Full Transcript for Episode 56 - Cybersecurity Training, AI Governance & Modern Threats with Thomas McCarthy

back and forth. I don't know enough to know. Well, I know a little bit more than you know, which is not a lot. As I said to you before I came on, I am I am by no means an AI expert. Learning every day. We are using a lot of AI tools right now within the delivery of our training mats and using the animations to make the experience more realistic. I've listened to and we hosted quite a few AI experts just recently at an event in Aberdeen talking about machine versus machine. ⁓ and and actually a Spanish lady who's a who's got a doctorate in matha in ⁓ mathematics and a huge AI guru, she's anxious. about where AI is going because of the lack of control, the ability to control. And I don't I don't scare easily, Matt, and I don't always listen to other people's rhetoric. But I think this is something we need to pay attention to. I really do. That because of the pace of development, I think that's one of the biggest concerns. Every day it's evolving tenfold, twentyfold. You know, whereas The industries that we come from or that we're aware of, especially in oil and gas, it took ten, twenty, thirty years for technology and expertise to evolve. AI is evolving every twenty four hours. What concerns me the most is the lack of coordination between countries where if you have a military reason to create AI faster than your adversary, if it's just not military, but you have national security reason to, what is the incentive to cooperate and put voluntary guardrails on? So just think about, you know, China versus the US versus other countries. If one doesn't do it, then nobody does it, and then it just becomes a bigger issue that then becomes uncontrollable. Yeah, you know, it it's a bit ironic actually, and we won't we definitely won't go into politics, Matt. But as you know, the newest Prime Minister of the United Kingdom, Andy Burnham, was just in at the UN, making his maiden's maiden speech out at the UN. And I would say one of the two things that I took from Matt was his acknowledgment. of his concerns and the UK government's concerns about the lack of control over AI and this new arms race that we're now witnessing. ⁓ and obviously the superpowers like America and China, maybe not quite so much Russia anymore. Ukraine. Ukraine are of the dark horse when it comes to AI. And we see that with what they're doing and how they're surviving this horrendous war. So I think that ⁓ the superpowers definitely won't collaborate. It's impossible for them to collaborate because it's just not in their DNA. You you look at You know, how aggressively, ⁓ the American governments are aggressively as in looking to develop capabilities around AI. I mean, it's a huge commitment that America's made around AI with the collaborations in the Middle East. So I think that it's the collective that probably will win the day, that will have the upper hand. The more that are working together, the likelihood we have of being wiped out by mankind. Never mind by being wiped out by the AI,

you know, but I I just don't see it conventionally it's never happened in modern warfare, has it, where the adversaries have collaborated when things have settled. So I don't think we'll see that level of collaboration but ⁓ there's definitely a concern globally about how do you control something that's uncontrollable? Right. But it is uncontrollable. The evolution. I've tried with my wife for twenty years and it's not working, so You're the brave man. She doesn't listen. It's fine. But you don't get us in. Yeah, yeah, she does. Exactly. So talk to the listeners a little more about the OSP Cyber Academy too. So who attends? What are the modules? Like ⁓ you know, obviously cyber is a really important thing that people have to learn about. And ⁓ you know, you guys are doing a wonderful job of teaching people around the globe. Yeah, for sure. Well, as I say, we were incorporated back in twenty seventeen. In the advent of the implementation of the latest data protection regulation, which was GDPR, the general data protection regulation, we were still members of the EU. And as a collective company, we wanted to provide knowledge and and training around the management of and the implementation of GDPR. So our chief training officer Richard Priest, a former Lieutenant Colonel in the in the UK Ministry of Defence, he's the architect of all of our courses apart from data protection now. And we came up with the first assured and certified training course that was certified under our GCHQ, a bit like ⁓ your NSA, with a certified scheme. So we started rolling out training around data protection. And obviously within the technical requirements of some of the data protection regulations. You've got to have more knowledge around cyber. So we added on the cyber resilience training. GCHQ handed over to our National Cybersecurity Center, who are the police authority for cyber basically in the UK. We then aligned ourselves with their training scheme and we've continued to add assured training course content. We we led with the board course, Matt, because if your leaders don't understand where the risk is and what their appetite should be, then they're not really going to take it serious enough. And I think this is one of the challenges that you have in the US and it's no different globally. If the decision makers that who are ultimately holding the purse strings don't understand what the impact to the organization is going to be around the catastrophic capability of a of a data breach or a hack. You look at the challenge I think America's can pride themselves in being the first country to actually imprison a CISO. The CISO from SolarWinds was given a jail term. Because of his obviously lack of ability to to do what was necessary of the CSO and that and that really sent shockwaves through through the cyber industry. So we've addressed all of the the major concerns and challenges of organizations, whether it be through