MITIGATING CYBER SECURITY THREATS TO DEFENSE AND FINANCE SYSTEMS AND INFRASTRUCTURE

Thank you, Ms. Beckham. I appreciate you being with us today virtually. They're not allowed to fly with Microsoft yet. Mr. Surjit Mahant, he's Managing Director of K2 Integrity and the Head of Cyber Risk Management Services. Thank you, sir. We look forward to hearing your remarks. Good afternoon, everyone. First and foremost, I want to thank Congressman Pittenger for having me here. Thank you to Alejo Campos for an excellent reception. And it's a pleasure to be here and speaking on the back of such eminent dignitaries and esteemed panelists. I'm here to present on the back of what my panelists before me said, more of a practical, pragmatic and a practitioner's approach to cybersecurity. So as part of my work, I reach out to public and private sectors equally and understand the issues that concern them most in the cybersecurity area and areas of risk. And one of the things that we have noticed overwhelmingly is the quantification of risk, the understanding and appreciation of what risk really means, how that gets translated in a cyber focus, and therefore, you know, what is the required effort to go behind it and, in fact, address it. And most of the organizations generally struggle with being able to understand what is the gravity of the risk in terms of the cost of remediation versus doing nothing. But when it concerns national security, doing nothing is obviously not an option. Even otherwise, in the private sector, for example, doing nothing could very well be the difference between staying in business or shutting down. I very much compare that to the vaccination and the pandemic. And you'll probably hear a lot of analogy in my next couple of minutes of dialogue when it comes to the pandemic. You know, it's almost like the you have a choice to take it for whatever protection it can offer or do nothing, which is really expose yourself. In terms of the domains that some of the people before me have spoken about, you know, we really look at it from three perspectives, the external threats, the internal threats, and the systems themselves, right? So it seems to form somewhat of a trinity of sorts. You know, when you talk about external, internal, and systems, you talk about confidentiality, integrity, and availability. You talk about people, process, and technology. And the trend there is it almost seems bucketed in certain ways. And one of the major challenges that the world is facing today, you know, in terms of being able to address these risks, is the silo nature of looking at it. There is a theme developing here in the conversation about building bridges, transparency, sharing information, collaboration, which is fundamentally so important because the technology is there. Like the panelists before me, Scott mentioned, you know, if you all have the power in our hands in terms of the technology and the speed and processing aspect of it, the information is out there. So how do you connect the dots? And what are those dots that need to be connected? Risk assessment, I feel, you know, is underrated in certain ways. And it needs to be evaluated in a much more deeper manner. The guidance that has been put out there from several organizations internationally is excellent guardrails to stay within and address it. But you cannot mistake compliance for protection. Protection certainly has to go deeper than just compliance. And I feel that these silos that have built over time in terms of the departments not having the ability or the vision or, you know, just not having enough bandwidth to be able to share the information is going to be critical to how it plays into the overall approach and how far-reaching the effort to mitigate and remediate those risks is concerned. You know, being here in Panama and looking at the Panamanian, the Panama Canal, you know, it kind of gives me the thought of bridging that gap, bridging the gaps between the silos. A fraud team in an organization needs to be talking to the cybersecurity team, and maybe in the quest of explaining this, I'm kind of venting a little bit, so you'll have to excuse me on that. But these are the tactical problems that a practitioner faces, and I think, you know, there is enough gravitas in this room to be able to change those things, to be able to get the visibility that is required, the appreciation, like I said, for the areas that need to be addressed. You know, in terms of, again, using another analogy of the pandemic, you know, over the last two years, we have grown to sanitize everything that we see within reach, and, you know, it has to be taken down to the third-party vendor risk management program, for example. The riskiest aspect of the enterprise is at times, and it's proven statistically, it lies mostly with the endpoints, the connections that you have to the outside world, and they are either your vendors that you deal with, you know, we spoke about China and we talked about buying equipment and all of those things, but it doesn't even have to go that far. You know, on a day-to-day basis, any given organization has hundreds and thousands of vendors that they deal with, and those could very well be your weakest link. The vetting process for vendor management, the vetting process from a cybersecurity