Leading up to the round table to take place in Luxembourg in July 2024, we discussed the issue with,

• Jørgen Floes, Distinguished engineer from Kyndryl
• Adam Gale, Executive Architect from NetApp

How big is the threat?

Kyndryl, previously part of IBM is a global provider of Cybersecurity solutions and of the 4000 clients they have around the world, about 200-300 are successfully attacked every year. They also report that cybercrime is the biggest threat to data hosting companies around the globe as threats from natural disasters have reduced. They have 80 centres globally and 40% of incidents are cybercrime related. Cyber risks go even further and with geo-political conflicts on the rise, you only need to look as far as the current Ukrainian, Russian conflict for direct evidence of Cyber Attacks preceding physical warfare.

“Storing and managing data lies at the heart of the challenge.”

If you lost all your data from the last two years, would your business survive? Probably not. Perhaps you believe that because you are using the cloud, either completely or partially that you have a better chance of business continuity. Think again. Many organisations have a mesh solution of on-premise and cloud storage, which also means they need different forms of security for the different types of data stored in different ways. The Nasdaq listed company NetApp, the Intelligent Data Infrastructure company, let the good guys in and keep the bad actors out.

Many of us have already heard about regulations such as DORA or NIS2. In your view what were the regulators hoping to achieve?

DORA is aimed at the financial sector and NIS2 aimed at critical infrastructure, but both are trying to motivate, almost threaten companies by means of fines levelled at the management into meaningful change. This change will influence, more than hardware and software choices but the human factor of who needs to know what and when and what consequent actions to take.

Effectively the days when a member of the board could sit back and allow their CISO to stay awake at night worrying about hacks are coming to an end. But regulators are right to act, the number of malicious elements who may make attacks is at an all-time high and action by all organisations is essential.

One sub-plot within this labyrinth is that many companies have business relationships with third parties especially in terms of data hosting. This scalable part of the business ecosystem, makes sense but is not without its own risks.

“Don’t put all your eggs in one basket? This includes using just one cloud, is a key underlying message from the DORA regulation,” said Adam Gale. The financial industry is so critical to our everyday life, more than just banking and payments but insurance, crypto, central counterparties, the list goes on. It is like a chain, where every link is essential, if one link fails the chain falls apart.”

Regulators are sensitive to the data that is being used by LLM and GenAI to provide results. They know it could be poisoned and thus steps are needed to protect users, companies and the public at large.

What type of cybercrimes are on the rise? 

For a number of years, It has been easy to create your own Malware. Up until recently it was even possible with ChatGpt to create your own Malware code!

Malware needs to be planted and this where the other methods come into play. There is still traditionally hacking going on, but phishing and some of the code that is used, if you have a lot of developers in your environment, some can accidentally bring the code with them. Gen AI can now create totally believable videos of a CFO giving an instruction to transfer millions of dollars and their own teams will believe it. This is the future of cybercrime. 

5 Good questions every organisation should ask themselves when assessing their readiness.

• If we were interviewed by regulators tomorrow, who knows what in our organisation about our data and IT Infrastructure?
• Are we too dependent on one third party data host? If yes, what are we going to do about it?
• How much training will our board need to be fully up to date and therefore compliant?
• What’s the plan in case we are hacked?
• What are the financial consequences of non-compliance with DORA?