fishing, smishing campaigns, we make short courses to address these elements. we've got more comprehensive courses around regulation. So data protection is a huge thing in the UK, Matt. ⁓ We are really governed by data management, data controls, you know, for people's personal data. So data protection still has a huge sort of ⁓ control over how organizations manage data. So we really spend a lot of time and you met Irene Coyle, 30 years ex police, actually implemented the GDPR within Police Scotland's recruitment function. So joined us when she retired. And Irene's been instrumental. in developing and growing our capabilities up to this day. Then of course, last year, people started asking, what are you doing about AI? As I said to you earlier, we are not an AI training provider or an AI technology provider, but we understand regulation. So we looked at what the compliance obligations were. In each country, under their own mandated AI strategies, and we've created AI governance training programs for leaders, for the general workforce, for people that are at the coal face that are using these tools just to better educate them. But also, Matt, to tick that compliance box because if you're a regulated organization, whether it be in finance, whether it be in healthcare, normally you'll be regulated by your own industry to demonstrate that you are educating your workforce. And if you're not educating your workforce and God forbid you have a breach, then the regulators come down on you much harder. So, you know, we are making sure that we're providing training that's fit for purpose. It's quite a mouthful to give you. It should have been a an easier answer, but that's pretty much it in a nutshell for now. How do you find boards now? ⁓ do you find them to be more cyberliterate than they were I obviously more than twenty seventeen, but are we getting to where we need to be? I would say that the public sector is paying more attention because the public sector don't have the same budget for technology and defence. And we're working right across the UK with the Cyber Centre of Excellence, which is a cyber authority Which was established specifically to support the public authorities throughout the UK. And we've been rolling out the board course for leaders in most of the councils in the UK, just to really give them give them the information in simple terms. Because they're not technologists, they're business, you know, they're leaders in most cases, and they've got 101 different things to to focus on. So we tend to try and just give them that that knowledge in a scenario based exercise that makes it more practical and more relatable. But I would say the boards are definitely paying more attention, especially and I come back to the regulated industries, especially finance. We now have Dora, which is a new regulated compliance standard for the financial services sector. Richard Priest is doing a lot of training and education, especially in the city, around Dora. So yeah, I would say that it's it's

still a journey, Matt. There's still plenty to do, but people are definitely more cognizant of the fact that, you know, they are at risk and mandated in companies house in the UK. If you are a company director, you have a responsibility as a director to ensure that your company has the necessary cyber protection or at least understands the risk. So there's more obligation being driven, I would say, than there has been before. If you were a company today, what would be your top two or three concerns? For me as an organization, is just how secure is my network because everybody is working in front of these things. Mm-hmm. You know, and and more and more, Matt, since lockdown, we're all working from home. Yes. The office space in Aberdeen alone is mind blowing. This used to be the old capital of Europe. Every other office building is empty. You know, it's not as efficient anymore. So for me, bring your own device. What are people doing at home? How are they linking on to the network? Have we got the right network security solutions in place? Are we educating them regularly enough to make sure that they understand there's a new threat out there? Remember, we've got standard operating procedures you must follow. Don't click on anything that you you're not sure of. All that kind of good stuff. Say for me, first and foremost, Matt, to answer your question, network security. And you remember we're not a technologist, so I'm saying this independently a as an individual, first and foremost, because all of our team work from home. So network security. We use a device that was created in America. It's used by all your agencies. It's called AppGode. It's a a a colossal piece of kit. And again, we've got no reseller ⁓ rights to it. So I'm I'm telling you that as a as a young user. And I constantly get notifications popping up to say that it it's just blocked an attempt on the network. So yeah, network security first and foremost and, you know, more communication with the CISO. The CISO now is is like health and safety was at its height. The CISO is somebody that needs to be taken serious and needs to be given respect in the boardroom. I ⁓ had Joe Sullivan on not too long ago who was Actually the CISO got that got charged many years ago. And one of the things that he said, which I thought was interesting, was the CISO is in his view the toughest job i after the CEO, of course, because it's the only job in which adversaries are every single day attempting to destroy your entire organization and you have to defend against it. There are a lot of people on the board that sit there, take the paycheck, and contribute insignificant amounts compared to the CISO. CISO burnout is actually a term in the UK right now. I see workshops all the time by various different therapists running workshops for CISOs to ⁓ help them better understand how they decompress, you know, how do they manage. CISOs probably are one of the few people that don't know or don't enjoy ⁓ giving out responsibility, you