perspective, particularly the due diligence that needs to be done, has to be an extremely important aspect of how cybersecurity is being addressed. Today, with the work from home, I think the attack surface for cyber has grown exponentially, and the digitization, as expeditiously as it has happened, it has opened up a tremendous amount of volume to be protected. Every endpoint is connected. Lateral movement, as we call it in our lingo, is essentially exposing every device, not just your home, not just your network that you work on internally, but externally exposing your organization just by virtue of having that capability of being able to connect from wherever and getting onto the corporate network or enterprise network, and when you are a public service employee, you can just magnify that multifold. The other aspect that I think is critical in the effort to strengthen cybersecurity is a culture of compliance, and by the culture of compliance, I mean more so in terms of awareness, and the awareness needs to be taken down to the individuals. Every single person needs to be aware of what cybersecurity means, what risk there is in being able to expose yourself, put yourself out there, whether it's the social media, whether it's Facebook, Instagram, Twitter, or what have you. We have grown, and generations to come are going to be native to this technology. I would urge my esteemed people that are in positions of power to even think as far as having cybersecurity as a part of the curriculum, because if a person, if a two-year-old is out there browsing cartoons, that is eventually a threat to national security in some ways, if you think about it, because there is a certain amount of exposure that everyone is carrying with them. It is extremely important to look at the ground reality of what we are dealing with. The ransomwares of the world, the business email compromises, the corporate espionage, and the state actors behind it are doing much more sophisticated work at a very, very grassroots level, and to be able to tackle that, we have to apply every technique that's in the book, and I don't believe, you know, or rather, I do believe very strongly in the technology capabilities that are out there, like the person from Microsoft just mentioned, you know, every organization is doing a tremendous amount of work in cybersecurity to help us protect ourselves, protect the environment, protect our organizations, and eventually protect our country at large, and the world, and we all need to take that into account. One of the things in terms of the expeditious nature of digitization is the fact that there is a misnomer about the cloud. It is the fastest and easiest way to upload your pictures or take your organization from a server under your desk to something that is much more connectable internationally from anywhere and just have things in the cloud, and it is almost, you know, an assumption that once you're in the cloud, it is the responsibility of the cloud provider, like a Microsoft or an AWS or someone else, Google for that matter, and to some degree, there is inherent protection, but there is more that needs to be done, and just like, you know, if you're sick, there's no shame in going to a doctor, there's no shame in being able to assess yourself, in being able to do a penetration test, for example, on the organizations, to expose the vulnerabilities that might be there, to expose any weak points that might be there in the organization to be able to then successfully address them and create a solid, full-proof environment, and I don't think it's difficult to achieve. The only difference is that it's not a one-time aspect. It's a continuous journey that needs to be taken into account. It needs to be updated. It needs to be upgraded, and 90% of cyber risks for the enterprise can be resolved with very little effort, but a dedicated attention and a continuous effort to be able to mitigate everything that's within reach. The anomaly detection, the transaction monitoring, things that came up during the course of this discussion are extremely important and extremely achievable at the same time. Data, which is the holy grail of everything, a lot of times, the first question that I end up asking the people I work with, the organizations that I come across, is do you know where your data is? And the question, unfortunately, is not an overwhelming yes. Knowing where that data is within the infrastructure, knowing where those pockets of information are, knowing what is sensitive, being able to classify and therefore protect them adequately, I feel is extremely important. These are all the proactive aspects of it. Incident response these days is getting better. What we saw with the pipeline situation and the fact that there is recoverability even with the ransomware payments is very encouraging, and I think with the effort, with the joint effort of the public-private sector, with the ability to collaborate, with the ability to share information, meaningful information, that is really going to help across the board, all avenues and all areas, all sectors, regardless, to make this world a better place. I strongly believe that we can achieve it, and I think this is a great forum. Once again, thank you, Congressman, for having me here, and I'm happy to take any questions. Thank you.