← Cybersecurity Today
Cybersecurity Today
Cybersecurity & Arctic Sovereignty: Protecting Canada's Most Vulnerable Infrastructure Cheryl Biswas
00:29:51
Loading summary
Transcript45 lines
- [00:00]
A
Welcome to another edition of Cybersecurity Today on the weekend. And with me for this episode is a very special guest, Cheryl Biswa, who brings a new perspective on issues around Arctic sovereignty, a key issue in Canada that's often been thought about in terms of holding and protecting the land. But what about the systems that enable sovereignty? She gave a great presentation at the Atlantic Security Conference in Halifax, Nova Scotia, which is one of Canada's most thriving cybersecurity scenes. And she joins us today to talk a little bit about her journey into cyber and Arctic security. You're in for a treat and I hope you enjoy this as much as I did. So, Cheryl, maybe just start off with a little bit and to help the audience get to know you, what's your background, how did you get into cyber and what, what do you find most interesting about this field?
- [00:58]
B
Oh my gosh, I love to say I took the long and winding road here and it's a great encouragement story for people who are always wondering, could I ever join it or is it too late for me? And I'm here to say no. And yes, you must, you must follow your heart here and then you can rewrite your poor life choices later based
- [01:19]
A
on
- [01:22]
B
no long story, sort of short. I had been a stay at home mom for a decade. I had left a really good career at CPAIL, found my way into their help desk. Political science degree. I bought myself computers because I was working as a receptionist. I was bored out of my mind and nobody else wanted to touch the computers and nobody wanted to do word perfect tables and I'm like, hey me. And then when I discovered you could give me a screwdriver and I could open up boxes and stick in modem cards and have a whole bunch of other fun, learn new software packages, that was me. I had no idea the inner geek I possessed. So that led to some good things. But then I had to take some time off. I raised some kids and then there were bills and I needed to go find a job right away. So I had to start at the bottom again. And I came on as a girl Friday at a small managed services firm and I do love the sound of Windows servers in the There is nothing like
- [02:21]
A
for those listening, that was both a cyber joke and a military joke merged together. This is going to be a fun conversation.
- [02:31]
B
So I was there, Girl Friday and I read all of the emails and there was one from Kaspersky and it was about Stuxnet and that was it because that was the intersection between technology and geopolitics. And every disaster movie I had ever watched and loved. And it was like this. Where has this been all my life? It was a thing. I didn't know there was a name for it and that I just devoured everything I could find. But the magic happened when the little company said to me, please take our Twitter account, which had 0 followers. Please do something. So I. I didn't have a Twitter account. So I figured, well, start following, I don't know, Kaspersky, Microsoft, Semantic. All the names on the boxes around me. Not realizing the rabbit hole that I would follow, I fell through it. I've never come up since. And because I did that, I discovered there were people who had the most fascinating conversations online. This wasn't just shoes and Kardashians and stuff. This was interesting. And you could ask them questions and they would actually speak to you. I made friends, and they were hackers and they know who they are, and I cannot thank them enough. And I will thank them for the rest of my days. And they invited me to come down to a HackerFam conference in Indianapolis, which was my first foray into this wonderful world. And I saw everything and everybody and that was it. And I just. I fell in love. And they said, you can do things like you can submit talks to conferences. And besides, Las Vegas has a mentoring program that if you get selected, you get paired up. I sent a submission in about IoT and they matched me up with Phil Young, who is a mainframe. You know him, Mainframe hackers. He and Chad Rickensford became very special friends. I adore them. They are funny guy. And because we spoke mainframe for it, he's like, you speak mainframe? Speak mainframe. I don't actually do mainframe, but I grew. That was the CP rail environment. We had a ball. And. And because I got to do that, I got to go down to Las Vegas on a. I had a box of cereal bars, I crashed in somebody's room. I worked for food from as a volunteer and I gave my talk and I was able to. I got a little stipend. And. And because of that, I bought a conference ticket to defcon. That was it. That was everything.