know, because all the weight falls on their shoulders. I I know a lot of CISOs that are so overworked and stressed like you wouldn't believe. And it's not a job or a title I would be happy ever taking on on board, that's for sure. Full respect to the CISOs, Matt. ⁓ my gosh, I wouldn't want that job. No, no, ch no no way. ⁓ I agree with you. One of the things that's interesting to me too is we continually talk about all the improvements that we're making ⁓ technologically, but the remaining key sort of potential area of compromise is the human element. And It seems like it hasn't changed much over the last decade, two decades. How do we improve that? I know you guys are working hard to improve it. Like, what do we do if it's still always going to be human that we're going to exploit? And when you look at some of these bad actors just doing social engineering, they're even bypassing, you know, any ⁓ sophisticated sort of zero days and just like, I'm just gonna trick them into giving me the keys of the castle. And isn't that a shame? It really is. It's a common theme that's that you could probably acknowledged throughout all industries over the last one hundred years because it's all about greed, sadly, Matt, and that's what I put it down to because you know, leaders of organizations are trying to become more profitable. They're applying more pressure because the shareholders are want to see better returns. So the human element sadly doesn't get the acknowledgement it sometimes deserves. Very, very few people are acknowledged in their own right that the way they should be, because it's the organization. They are just a little chain in the cog. You know, ⁓ people should be given more acknowledgement, I think, you know, they should be embraced more. More so because we're all working away from home now, keeping people together as teams, really making them feel important and and and a part of the team. You met young Blair that joined us from university. Can you believe this is his eighth year with the company and for only s five months of it he worked in an office before lockdown. So you can just imagine there's a young man that started out his entire career working from home. He's never had an office based job, but very competent, very capable. He wears multiple hats for us, you know. ⁓ he's a very confident young man. He goes all over the world with us. As you know, ⁓ we were in Bahrain last year, Dubai last year. Blair comes with us, he travels, he you know, he he's he's good at mixing with people. And it's really important that you take the, you know, people on the journey as much as you can, that you that you recognize their contributions. I think that's sometimes that gets forgotten about Matt, you know. But it's an interesting thing. A phenomenal CISO. He's now the CISO at ⁓ Anglo America. And he was actually a CISO here at an oil company. And he was a great mentor to us and gave us some huge support. He did a presentation at

one of our events and he he stopped the audience with a statement he he repeated three times. Behind every cyber attack is a beating heart. We all just looked. Behind every cyber attack is a beating heart. And the third time he said it, it resonated. And you know, he's absolutely right that people are still in the loop. It's all part of this activity. AI hasn't completely taken over that that role yet. So we need to pay more attention to our people, you know, do things outside the business. Matt, who doesn't love a a round of golf? The people can't play well. That's me. I still do it, you know. So yeah, you know, we need to pay more attention to our people to you know, to the to their welfare, you know. It's hard to motivate yourself, you know, especially if you're not going into an environment where you're feeding off people. You know, ⁓ there are very few people, as you well know, that can self motivate. So ⁓ yeah, it's something that people need to pay attention to. How how much does that worry you long term, the change in dynamics and just human interaction where you're not s centralized and working together, but it's more fragmented. Like I I think about my career and I really enjoyed going to the office and seeing people and I fed off of that. And it is harder And I spent a lot of time on the road and I spent a lot of time, you know, basically meeting people because that's what drives me. But if you don't grow up in that environment and you your entire sort of knowledge of work is working somewhat in individual silos physically, maybe not as a part of a team, but like physically, you can't go and go to the water cooler and talk to people about, you know, whatever. That concerns me long term, but just about the health and well being of people because people thrive, other people, do they not? Yeah. A hundred percent. Matt, we we are both people, people's me and you, you know, we're people's persons, as we know. I I love nothing more than engaging with people, taught martial arts for nearly thirty years. So I love being around people. It's part of my personality. ⁓ it it really I need that fix. The whole dynamic has changed. I think that's why there's been such a reassurgence in in these these events that we attend, Matt. We're seeing them being picked up again after lockdown. It was quite a slow burn. But some of these events now, just because you're getting the opportunity to meet like-minded people, to talk about with your peers about the challenges, you don't get the same response online. I was on a ⁓ webinar half an hour ago, man, and there were 40 technologists, CNI leaders on it. It was a great webinar. Some of the people very highly respected. It's still really hard to engage because you even now it's a bit different because this is a one on one, but you know, you need that interaction. I worry. I've got two grandsons, five and eight, and the five year old comes to my house to see me and if he wants the channel on, he he picks up the remote and he knows exactly how to put the T V on. You know, and that's at five years