– Hi, Giuseppe. Welcome to Upstream’s “Tech Talk” series. I’m Fay from Upstream Security which offers the first cloud-based cyber security solution that’s purpose-built to protect connected vehicles and smart mobility services from cyber threats and misuse through the use of data. And I’ll be the host of this tech talk, so again, welcome. Turning it over to you.
– Thank you very much, Fay. It’s a pleasure to be with you, and thanks for inviting me into your tech talk. My name is Giuseppe Serio, I am part of the IBM Global Automotive Aerospace and Defense Industry team and my role is I’m the Global Solution Leader for the entire portfolio around connected vehicle and cyber security in that industry.
– Fantastic. And where are you based?
– So I’m based out of Germany, close to Frankfurt, that’s where we are now and given the Coronavirus, we don’t move a lot these days so that’s where I’m based and staying for the most part.
– Beautiful. Yeah, these fireside chats and conversations usually happen in these big rooms with an audience and it’s always fun to be hosting these things over Zoom. So I’m really excited to have you, so really thank you for joining us today. I wanted to jump straight into the details of things. So obviously IBM has products and you have services and you’re a bit about how you and how IBM approaches security within this global ecosystem.
– Well, as you know, IBM Security is probably one of the largest, if not the largest, depending on how you see it, security organization for enterprise security in the world. We have more than 8,000 practitioners basically everywhere around the world. And for our clients, we also have every day monitoring 70 billion security events. So that’s quite a large amount of insight we gain from our customers so obviously that’s over the entire portfolio of our customers, it’s not specific to automotive, but it gives you an idea about the magnitude of security and ultimately the service that we provide for our customers. Now specific for the automotive industry, as you know, and Upstream has started to play a big role in automotive cybersecurity with the events of connecting vehicles to the internet and all the new attack surface around it and how to protect it, IBM has a role to play in that ecosystem. We have in the automotive industry, around about 4,500 practitioners that cover everything from services to products, to all sorts of engagements that we have with our clients.
– And your clients are typically major OEMs, they’re tier one providers, I mean, the automotive ecosystem and the supply chain within that space is massive and very fragmented, where do you find the, I guess the combination, where do you really focus your security infrastructure?
– Well, I would say every client in that ecosystem because independent, whether it’s an OEM or it’s a supplier, the end product ultimately is a combination of suppliers plus OEM. So ultimately we are serving all those customers. Could be for specific topics on the supplier side and more comprehensive generalizing topics for the OEM world. So there’s a lot of involvement there are a lot of different people, I would say, we can look at them as obviously organization or corporation, but there’s a lot of people involved, there’s a lot of product involved and certainly there’s a lot of process involved when it comes to the automotive ecosystem. And I know that’s something that you had mentioned to me earlier was security and you approaching security as a combination of those three. Can you go into that a little bit more? What does that mean for you? What does that mean for this specific ecosystem?
– Sure, look, I mean, in today’s world it’s no longer a matter of how to protect things. It’s a matter of how to stay resilient in the face of cyber attacks. And I truly believe that in order to stay or become resilient, it is imperative that organization excel in the three domains that ultimately we know makeup security which is people, process and technology. And I would argue that today, the organization and the process is much more important because it requires from organizations to be agile. I mean, the word agile is, I emphasize a lot
– A popular word now too. Very popular word, but it is-
– At our workspaces.
– Yes, yes, yes, agile development and so on. But the same is true for cybersecurity. So your organization needs to adapt very quickly to new threats to threats that were not faced before, and also tackling these in a way that is efficient for the organization, looking at the big picture is something that is very much process driven. So that is imperative and that is absolutely key today.
– And how do you think that process has changed within the automotive space with connected vehicles? Obviously, vehicles are becoming more connected, the OEMs are becoming more connected, there’s so much data being sent and received throughout the, whether it’s the mobile applications, the car itself, other mobility services, that process there is multifaceted. How does cybersecurity play a role within such a massive process, specifically when it comes to an automotive space? Are there other industries that are similar in that way that you can take and learn from, or is this a truly new phenomena of how long and why that process is?