- [05:05]
A
You got the gateway drug and you went straight into hacker nirvana. Okay, okay, so. So what do you do these days? What is the deals you got?
- [05:13]
B
I was working with a major bank and I. I was with them when they started up their threat intelligence program and watched it grow from a few people to a big complex entity within the organization. And then of course, there was restructuring, moving people around and I got. Was a little cut last summer, but I had a landing. I'm doing okay. So I've used that time to, to recover to. I just got it. I become my cissp.
- [05:45]
A
Congratulations. And you should. So you've been doing talks and you did a talk for the Atlantic Security Conference. And do you mind sharing folks, what your talk was about?
- [06:00]
B
Sure. So the title of the talk was Kick off, eh? It's our Great White North. And it was near and dear to my heart because there's been a lot of talk about Arctic and sovereignty and you just have to watch the news, you know what's going on. And I looked at this thinking we're spending a lot of money here on a lot of equipment and a lot of positioning to be able to do stuff. We're really stepping up into this role. That's a lot of technology that is vulnerable. That's a massive attack surface. And if you think about the Arctic, there's a whole lot of space and not a whole lot of people. And they're using things that I know and other people know, like satellites, which are again, like, those are difficult to maintain, lovely, vulnerable targets. I've seen the talks about how to take down slow things and pick them out. So I looked to see if anybody had talked about this issue about cybersecurity and Arctic and defense, and I didn't find anything. And I thought, ding, ding, yes, that's me, that's my name. I'm going to do that. So put together a proposal. And the next thing I knew, I had a whole bunch of slides about what, what we need to be paying attention to and why. So yeah, it was. It's really important if we want to take this step up, Canada standing on the world stage as a leader in the middle power realm. And saying Arctic sovereignty isn't just to claim Arctic sovereignty is our responsibility for our country. And it is super important because there's a whole lot of people who are interested in that particular region for nefarious reasons.
- [07:42]
A
So for the benefit of those, we have listeners around the world. We've hit into the top 10 in various countries, everything from Australia to the Middle east to Europe and more. And so to paint the picture for listeners who may not be following day to day Canadian politics, But the last 18 months has been a time for us in Canada. It has been a bit of a reset in our view and our place in the world. And if we have a moment of honesty, we were probably, and I can say this as a former veteran, we were the Couch surfers of NATO. We were just. Can we hang out with you? Can we be on your. Can you foot the bill?
- [08:20]
B
Thanks.
- [08:20]
A
We're super nice guys. Remember that thing we did in the Second World War, or more accurately, our parents did for you so we could couch surf? So we got to own that just to be real. And certainly we have absolutely benefited from the umbrella of security provided by NATO, NORAD and other things. But whether we like how we got where we are, Canada now is trying to take ownership for its own national defense. And there are lots of great models to follow. We have partners in the Arctic, you think the Scandinavian countries and others, but nobody besides Russia has got the coastline and the space. I don't think people can fathom the sheer size of Canada's Arctic footprint.
- [09:07]
B
Exactly. We're second to Russia in terms of that geopolitical. That geographic expanse. That is a huge amount of territory. And the concerning factor is Russia has known this and they have acted on it. They have mepors, they have monitoring. They have people all along that area and we don't. We're just sitting right across from each other in a hot.
- [09:34]
A
And I feel like. And I feel like this is where your political science background comes in, because your ability geopolitically to claim ownership of territories, there's a couple of interesting thresholds around that and boots on the ground as part of it. But in the conversation about Arctic sovereignty, we've talked a lot about how we use the indigenous and first nations and Inuit and other First Peoples as part of our defense. So we've got the amazing Canadian Rangers program. We've been. We've had some rough times trying to set up naval fueling stations or not set up. But it's all been about physical. It's all been about holding territory. Why does cyber matter when we're holding territory?