old. I couldn't even tie my shoelaces at five years old. So think about the evolution, Matt. Think about the evolution. It's a concern. It's a concern. Yeah. A real concern. Are we passing on the same skills that that we that we inherited? I don't know. I don't think so. And that is a concern. You know, I th I I think some things are overblown, like penmanship. I can't even have my own handwriting. So my son's fifteen and his handwriting's worse than mine, but well, okay, fine. But how are you going to interact with people? How are you going to understand social norms? Things like that. I just don't know how that's gonna play out. And you know, this is one of the consequences of lockdown, to your point, is businesses realized it probably would save us money to not have that brick and mortar office space. And then people also were like, well That was kind of cool that I just got to work in my pajamas for two years. I don't want to go back. And now we're in this odd scenario, which again creates those potential risks for cyber attacks because you are much more fragmented. You can't control your infrastructure as much. And people are mixing business with pleasure probably, you know, all day long. And it'll be interesting to see how it plays out in the next three to five years. Yeah. As you know, Matt, we've we've both spent a lot of time i in the Middle East and w we actually incorporated there last year in Russell Kema in the UAE, you know, as a part of our own growth strategy. And I have to admit, witnessing the conflict that's gone on in the region and the way that the Cyber Council especially have averted so many unbelievable attacks on their infrastructure because they had the ability to do so, because they didn't have the restriction of resource that most organizations we speak to, Matt. The one reason why they can't take on extra capability is because of resource, financial resource. And I think this is now being demonstrated in the region za as an example of what can be done if you're given the correct resource and also having the right people around you. And you know, they embraced massively c very quickly getting back to a normal society after lockdown. ⁓ and and I see that and I witness that every time I go to the region. ⁓ we've spent a lot of time these last few years in Saudi, in Bahrain, right across the UAE. And I have to say there's a different approach to life in the Middle East. There's a lot to be said for it. A hell of a lot to be said for it. from a positive perspective because, you know, society is so much more integrated. Doesn't always ⁓ sort of balance out the way we live our lives. But I just feel there's more engagement and I think we need to figure out how we can bring more engagement into society ⁓ rather than just social events. I don't mean going to the football, I don't mean going to baseball. I mean just getting people, you know,

coming together. And and I think do that socially and it might it might actually blend into what we do professionally. I'm I'm at the the end of my shelf life, Matt, so I f I I only have few more years to worry about, you know, you've still got a a good couple of decades in you yet. So We'll see. Yeah. It it is a thing where when you know people, you feel more comfortable calling them and asking for help or getting guidance. And if you don't know them, you're much more reluctant to do that. And how do you get to know people? It's those off hours. It's having beers. Those are the kinds of things, especially now, you know, you look at the conflict with Iran and what's going on with ⁓ Russia and Ukraine, and you can see that unfortunately the CISOs are now on the front lines of war. You know, if you're in critical infrastructure Like you're no longer just making sure that you can stay operational from a business perspective. You have to worry about nation states attacking you. And that is a really challenging thing, especially in some countries that don't provide the level of support that they probably should if you're being attacked by a nation state adversary. Yeah, and obviously most of our country not not too dissimilar to yours, we've got a great infrastructure from the different agencies that are there to support the business community. They're overstretched. They don't have the resource that that's necessary. Budgets are getting cut right across the economy right now, in all services. So it's really hard to identify where is your money be best being spent. This is a whole new different type of warfare, Matt. We talked about this years ago. It it is a different type of warfare and the resource needs to be spent more on the cyber capability and less on the tanks and bombs and planes because war well, you can see that now, by the way, in the conflicts are utilizing drones on unmanned, you know, aerial devices. The cyber attack is on the increase hugely, you know, from a CNI. We we averted in the UK an attack on a small power station. It was a nation state sponsored attack. There's different conflicts about who it was in the media. But needless to say, the UK has been identified as fair game now. And I think it's fair to say that on on the news recently, ⁓ Putin actually said that, you know, because of the support we've been given to Ukraine. ⁓ we are now fair game. So who who's to tell? What's around the corner? It is a concern because obviously what goes on nationally will affect us, you know, locally. There's no question that'll happen. Are you finding that the CISOs that you ⁓ deal with that are ⁓ more effective are the ones that are able to translate with their needs to a business case and to get the funding and to get the resources that they need? And how do people learn that? Is that through working through others? What is the key in your view to be a successful CISO? Well, ⁓ I'm not a CISO, so first of all, so I I can't I can't speak on their behalf. But what I can tell you is because we did host a very interesting workshop, Matt, and it was the the year after the event you attended in