Draft27-12

IS NOW
Combining thermal security cameras with video management systems.
www.flir.com
Untitled-20 1 18/02/16 10:18
Some of the
contestants in the
Cyber Security
Challenge UK;
supported in part by
the Government’s
National Cyber Security
Programme
Photo courtesy of Cyber
Security Challenge UK
The view from Level
39 at Canary Wharf
at the Immersive
Labs launch in London
Docklands
Photo by Mark Rowe
56
ways to find talent:
Immersive academy
Immersive Labs, a Bristol-based cyber security start-up that
helps identify and develop talent through a cloud-based
cyber training and assessment platform, has launched the
Digital Cyber Academy (DCA). That encourages
full or part-time students to develop cyber skills by
immersing users in real-world exercises through
online cyber labs and running a leader-board to help
employers and recruiters fill their cyber security
skills gaps. The developers stress gamification, as
users are rewarded for each task they complete,
and the higher up the leader-board they rise. In
other words; not classroom learning and not college
certifications, and no ‘right’ degree. James Hadley,
CEO and founder of Immersive Labs, was an
instructor at GCHQ’s Summer School: He said: “We
have acknowledged that academic background has little
bearing on an individual’s ability to develop much soughtafter
cyber skills. The Digital Cyber Academy will enable
millions of students to develop knowledge and hands-on
skills, allowing them to be recognised as highly cyber
skilled by potential employers. We’re looking forward to
building a community of cyber security talent from around
the world, on a single platform.” And Robert Hannigan, a
former director of GCHQ (see below) said: “Identifying,
developing and measuring practical cyber security skills is
Ex-GCHQ chief:
technology
will develop
Speaking in support of the Digital
Cyber Risk Academy was a former
director of GCHQ, Robert Hannigan.
We took the chance to speak to him
afterwards.
Professional Security’s one
question to him, and the
founder of the Academy, James
Hadley, was about how cyber relates
to physical security; as, to take the
example of the building the Academy
was launched in, many floors up One
Canada Square at Canary Wharf, it’s
one thing to protect tenants in cyber
terms, but it’s for nothing if someone
can walk in and plant a memory
stick with malware, or walk out with
a laptop under your arm. Both men
granted this; the Academy is not
looking at once to tie in with training
for physical security, presumably
having enough on its plate with
cyber. Robert Hannigan did recall
DECEMBER 2017 PROFESSIONAL SECURITY
the great challenge for all companies today. Most traditional
training methods are outdated and we need to think
differently for a new generation of intuitive, competitive
and diverse individuals. The criminal world has been good
at recruiting new talent often found through online gaming,
it’s time we take a similar crowd-sourced approach that is
profoundly disruptive for the greater good.” p
Cyber contest
that high-net worth people not only
want perimeter security, but want their
cyber life protected.
How many air bags?
Hannigan saw cyber-security as
developing, arguing that the internet
has (relatively speaking) only just
begun; it ‘hasn’t really settled down’,
and ‘it wasn’t designed with security
in mind’. He likened cyber - such as,
the level of your anti-virus software
- to car safety. You wouldn’t ask a
driver how many air bags they want in
their car. His point; we are expecting
individuals to make too many choices
in security and to do the right things;
‘that’s just unfair really’. He hoped
that in ten or 20 years people will take
many such cyber things for granted,
as security will be done by service
providers, ‘because it’s just crazy to
expect people to do all the right things
and manage their [IT] security. He
agreed with Professional Security that
cyber and physical security are on a
spectrum. “Most people’s lives are
lived online now, so it’s as important
for them to control their cyber,
digital life as to have their garden
protected, or whatever.” He hoped
that technology was at an early stage
Last month 42 UK amateur cyber enthusiasts competed
in a two-day simulation, protecting a fictional shipping
firm from live attacks. The contest was the end of a year
of qualifying rounds in the Cyber Security Challenge
UK Masterclass. A simulated Security Operating Centre
(SOC) in the home of British shipping, Trinity House in
London, was developed by telecoms firm BT, with Airbus,
cyber firm Cisco and the Cyber Technology Institute at
De Montfort University. The contestants took the role
of security consultants, brought in against a suspected
insider threat. They soon found a new COO was to blame
for missing files and working with fictional group crime
syndicate Scorpius extorting money. The challenges were
to defend the company from cyber-attack, conduct forensic
analysis and present a case against the corrupt COO. Nigel
Harrison, the Challenge’s acting CEO, said: “This event
is designed to mirror challenges faced by leading industry
experts, to identify the UK’s best talent.” p
and that security would develop. He
returned to the comparison of cars;
gradually, insurance companies and
others drove up standards, ‘and I think
that will happen in security; but they
will take a while, because the criminal
world is ahead of us’. That implied
the onus is on those in authority,
whether the state or industry, to fix
cyber, for the mass of non-specialists,
just as most non-professionals (to
take an example Professional Security
offered) do oral hygiene basics but
leave dentistry to the dentists.
Active defence
Hannigan pointed to ‘active cyber
defence’ by the UK Government,
whereby for instance the official
website gov.uk is having phishing
emails that spoof its address blocked.
Hannigan said that you can stop
such phishing, at a national level, if
companies buy into it; and BT and
others are interested, he said, about
stopping email ‘rubbish’ reaching
users in the first place. He added that
civil liberties concerns would have
to be addressed - that people did not
feel their communications were being
interfered with, even if it were spam
pretending to be from HMRC. p
www.professionalsecurity.co.uk
p62 NetworksImmers 27-12.indd 1 18/11/2017 12:07