- [10:21]
B
Because what are we using every day when we're holding that territory? We're a technological civilization. Everything we do is underpinned by that technology, by the networks that we rely on, by the software that we utilize, the things that we have come to take for granted. We're not even aware of what we're doing as we're doing it. But if you speak to. I have friends who are Internet plumbers and. And when they show you what we are running on, in some cases, it's literally duct tape and springs. The. Our vulnerability to compromise when we're trying to do the most important missions of our existence as a country. It's staggering. That's why it's so important to understand that just as a pen could run out of ink or explode all over this document that you're signing, that's the risk that I'm looking at that it's not just a what it is a when, when and how will we deal with it for next patterns.
- [11:34]
A
And in terms of the when, we've had attacks on the territorial governments that have been massively disruptive. So we've. And thus far it seems to be mostly criminal. But as I'm sure you're familiar, the line between criminal nation state is
- [11:51]
B
I call it dirty deeds done dirt cheap because.
- [11:56]
A
So Jim, who is the resident musician, I tend to be the cultural critic on pop culture related to television and film, will definitely appreciate the dirty deeds done cheap reference. So we've already seen that. So in your talk, I guess what. So we talked about satellites. Satellites number one. So if you rely on those for Internet connections, that's a problem. But what else are we worried about in terms of Arctic security and cyber?
- [12:19]
B
We're investing heavily in ship's coast guard fleet. These are very advanced technologies. Remarkable how much technology now exists on naval vessels. And it's essential if you go on any sized craft other than a rowboat. So many of them have like sonar equipped station because when you're driving through psoop you have to be able to see coastline and other vessels. So at an individual scale that matters. But at a larger scale that's significant in terms of nautical safety. But if you are thinking like an attacker, which is what we are always taught to do, if you're messing around with that and you can steer large vessels into very delicate harbor areas and cause damage, boom, impact damage, downtime, it can go and it can escalate from there. I'm thinking there's a great scene in Die Hard 2 where unfortunately I know where I'm going with that one, where the planes are being misled. They rely on the guidance system and they crash into the ground. Those guidance systems are up for grabs for people who can manipulate them. We know this is doable. It's not just something from a movie, something they have to consider very seriously. And Canada is surrounded by water. Our maritime and fishery industry is huge. We constantly need to be monitoring. This is people's life's blood. Those small towns, those harbor facilities, they're not. They're part of the community, they're part of the economic livelihood of that particular region that feeds into our overall economic state as a nation. So there's a. It could be death by a thousand paper cuts if you really want to construct it at that level and then go higher. But realizing what do we rely on as a country to maintain our stability, that sense of economic stability and prosperity. When your people feel safe and secure you can do a lot but you also aren't having to deal with the problems that panic and an agitated population can cause. And we're at a point in time where we have to be thinking clearly and able to mobilize the majority of our population to go forward to respond as we need them to, as we are going to project that they will when we're making much bigger plans against a very volatile geopolitical scenario world stage.
- [15:13]
A
So we've talked about satellite Internet connectivity for communications and which flows through to a whole bunch of stuff. We've talked about navigation which we talk about seafaring navigation. We've got clear cut cases both from the Ukraine war now the Strait of Hormuz. We're talking about aerospace which we've got again see your die hard and raise you golden. Not goldeneye. I've been corrected about this before the tomorrow dies. So for the listener who corrected me in the past, see I do remember so Tomorrow never dies where we have this British warship that gets sunk because it's in the wrong waters. So we've got that. So we've got a good handle on that. Anything else? Anything else critical infrastructure wise or that
- [15:53]
B
was part of your focus under sea cables and there's We've already seen lots of increased reporting as they are increasingly targeted and so much runs on these. If you Again we're so dependent now on technology we don't know what to do when we lose it. And we see people rise to a state of panic with societal reaction that didn't really exist 50 years ago that the Rogers out which really demonstrated for us here in Canada. And when people can't get to their bank and get the money out of their bank they can't contact their family or loved ones. That is something that is very hard to manage and can really exacerbate trying to get control of an already difficult situation. Those lines of communication are difficult to maintain because there's only a few specialized troops and people who can come out and service them when something goes down.