Aberdeen, a marketing company did a a a workshop for us to talk about how you get the budget, how you present the re you know, your requirements to the board to get the board selling. The CISO's got to become more than just ⁓ a capable individual that understands the threat actors. He's gotta be a good salesman. He's gotta be able to tell the story, Matt, because ultimately the board are relying heavily on the CISO driving the security, the network security, the online security. If the CISO can't communicate that to the board, then you know, is it's fairly unlikely that he'll get the resource you need. So I'm seeing these young, dynamic CISOs coming through, not even thirty years old and and making a lot of success for themselves because they're competent speakers. They've got better social skills and the and the more confidence and more knowledgeable because the way the industry's changed in this last five years, you'll see it yourself, has been colossal with the the advanced attacks that we're witnessing, the malware attacks that we're that we're witnessing. The younger generation just have a better understanding of the whole online life mat. And I think it's a as in sports, it's a young man's game. Yeah. So I think that there's a lot to be learnt from the older, you know, more more well established CISOs about the overall business continuity piece. But I think the CISO of today has got to wear more than one hat to be successful. Gotta be a good salesman. He's got to be able to tell a story right. Get to the point as opposed to laboring the point with too much technical information that just switches all the decision makers off. Gosh yeah. Tough job. Real tough job. Speaking of sports, when we were in Aberdeen you took us up to the Brymar Highland games. And it was a treat because obviously it's the Highland games and, you know, the king was there and That was wild. I mean, that was you know, once in a lifetime experience, but also getting to spend the day with all those cybersecurity professionals and drinking the world's best scotch and just talking about cyber. I mean, that's again, that's where relationships are built. And ⁓ you guys did an amazing job. We were delighted and honored to host and we have done a lot of your colleagues that that you're obviously from your previous life ⁓ extended the same hospitality to me in November. I got a VIP tour of the American Embassy in London and I have to say, ⁓ Mr. Callahan, ⁓ did did you proud. It was an awesome time. But you're absolutely right. I think spending time with your peers where you can just let yourself go and just be natural and and talk candidly in a safe space. Being able to share your anxieties and your concerns when there's so much pressure being put on you in your everyday life, I think that will benefit a lot of CISOs ⁓ for months

and months and months to come. And you're absolutely right. ⁓ we built on the success of that Highland Games that you came to by hosting the first Sealord, the Commandant General of the Royal Marines, because we support the charity. And actually the bizarre thing was the King had to host him because he was exactly the King's boss. So General Gwen Jenkins, he's now our first Sealord, he's the overall commander in chief of the Navy. The King is the captain general, so technically He's the king's boss. So he had to send his car to pick him up at the airport. He had to stand behind him when the when the parade was done at the games that you witnessed. Yeah. And then he came and spent time with our CISOs, and that's where I was going with this story. He he took the time out to make these people that were defending our nation in a different way feel so much valued. And I think it's the responsibility of all of our leaders from all of our services to understand more about the contribution that people are making. And the challenges that they're having, you know, not be too siloed. I think this is one of the problems sometimes. So just look out for yourself and say, Well, that's your problem. I'm not interested. If you can extend that hand of friendship wherever you can, I think it'll go a long way because I've I I've made so many buddies through you, Matt, ⁓ and great guys as well. So that that's the whole part of the journey for us. And that proves a point as to the reasons why we're having this podcast right now is that if we can't share our anxieties and and our lessons learnt and give that advice when we think it's needed. Then we're always gonna be struggling, fighting in the trenches on our own. We need to work together, as you said earlier. We need to come together and support each other. Yeah, nobody's alone. I was thinking about you the other day because I was watching the DP World Tour event at the Trump Aberdeen, and it was giving me ⁓ it was giving me terrible flashbacks to one of the worst runs of golf I've ever played because it was so freaking hard and I'd never played Lynx golf, but ⁓ boy, it showed up well on TV and that was again also You get to spend time I with the guys and just having fun. So I've already told my wife we're coming back to Scotland. I'm gonna do it right. Good. Awesome. Well, you there's no excuses now. You s you make sure you give us plenty of notice, Martin. I know that Eileen would be delighted to give you another lesson in golf. That's she sure did. She sure did. So well Tommy, thank you so much for joining us. I really appreciate it. It's always a pleasure to see you and talk to you and safe travels and I'm sure we'll be in touch in the future. Wonderful. And likewise, Matt, thanks for inviting me along. It was a pleasure. Actually, this is my first official podcast that I've not hosted as a guest. So yeah, so thank you so much. This this was a f you just popped my cherry, Matt. Thank you so much. Love it. Love it. Thank you, my friend. I appreciate it. All right. Take care, Matt. Yeah, and thank you, listeners, for listening to this week's episode of Detonation Point presented by Elastio. We'll see you next week. Thank you.