Translator: Michele Gianella Reviewer: Nicoletta Pedrana
Have you guys ever seen
a 100 vs. 1 soccer game?
In this crazy Japanese experiment,
100 were kids and 3 were adults;
but in the world of cybersecurity,
the attackers are 100 against just one defender.
It's a much more unequal story, an absolutely unfair comparison.
The history of cyber security, of information security,
is a relatively recent one,
we are talking about the last 20-30 years at most;
its golden era in fact is still to be drawn
and will probably be in this decade.
But the concept of information security
and data security
is in fact as old as human history.
We've evolved from a phase where we eavesdropped on conversations,
and needed to be physically close
to the person we were going to eavesdrop on,
to a later stage
where writing was invented
and messages could therefore be intercepted,
to today's surveillance capitalism,
where we can theoretically listen in
on any conversation from our room.
What has changed throughout history
is the range of our ability to intercept.
The problem with cybersecurity
is that we can't visualize it:
the best that the cream of Western journalism,
that Hollywood
has been able to come up with
is this stereotypical image
of a pimply, nerdy kid with a hoodie,
who is able, from his room,
to hack into all the world's possible systems,
so if we could only find that single kid
we have solved all the world's cybersecurity problems.
If you try to understand a little more in detail
what cyber security actually means,
try to make this effort of imagination.
You're in Iran, it's 2008,
and you're in charge of the country's nuclear enrichment program.
You're in your room.
You have all your parameters under control.
Still, every month, periodically, the program fails.
Nobody can explain why it fails;
but this happens for a reason,
as what really happened in 2008
in Natanz, the Iranian nuclear power plant,
is that somebody infiltrated the plant
and infected, probably with a USB stick,
the systems of the plant
in such a way that they were able to do a single thing:
slow down, every 27 days,
the rate of rotation of the uranium enrichment blades
for 15 minutes only.
And you will say: haven't the engineers ever noticed?
No, they didn't notice:
they couldn't possibly have,
because the other thing that this malware did,
which went to history as Stuxnet,
was to loop a video
that showed that everything was under control.
So you understand that there are several issues with that.
What precisely has changed, throughout history,
is that there have been other countries also -
for example Russia, moving a little bit further north -
has often used Ukraine throughout history
as a sort of Test Field of their cyber weapons.
In 2016, during the Crimean War, for several days and close to Christmas,
hundreds of thousands of people in Ukraine
were left totally in the dark, in the most total blackout.
Home refrigerators didn't work, schools didn't work.
And what at that stage somewhat saved Ukraine
was that its level of automation, as a country system,
was not yet that advanced.
Because what's new is, that in the 21st century
being technologically backward can be an advantage;
disconnection is an advantage over -
for once, we can say
that the more technologically advanced economies
risk the most.
Let's take a step back.
Cold War.
The world is governed by the acronym "MAD" -
mutual assured destruction.
What does that mean?
It was the reason why no one, either in Moscow or in Washington,
had the courage to push
the famous red button of the nuclear warheads,
because everyone knew
that would have triggered an attack from the other side
in an escalation that, in many people's fear,
would perhaps even have led
to wipe the human species off the Earth.
What's different now?
Today is no longer -
These extremely destructive technologies
no longer only belong to the world's great super powers:
a whole series of players, actors have entered the market,
even some very small ones.
Not sure if you know this movie:
it's a 2014 film, called "The Interview"
where James Franco mocks of Kim Jong-Un,
the president of North Korea.
Understandably, in Pyongyang they didn't take it very well:
so much so that within a few days
70 percent of the corporate computers at Sony,
which was the distribution house for that American film,
became unusable:
Sony employees were forced for weeks to use pen and paper again,
instead of sending emails.
And if that happened with an attack started from tiny North Korea,
imagine what could obviously happen on the world scenario.
Historically, however, espionage has always been
a matter of both expertise and money:
you can steal the designs of an American aircraft carrier,
but then you still need to have the finances to build it.
This cost is totally zeroed in the digital world,
as we have seen with the attack of the Shadow Brokers,
which are a bit the equivalent of Banksy applied to the world of cyber security:
an anonymous reality
that has managed to enter America's National Security Agency,
and effectively steal all the world's cutting edge cyberweapons,
the most sophisticated ones,
and then put them on the market.
Yes, the market.
the market is extremely deregulated:
consider that even in war there are rules.
According to the Geneva Convention
you cannot bomb civilian hospitals,
even during a war.
You cannot bomb them:
but you can cut off their electricity,
you can steal their medical records.
This whole digital part is absolutely not regulated.
Now, there are then other ways to wreak havoc
in the digital, cyber world.
For example, with artificial intelligence.
See this stop sign
with little patches on it almost imperceptible to the human eye?
The AI that drives self-driving cars
does not interpret it as a stop sign
but as a 45 kilometer per hour maximum speed sign.
Now you understand what this, in a soon-to-be world
where most, or at least a good share of cars
will go self-driving,
can create in terms of disorders,
in terms of potential chain accidents.
The problem with AI
is that the tweaks to fool it are unintelligible to humans.
Take this other example, this cute picture of a kitten.
The neural networks behind AI algorithms
actually as you see
all agree to label it as a kitten.
But what happens if we go and apply a small adversary perturbation
created by a cyber attack?