– Let me start with the last part. So based on our research, automotive industry is second or third most attacked industry. And the reason is that similar to other industry like banking, utility and energy, which are the top two, there is a big evolution, big change in the industry when it comes to evolving from a, so to say, very lethargic metal-based company that is creating products to software products. So this shift from being monolithic and lethargic to be agile, and we talked about agile before, is very important. And it’s also a complete mindset shift that is needed in order to address it. And we talked about agility. So when it comes to process, agility is maybe the overarching topic and word for this but agility goes really into the organization, the security operations, the governance that is in place, the architecture, so the technology, how much agility you have in your architectures to look for cybersecurity. And also the operating model, how do you align cyber security to support your business and digital transformation? So that is where agility is important. And let’s not forget, agility is also about talent. I mean, today we talked about new and emerging technologies, new skills needed. It’s very important that with the right people, addressing the right sort of attacks and have the backgrounds to address all of these challenges, and at IBM, we certainly focus, and obviously serving 12 and more industries, we have a very broad view on how these technologies that are pervasive, I mean, an attacker doesn’t look at, “Hey, this is automotive and I want it to attack it.” It’s for some gain, be it to get ransomware or being to, if it’s a nation state, to block things, you name it. But looking at security with an abstraction to the industry helps a lot in understanding what’s at risk and we know that technology is these days everywhere. So what is just running in your refrigerator could run in your car and vice versa. So you have to have a very broad overview on things.
– Yeah, cars are basically computers now, and it’s quite incredible. That concept of the new and emerging threats, I mean, we see that being such a heavy focus even with the WP.29 regulation of them insisting that there needs to be technology or a process in place to be able to recognize and deal with these new and emerging cybersecurity threats, especially as a connected car becomes more connected, there’s gonna be threats you’ve never even thought of in the future, ideas or concept or threat actors that you never even thought could potentially be threat actors. And that’s definitely something that we had Upstream are focusing on our technology. One thing is that’s great is that we really do have the ability to look at the data and be able to see these automotive streams of data from again, the vehicle, from the mobile apps, from different smart mobility providers, to analyze the data and to recognize how to see new threats and how to see things that could be, a year ago that threat didn’t exist within the automotive space and now it does. And I think that agile concept is really important and you’re right, especially within this this ecosystem. I think stream for a little while and what do you see with your communication with us, or role from your perspective within that space as the technology behind the cybersecurity offering?
– Sure, so, I mean, we talked before, IBM is very large and when it comes to security, we have a very broad portfolio, but, and this is the but, there is no single company today that can cover everything. There needs to be an ecosystem. And where I see Upstream as a very relevant partner is to get that threat intelligence specific to the automotive domain and make value out of it. It’s true, and I mean, big data has been a lot of emphasized and there’s to my mind, a lot of misunderstanding in the sense that many times we believe that the more data you have, the most secure you are. That’s not the case. The case is that you really need technologies to understand what is in the data that is important that you potentially might overlook and gives you the insights to do mitigations, to take the actions needed and do them quickly. So there’s one benchmark in the IT security space in security operations. So you have 15 minutes from, here’s an event and I want to respond to it. Now let’s transfer that to the automotive domain. We are not there yet and it will take time until we get there. So I think Upstream is helping to reduce that time in the sense that we have the means to get inside and understand where things are going and what to do.
– Yeah, for sure. I mean, I know that we have a heavy focus as well on now what we call the VSOC, is the Vehicle Security Operation Center and the importance of something like that playing a role within the OEM. Well, I just wanna thank you so much. I think this is a great quick conversation. Exactly as I had hoped it would be that we would really get to it neat early on without too much fluff around it. So I wanted to thank you for doing… Any last words you wanna to say, anything you wanna leave any members of our audience with or you think you’ve packed all our punch in in the actual conversation?
– There’s two things. One thing is thanks for inviting me, it has been a lot of fun to chat with you about security. I think there’re exciting times ahead of us when it comes to implementing WP.29, that will be a big one for the auto industry, for sure. And yeah, I’m excited to look forward and work with you in the future.
– Great, well, thank you so much for joining us today and we’ll see you soon.
– Thank you very much.