Speaker 1 [00:00:02] Hey,
Speaker 2 [00:00:03] it’s Theresa. Welcome to disruptors, the 10 minute Take where we dive into the latest innovation, tech and economic buzz. For this week’s take, we’re tackling cybersecurity, an issue that’s become even more prominent with the war in Ukraine. In addition to the large scale violence and physical destruction, the country has also experienced a bevy of cyber attacks and security breaches that are changing the face of war and spilling over into civilian arenas. How will this affect the way businesses and individuals protect against cyber threats? And what does it mean for the future of digital networks? To help us better understand cyber health and best practices is Matt Hedberg, software analyst at RBC Capital Markets in Minneapolis. Prior to RBC, Matt spent eight years in the software industry. Matt, welcome to the 10 minute take.
Speaker 1 [00:00:50] Thanks. Happy to be here!
Speaker 2 [00:00:51] Cyberattacks have been a facet of online life and digital business for years, but the war in Ukraine has put a spotlight on them, especially as we’ve seen critical infrastructure get hit areas like energy, utilities, transportation, health care. What’s changed about cybersecurity in the last couple of years, particularly as we’ve migrated much of our lives online due to the pandemic?
Speaker 1 [00:01:15] You know, honestly, it started well before Covid. It started well before the SolarWinds breach of 2020. You know, ever since the dawn of computers, there has been malware. There’s been bad actors exploiting vulnerabilities, and it gave birth to obviously a huge cybersecurity industry over the last 20 plus years. Some of these trends have accelerated recently. Covid is, we think, ultimately the biggest accelerant of all of them ultimately is forcing all of us. Whether it’s work, play, exercise, vacation to leverage more technology, something we refer to as digital transformation. And with that comes a whole new digital infrastructure and a whole new security posture. So Covid really accelerated trends that were already in place. The SolarWinds security breach of 2020 was very much an on premise oriented breach, and that subsequently, we think, pushed a lot of CEOs and CTOs to even want to move more critical infrastructure to the public cloud. Ultimately, we think a precursor to a digital transformation is a security transformation that really requires a whole different way of thinking about cybersecurity and whatever the next breach might be. A week from now, a month from now, there will be more. We just think the world is not where it needs to be from a cyber defense perspective.
Speaker 2 [00:02:23] How have cyber attacks evolved and what are the most common types you’ve been seeing lately?
Speaker 1 [00:02:28] From a warfare perspective, obviously, historically it was very much air, land and sea, but increasingly cyber attacks. You know, people can do that from their basement, right? And it doesn’t have to be nation state. It can be a rogue group of criminals that can hide behind firewalls and have their traffic, hop around multiple networks and really conceal their activities. A lot of times it could be malware. It could be phishing attacks. It could be brute force de dos attacks. It can be identity attacks. There’s a whole bevy of tools that cybercriminals are using to inflict more cyber pain, right?
Speaker 2 [00:03:00] And just a couple of weeks ago, Canada’s federal government did warn businesses and organizations to bolster their cyber defenses as the crisis unfolded. So what are the biggest gaps that still need to be addressed in terms of how companies should be guarded themselves against these attacks?
Speaker 1 [00:03:16] Yeah, I think it’s, you know, part of it is a frustration. I think among a lot of CTOs that we talked to, there’s this view that no matter what I do, the cyber criminals will be one step in front of me. And so that ultimately has led to a real proliferation of I want to buy everything because the more I own from a security perspective, the safer I feel. Yet oftentimes, the more you have, sometimes the more complicated your security posture is and stuff falls through the cracks. So we think over time there will be a sense of consolidation because sometimes less is more. And the more that you can have a single pane of glass to look at all of your cyber risks and defense, that’s a powerful thing. We also think that with the advent of cloud computing, we’re seeing a lot of these cloud security vendors do more with data. So CrowdStrike has a massive cloud native threat graph database where they’re able to see trends and anomalies faster than, say, a company could if they were analyzing all the data themselves and really the power of the crowd in this case. So we think some sense of market consolidation, additional cloud based technologies and really, when we think of what’s critical from a cyber defense perspective, we think there’s several core pillars identity. Knowing who you are is a critical aspect of cyber defense, how then you access critical infrastructure. So this is called zero trust, and it’s effectively saying, OK, Matt, you are who you say you are. Now we’re going to authenticate you to what you’re getting after, and there’s companies that are specifically designed for this kind of secure digital gateway, if you will. Another line of defense is cloud work will protection. So putting parameters around protecting cloud workloads, that could be stuff that a company like RBC developed internally. It can be public facing applications like salesforce.com. But but protecting that cloud workload, we think, is a critical aspect. And so we think ultimately, if you’re able to address identity, secure connection and protecting cloud workload, obviously there’s other aspects of cyber defense, but those we think are critical aspects of this next gen security posture that we’ve been talking about.
Speaker 2 [00:05:13] So pivoting now to perhaps the opposite end of the spectrum, looking at individuals, you know, you mentioned that some of these cyber attacks happen from non-state actors, from some person in their basement, and the same could be said for how they manifest on home computers. You know, cyber attacks could be launched from unwitting hosts. An attacker could probably take control of my computer without me knowing. And so from an individual point of view, what are the biggest vulnerabilities that most people just aren’t aware of?
