In the spirit of partnership: insights from the first Cyber Security Tech Summit Europe in Bonn

Cyber Security Tech Summit_1

Source: Cyber Security Cluster Bonn e.V.

The very first Cyber Security Tech Summit took place at the World Congress Center Bonn on March 13-14, 2019. This summit was hosted by the recently founded Cyber Security Cluster, an interdisciplinary network of players who want to make the world a better place in terms of cyber security, including Deutsche Telekom, the Fraunhofer Institutes FKIE, IAIS and SIT, the Federal Office for Information Security (BSI), and many others. They could hardly have been more diverse, which leaves no doubt about a key point: security affects all of us, whether we face it or close our eyes.

Modern arms race

This point is taken up again and again in the lectures following the introduction. One cannot help getting the impression that an accelerating arms race is underway, with potential attackers such as highly organized and interconnected criminal organizations. After all, they have a significant advantage: they determine the attack vector – and the timing. Endless possibilities of defending network perimeters and identities on the one hand mean exponentially growing possibilities for hackers on the other. Dirk Backofen, chairman of the Cyber Security Cluster and head of Telekom Security, confirmed this by talking about a recorded peak of 32 million attacks in a single day, just recently. On average, they record 24 million attacks. Two years ago, the average was around 4 million.

These figures are impressive. The full scope of the topic was underpinned by a number of interesting keynote speeches, for instance by the CEO of Deutsche Telekom, Timotheus Höttges, the CEO of Graphika, John Kelly, or the cyber security researcher Keren Elazari. Especially helpful was the reminder of some “worst practices”, which illustrate what the topic of security really is about; an example is the recently disclosed case of a medical technology manufacturer whose interconnected pacemakers were shipped with fundamental firmware vulnerabilities for over 18 months – with the manufacturer being aware of this fact. We can’t even begin to imagine the possible use cases here.

Hackers are collaborative and innovative – we can be, too

Especially in the panel discussion with representatives of Vodafone, Telefonica, and Telekom, it became apparent that the never-ending trend of growing danger from cybercrime is driving companies to rethink their strategies; even providers used to fierce competition are increasingly entering into partnerships in this segment to support each other and their customers. The key message is: regardless of industry, company size, market share, culture, or whatever other differentiators, when it comes to security, competition comes second since the attackers don’t really care about it either. So why should we?

Cyber Security Tech Summit_2

Source: Cyber Security Cluster Bonn e.V.

Information is essential. It has become clear to some extent that the balance between the paradigms of “everything that can be interconnected does not necessarily have to be interconnected” (as the president of the BSI, Arne Schönbohm, among others, emphasized) and “everything that can be interconnected will be interconnected” has not yet been fully found. Sure, there is some awareness of the fact that security measures have not been keeping up with the speed of networking, but on the other hand, networking keeps accelerating. The general consensus is that IoT security in particular continues to be a major challenge that has not yet been solved satisfactorily.

It is not only the telecommunications companies mentioned above, which are stepping up investment in cyber security in an effort to protect sensitive data and systems as solution partners for their customers, that make clear statements about their solution approaches of choice. Companies such as Microsoft, IBM, Cisco, and many others who were present on stage or at the numerous exhibition booths also stressed that they intended to master the challenges by means of cloud and AI; the latter term was used particularly often, although in most cases it actually referred to “machine learning” as an enhancement of automation concepts.

Security must not fail because of a lack of adaptability. In the future, users will have to know more about their options than ever before. While the comprehension of security matters is growing, comprehension and the resulting actions are not always in sync.

Due to resource constraints, today’s attacks can hardly be managed on-premises, as companies’ networks have become too complex, the identities – as the new “perimeter” – too fragmented, and the attacks too massive. DDoS attacks with a force of more than a terabit per second speak a clear language here. And detection through networks, which don’t lack any complexity, cannot be carried out manually, either, so users will profit from self-learning security tools in the future. This will be the focus of technology providers, who want to equip their customers with as solid a defense as possible – now and in the future. Microsoft, for example, recently launched Azure Sentinel, a machine learning-based tool for the detection and prevention of possible threats.

A brief look into the future

The event focused primarily on one key point: providing a clear signal that cyber security is gaining in importance, as is information, and that good partnerships and scalable solutions will be much more effective than fighting alone on a small island.

The Cyber Security Summit claims to be nothing less than the “Davos of Cyber Security” – named after the venue of the annual meeting of the World Economic Forum. Although they are not quite there yet, the foundation has been laid and the direction is clear, so we should keep an eye on the event as an important date in the coming years – or in the calendar application of choice.