Mikko Hypponen, Chief Research Officer, F-Secure
India is being considered as the most vulnerable country to the cyber attacks, so what we can do to get rid of this situation?
Get rid of the old technology. It’s one of the explanations that we can see so many differences in the risk rate in different countries. For instance, Windows XP is out of support for two years now, no security patches; and they are running in India. That means you are approaching towards the risks which are already fixed, they don’t apply to you because you are running an old system.
Another thing is the role of operators and the telecom providers. There are some vendors which typically keep their own network clean, they monitor both traffic and they monitor the servers. They isolate the company laptops, there could be own users. In some cases they even call the customers or sometimes disconnect the customers, put them in a wild card and they explain them they can’t be allowed on the internet until they clean the machine and they keep tools to clean the machine. The role of operators is crucial in keeping the net-
clean and this is also beginning in India too.
In the current scenario of Indian market, do you think we have enough skills before investing in the security?
The crux of the matter is, we need better security engineering for that we need better security engineers to begin with and that is a crucial problem. We have a cap on security experts, we don’t have enough qualified people in security, and this is a problem we always have to face while hiring skillful employees for F-Secure as well. That is why we are searching for the qualified people by visiting the Universities, to recruit people who are capable enough to work.
In this area, F-Secure is educating people. We run Cyber Security Base which is a course series in collaboration with University of Helsinki that focuses on building core knowledge and abilities related to the work of a cyber security professional. These are online courses anyone can access it.
With increase in trend like BYOD and BYOA (Bring your own application), with corporate giving us access of the company; what are the concerns that should be addressed to prevent attacks?
If the employee wants to access the corporate data on their own devices, then they have to follow some corporate rules. A company sets the decision of what kind of settings have to be applied on the devices and you have to apply them in your settings. So if the employee follow those guidelines well and apply them on their device, I think then there is no problem.
However, it is quite often people think that the mobile phones are less secure compare to the computers. But in actual it’s the other way around. In fact I always tell people to use tabs and Mobile phones to do critical stuffs, for example Mobile banking. If you do it from a computer you have more chances to get attacked but if you do it from your iPad then you have no reasons to worry.
What are the top things that CSO of the organization should know to secure his employee?
Firstly, they must do threat assessments for the company. Ask questions like who would like to steal by us?; do we have enemies?; do we need to worry about hactivists? Etc. For example oil companies and foreign intelligence are prone to hactivists attacks. Step two; company should build a skilled team which could handle such matters. But mostly we see, is a bit tough, in many organizations there are people already present in your organization that have the relevant skills. Step number three education, education and training.