talking about, like potential failures or corruption, as much as they value and think naturally about confidentiality today.

It's about doing the same thing again. And and you... And you're right. Confidentiality has been the poster boy of information security. We've always been training people how to keep confidentiality. It's like protect your credentials and label your documents. So we need to do it again.

We need to look at security not as the barrier or the gatekeeper for confidential information, but as...

Actually as a quality and resilience enabler. So the CISO maybe become like chief risk and resilience officer or something like this. And going back to the other question that you had, which which was very good, by the way, looking at threats and risks from a CIA triad point of view rather than levels of confidentiality point of view. When we speak to employees, and managers, we need to come with that message on the importance of having a system running, having a system available.

Because down the road, regardless of where you work, I would argue that if you're in IT, if your systems fail, the business will fail. And and there are some very good examples, not even recently, but a few years ago, actually. Maersk, the Danish, shipping giant, they were hit, and the business just stopped. And if you if you would have asked any of the executives two months in advance, are you an IT company?

They would look at the old maps on the on the wall and like, no. No. No. We are we are sailors.

We're a shipping company. But it shows that if the IT systems are out, that whole thing stops. Another thing was Norway's hydro aluminum.

Yes.

They produce aluminum. Would you...

Would would they say that they were an IT company? No. Not at all. They didn't even have a CISO at the time that they were had attacked, compromised, and they also needed to stop the entire production for for for days.

And these two examples, hundreds of of of millions in losses. What is more important? That some confidential data leaked or that this is just systems were able to able to restore and and continue? So so I think to build that mindset, to have that focus on availability, of the systems and integrity in in the information that they contain.

Now that it becomes so crucial to any operation, that is where we need to start putting the mindset. And I think that will change how the value of the information and cybersecurity professionals are seen in businesses as well because technology becomes so crucial everywhere.

It's it's such a great point, and I didn't even think about it till you said it. But almost built into the name of chief information security officer. It it almost sounds like a confidentiality topic. Right? Just just just if you if you read out that acronym and, you know, what what the first thing is that people would think about. But as you say, it's the entirety of the business. Like, if if availability fails, for example, the entire business can come to a halt.

And do you think then that this role changes into something else? So you mentioned around sort of risk and availability, but also does importance continue to rise inside of the organization?

Yeah. I I I would would definitely say that, and it has been the case for for a number of years. When I started, it's coming up to twenty five years ago. Most of the CISOs or CSOs that existed were all men, and they usually came from one of two backgrounds.

It was either police or it was military. That was twenty five years ago. And now it has changed. You see that, most of the CISOs, they come from a technology background.

They know IT and and technology. But lately, I think we see that more and more also has a business, education on top with an MBA or or or something like this. Because a science needs to be focused on the business outcomes as technology is becoming such an important, pillar of the whole business.

So you can't really be isolated into technology. And as you said, the guardian of secrets that is, that is not working anymore. You need to be, supporting the business and working on on, yeah, availability and, and risk reduction.

Maybe if you could give some advice on how does somebody go about best measuring or communicating success on the integrity and availability front. It it feels like, typically, folks will talk about, you know, their data labeling efforts and what they've done on encryption and what they've done to secure the data and keep it confidential.

But how do you think about success or ways to know that you're getting better on integrity and availability?

Yeah. I think you need to to start and focus maybe a bit more on the two last letters of the of the triad. You need to start asking questions like, what happens if these data are wrong, or what happens if the system isn't available?

And start making people think of of answering those questions more than just what kind of data does this system hold. Is it PII, or is it trade secrets or or not? So I think it would, yeah, broaden the risk mindset, have more focus on on on those two. And, again, and this is this is a uniform thing, instead of trying to focus on prevention, you have to focus on assumed disruption.

Because at one point, the **** is going to hit the fan. Right. And and then you need to have a playbook and a playbook that you have rehearsed on, so you know or people know what to do and when to do it. Because if that is just a paper tiger hidden in a drawer somewhere, I can guarantee you that you will be very sad when it first thing goes bad.

That is so well said. And and so many times it is exactly that. Right? Something to get just put in a drawer and people aren't actively thinking about it.

And one last question for you, and this is for other security leaders that are listening. What's one piece of advice that you'd offer for adapting this broader view of information security? Like, what what can they do? What would you recommend that they do next?

It's gonna sound very basic. If you look at the latest regulatory requirements that's being, put out over here in in Europe, you will see that they instruct companies to look for their crown jewels. What are the key processes and services that you're in the business of of delivering? And that applies also to us as a international organization, connecting law enforcement together.

We need to find out what is the...

What are the key services and products that we deliver. So identify those, and then you start working on resilience. Assume disruption, find out what it takes to get those systems back, get those services and and and products back online if they should fall out for whatever reason. And you have to rehearse.

It's it's it's not enough to just do a tabletop and and write a piece of paper. This needs to be tested because it's so crucial when it happens that you are actually able to to get back online. So any company, any business, find your crown jewels, assume breach, and then rehearse on how to to restore. That's...

Because you can always... You can... I will argue, but you can most of the time always recover from, from a data leakage. But if your system is taken offline, that's that's harder.

I can almost see that as a t as a t shirt. Right? Find crown jewels, assume breach, and how do we restore?

And train, train, train. Yeah. Yep.

Train, train, and practice and practice.

100%. Bjorn, thank you so much for being here today. Really, really appreciate it. It's so insightful.

And and listeners, thank you for tuning in. Please keep the conversation going in our RSAC membership platform by visiting 1rsac.com/membership. And be sure to check 1rsac.com for new content posted year round.

Bjorn, thanks so much again for taking the time for this.