- [17:00]
A
One has to assume with respect to the Arctic that there are also seasonality effects that come in the for those listening the you want to know one of the most interesting sort of political navigation conversations in Canada and largely any of the Arctic countries is what's known as the Northwest Passage. And this idea that we could move ships more easily through the Arctic without massive icebreakers. Right now the only vessels that transit the Arctic 365 with any degree of ease is a submarine. You typically nuclear powered submarine because it's the time and the distance it takes to stay on an air that they do the best. This is also where I feel like it's a Tom Clancy moment. For those who are not familiar, the reason that every superpower went to park their submarines in the Arctic was then short the distance to the targets that you wanted to hit. It's really interesting because we, I don't think we as a civilization think about the Arctic. I think we spin the globe around, we see that big there be dragons which is this just giant white snow wasteland. This is where the white walkers are. If I go full pop culture references and shock on that.
- [18:06]
B
So it's interesting.
- [18:06]
A
And the things that I think about as well is, you know, we think about the Arctic. The food supply chain is extraordinarily fragile. You rely on massive imports of food to sustain the population that actually exists there. Any disruption to the ordering, shipping, logistics systems to bring that food in and things start to get real really quickly. And the other part is power generation there is tricky. It's fragile, it's diesel generators. It's. It's also an odds are if I had to draw a conclusion, they're probably not super patched, potentially not super secured the ways that we'd want to think about it. So critical infrastructure.
- [18:48]
B
And that's the thing, you've got both a vulnerable civilian population and the indigenous population and military population there as well. All of that infrastructure is very highly coveted, potentially highly targeted. But it is as you said, it is fragile, it is not maintained the level that we even see through the rest of Canada. And it is that much more difficult to be able to ensure that people up there have what they're going to need there. It isn't just I'm going to be able to go to the store and get what I'm going to need for food and what it's flying stuff in. And that's something we don't think about. Most of us have no idea what
- [19:36]
A
it's like to add in ransomware attack on a healthcare system in the Arctic. You're not driving to the next hospital system to get care. You're in a world of hurt in the last major frontiers, certainly in our sector of the world. So you gave the talk at a last security conference. You covered sort of these topics. What about solutions? Where were you? Is There anything hopeful? Do you see any traction or what needs to be done?
- [20:08]
B
Okay, so I see good conversations happening right now within our local community. It was just recently some people here at Parent and others who were up there. Amy Yee I saw this on LinkedIn so that's why I'm following. I follow if you're doing arctic work. I'm following you or trying to follow you on LinkedIn because I'm just following like a sponge. However, it's the awareness that we need to work collaboratively with the people who already live there and understand that better than any of us. We need to get that buy in and that understanding and it is a group involvement to secure our territory together. And that is going to take a real, real understanding. A trust has to be built and maintained in order to do that. But when we have that in place, it is far more difficult for outside parties to engage in misinformation, disinformation to separate us. And that is a, that is absolutely one of the big threats I would perceive because I know that China has already been after parties up there in order to buy them out, as they have done in Africa and other countries was very good at this.
- [21:26]
A
The Belt and Road has been dramatically effective in, in a new form of economic colonial control in Africa, which is interesting and we've got really interesting stories from the security services about the military put an aircraft hangar for sale and had to quickly buy it back because of where it might get have been purchased to. So it's interesting times. And one of the things I've heard from and there's this phenomenal indigenous groups who are building Internet infrastructure and one of the, one of the pushes is to get as much fiber connectivity to decrease the reliance on satellite Internet which has issues with speed, quality, et cetera, ownership on that side. Was that part of your discussions at all in the presentation?