That this network that we have added here
and that is totally invisible to the human eye
actually causes neural networks to mistake a kitten for an ostrich.
Now you understand what this can bring obviously on a global scale.
Speaking of deregulated market,
one of the examples is zero days.
They're unknown vulnerabilities
that are discovered by hackers for the first time
and are often resold
to the same companies they were discovered in.
For example, Chaouki Bekrar, a very famous hacker
has created a few years ago a company called Zerodium
and has published in a rather bragged way
an online price list,
organized very nicely, by the way,
as a periodic table of elements
where each vulnerability
is paid as a reward to the hacker who found it,
one million dollars for WhatsApp, for example,
and up to two million dollars for an unknown iPhone vulnerability.
So you can see, it's a pretty rich field.
We noticed how rich it is also with ransomware attacks,
where you enter into a system, encrypt all the data
and then ask for a ransom
to give back the key to get their data back.
On average, an attack of this kind
earns the perpetrators some three million dollars
and some possible targets
can be colleges, municipalities, regions, private companies, gas pipelines -
as recently took place in America.
And it's not always easy to tell the good from the bad guys .
Because for example,
the companies that do these ransomware attacks
in some cases have ethical principles:
for example, they don't attack hospitals or ngos
and in some cases, they even give part of their earnings to charity.
Another types of potential attack is for example phishing.
Phishing is also a malicious and fraudulent activity
that for example sends you messages
where you pretend to be your banking systems
and you are asked for your credentials
to get in and obviously be able to steal your finances or other things,
and consider that this type of attack
does not only concern functional or digital illiterates.
One out of two credit cards has been cloned in the US,
and not just John Doe's, even Mr. Barack Obama.
Now we are aware
that we are only at the tip of the iceberg.
Also because the first rule in the world of hackers
is, never talk about hacking.
But a structural problem emerges
within the great centers of innovation,
for example in Silicon Valley.
One of Mark Zuckerberg mottos
before the recent turnaround towards the world of the metaverse
is: move fast and break things,
Precisely the opposite
of what a good cyber security consultant would advise;
the opposite, probably, of what common sense would suggest.
The result?
Half a billion Facebook accounts were hacked.
Now I realize that it is hard to make predictions -
especially about the future, as the Danish physicist Niels Bohr said,
but there's something shown by phrases like this:
"No one will ever need more than 637 KB of memory in a computer."
A sentence pronounced exactly forty years ago
by a gentleman who, before making money with vaccines,
would indeed sell some computer,
Mr. Bill Gates.
But despite this I still dare to bet
because it is a really very easy bet:
Cyberattacks will increase over and over again, exponentially.
It's a cheap bet because we are in the IOT - Internet of Things - era,
which in cyber security
is also known as the Internet of Threats.
Now, after this little excursus,
you might have guessed it's not a worrying scenario,
it's really a terrifying one.
So we come to the part that perhaps interests you the most,
the most hopeful message:
How to protect ourselves?
We have to sort among three categories:
companies, country systems and individuals.
A good way for companies is to start
with what is known as the "Assumption of compromise":
Build it like it's Broken.
Since it's very likely that someone will break into your systems,
a wise way to build it is to create watertight compartments
you can't jump across during attacks.
If you have to enter in a submarine,
and sooner or later
this submarine will enter the water,
it is good to isolate that part
and obviously secure the crew.
For country systems, it is more a question of investment and political will.
We were talking about the Geneva Convention:
the Geneva Convention was signed in 1864,
it is more than 150 years old,
Updating it today
in an era when we are connected for five to six hours a day
is not only our right,
it is our precise duty towards future generations,
just as it is our duty, a necessary gesture of civility
not to leave the famous defender alone against 100 attackers.
And finally we get to the personal level.
In the meantime, remember this very simple piece of advice
that refers to an acronym: 2FA, two-factor authentication,
which is what allows you to verify
that actually,
what is entering right now
from your home computer into your banking
is actually you
through a double check, a double check on another device,
trivially on your cell phone.
Then I realize that it's hard, in the 21st century,
advise someone to digitize less;
but at least we try to digitize better,
or better with more awareness.
It applies to the Internet in general,
also because, for the first time in the history of mankind,
not only our systems,
but our minds have also become hackable,
as stated by the Israeli historian Yuval Noah Harari.
And here I'm not talking about Elon Musk brain probes
or Neuralink,
I'm talking about something much more basic: our freedom of thought.
o here forget about the kid in the hoodie
and let's focus instead
on what could be the real culprit -
algorithm systems.
According to a 2015 Cambridge University study
70 likes are enough for an algorithm to know you better than your friend.
With up to 300 likes,
the algorithm knows you better than your partner,
your wife, your husband.
So the question you have to ask yourself is,
how many likes does the algorithm need to know us better than ourselves?
If you're clicking on an image of a shirtless man in an advertisement,
rather than a woman,
you give information to the algorithm
that maybe even you don't know you know or somehow agree to know.
And this applies to our sexual preferences,
but also to other inclinations
that are covered in any case by the bias of our prejudices.
Therefore, and I'll close here,
in addition to the information at risk of being stolen,
which is my actual cyber security business,
be very careful about the information
that you deliberately choose to share
and give away to algorithms.
Because in an age where not only our properties,
but our very identity
has never been more digital,
defending our data online
is ultimately about defending who we are
Thank you.
(Applause)