Speaker 1 [00:05:41] Yeah, I think there’s been so much focus on enterprise security or federal or state and local security. I think oftentimes individuals, we are the weakest link of the day, right? We could click on an email that we shouldn’t click on or a URL that we shouldn’t click on. And ultimately, so we are sometimes the last line of defense, whether that’s you and a corporation or you as an individual in your private lives. And so there’s been less technology devoted to protecting individual consumer security. There’s a handful of larger consumer security vendors out there, but some of it’s generational. I think a lot of younger kids and one feels and didn’t necessarily grow up with a fear of computers, you know, doesn’t think about cybersecurity as much as, say, like an RBC, what, for instance. And so I think a lot of it’s education. I think there’s some basic security measures that consumers can take. Obviously, identity fraud is a huge thing, but yeah, it is when we’re talking about potentially the weakest link in the chain being humans. I think there’s certainly more that we all can do individually. And some of it’s just education. You know, knowing what looks fishy is certainly an aspect of it. But deploying oftentimes, you know, enterprise grade security for individuals is not something that really happens today, but I think something that certainly could be an interesting avenue to to explore.
Speaker 2 [00:06:52] OK, so when we look at the latest market moves on cyber defenses, we saw Google purchase cybersecurity firm Mandiant for $5.4 billion this week, and it’s one of the largest acquisitions in the tech giant’s history. It’s also a big bet that helping companies better address cyber threats is also very good for business. But in your view, what is the right balance for private sector companies and governments in assuming responsibility for cybersecurity?
Speaker 1 [00:07:19] You know, on the Google acquisition of Mandiant, it speaks to how important the hyperscalers IWC Azure GCP are taking cyber security. Microsoft has, I think it’s a $10 billion security business internally, and so we think there will be continued spending from a public cloud perspective. Now what’s interesting, though, a lot of the public companies that we cover can play across multiple clouds. We call it like, you know, multicloud or hybrid cloud. And a lot of organizations like RBC are leveraging multiple public clouds for the workload. And so while we think the hyperscalers will continue to invest both organically and inorganically in this case, Google bought Mandiant. We also think there will be a need for independent sort of software security vendors that can play across clouds now. The question was also to what is that from a federal perspective, to an individual corporation to an individual person in their personal life? Obviously, there’s varying degrees of things that governments are doing. There’s things like Europe has implemented data security or data breach laws where if you know, if a company is breached, they have to disclose that breach to alert the public that they’re potentially their identity has been compromised. And so federal governments around the world are really deploying a number of sort of more governance based items. Corporations are clearly spending billions and billions to secure their own networks. But yeah, I think it is a tough balance, right? Philosophically speaking, a lot of federal governments take more of a defensive posture when it comes to cybersecurity. They’re not taking an offensive view, right? And so in some regards any the federal agencies are a bit hamstrung in taking a more defensive posture. But I think a lot of the enterprise security vendors that we now cover more of the cloud based cybersecurity vendors are doing some amazing things with data that can prevent breaches. And so that defense mechanism, we think, ultimately needs to make its way further, both into the federal government perspective as well as humans and individuals in their own personal lives.
Speaker 2 [00:09:06] As we look forward, do you think this marks a turning point in global technology development and network connectivity? To what extent do we think this increasing threat of cyber attacks is going to slow down growth in the Internet of Things, for example?
Speaker 1 [00:09:20] Yeah. Covid. If it taught us anything kind of reverting back to the sort of our conversation, the world is digital. We all know that, and we all relied on technology to survive and thrive during Covid. Those trends aren’t reversing. It’s now a function of cybersecurity to continue to make advancements to enable this. And so this is a critical thing of what we talk about in our research is that digital transformation, so moving more workload to the cloud is ultimately a secure practice. But then also security transformations to enable that has to happen in conjunction. And so therefore we think the overall cybersecurity spending environment will remain robust for a long period of time.
Speaker 2 [00:09:57] Right. So as we grow more connected. It’s cybersecurity, we’ll just have to keep up with advances in technology.
Speaker 1 [00:10:03] Exactly. We’re not going back to pen and paper as much as I think we’d all like the nostalgia of writing letters and receiving them in the mail. This world is digital. That’s not changing. And so we do think that cyber defense is a paramount aspect of further enabling digital technologies, and we’re not going back.
Speaker 2 [00:10:22] That’s fascinating. Thank you so much for joining us today, Matt.
Speaker 1 [00:10:26] Thanks, Theresa.
Speaker 2 [00:10:27] And that’s a wrap for this week’s 10 minute take. I’m Theresa Doerr. Join us next time as we dig into the resurgence of travel happening in Canada right now as COVID restrictions finally ease after two years. Talk to you soon, disruptors.
Speaker 3 [00:10:45] The 10 minute take is created by the RBC Thought Leadership Group and does not constitute a recommendation for any organization, product or service. It’s produced and recorded by Jar Audio. For more disruptors content like or subscribe wherever you get your podcasts and visit RBC dot com slash disruptors.