- [22:14]
B
I was looking at that. I didn't go into that in as much detail because the challenges of satellites were something I wanted to highlight more within the limited timeframe. But yes, being able to lay something that's more secure, that is more dependable for that particular region, having the fiber up there and being able to maintain it and then also again, getting the people involved directly can be part of the solution. Another really nice takeaway was how Canada as a nation is technologically forward. We are doing enormous things in terms of our development with regard to systems. And it's not that I'm an AI opponent, it's the understanding of taking that technology and developing it to serve US and knowing where it can be utilized or leveraged and then quantum and there's big steps being made, the funding being done with regard to universities and Canada being able to develop that so that we again are positioned. We're not going to be reactive. We're going to actually be aware and potentially proactive and in this field carrying our knowledge and collaborating with other like minded powers. And there is absolutely strength and collaboration. This is where the future is, us working together and these other middle powers who are positioned against the north with an understanding of Arctic sovereignty. We learn and build off of each other. We can work together. And our relationship with Greenland has really developed just over the past century because we,
- [23:58]
A
we, we have shared an experience and Jim and I are very conscious. We have so many fantastic American listeners and some of whom are more sensitive to the, to the trends and geopolitics of it. But all that to say is that they're, that it's the reality is that everyone is having to think about these things and there are a number of countries that have a shared geographical challenge and shared economic and security concerns around what we're seeing. How was the reaction to your talk? What was the most interesting sort of feedback or question that you got?
- [24:29]
B
I had. It was a small number of people and I was thrilled that somebody from the federal government from the sharies and oceans came right up afterwards. We had the most wonderful discussion afterwards and we're still having more discussions, which is really good. And I also, I don't know if you're familiar with Alina Dabit. She is with OptivNow, has a fabulous career. She also came up afterwards and just, it just made my day to have her say that it was a good talk and I had brought to light things that I felt were really important for other people to take away and consider. So I'm just hoping to get this out there again and build on it.
- [25:09]
A
No, I think that's wonderful. Is there anywhere that folks can go to watch the talk, download the download your slides or just reach out to you if they want to get the material?
- [25:19]
B
They can reach out to me on LinkedIn.
- [25:22]
A
Yep.
- [25:23]
B
Yes, I would be happy to. I'm in the process of refurbishing, have a blog and it now needs to be refurbished and that is where I would normally position this so I can be reached on LinkedIn for sure.
- [25:36]
A
Perfect. Awesome. And I will. Yeah, if folks can't find you, I will happily connect them up. I want to turn back to your story. So congratulations again on the cissp. Where do you where, what's your dream job? Where do you want to be in case there's someone out there listening? And I need a Cheryl where.
- [25:59]
B
Okay. I love, I secretly wish to, to be a part of a think tank or being able to do strategic thinking with a group of people and coming up with the solutions. So that's. I love being part of a strategic threat intelligence group. To be part of a small group where we're coming together ideas and looking at the big picture and then putting together the what ifs. I've done a lot of that and I'm very, very accurate on what comes down the line a couple of years later. So we've got the passion. That will always be a passion. But being a part of anybody's group who needs somebody who is a creative strategic thinker, get paid or unpaid,
- [26:43]
A
hopefully we find something that gives you great compensation as well as those intrinsic rewards. Those are, those are always good on that side. Cheryl, I've always enjoyed chatting with you. You and I are co. Co conspirators or part of that giant group trying to bring some of the lessons from our American friends, folks like Bo woods and others here in terms of the hackers on the Hill and you know, for those listening, I had the privilege of participating in the first ever Hackers on the Hill with Cheryl and I had a whole gang of cyber policy nerds. And turning from your story to the next Cheryls, to the folks who are just as passionate about policy issues and tech and that intersection, if someone's listening going, I don't know if I could do that. I don't know if I'm the right fit for that. What would you say to them?
- [27:31]
B
Trust yourself. Somebody has to ask these questions. We need the weirdos. Be that square cake and round hole. And I'm on LinkedIn, maybe you can run your idea past me and I can listen. All it takes sometimes is just one person to say, I see where you're going with that. You never know who is going to have ears open, but bring it. We need people to think outside the box. Do that.
- [27:58]
A
I really love that perspective that you brought in there. And I had the chance last year to talk at B Sides Las Vegas and I'd done a lot of presentations before there, but it was always on my wish list to go there. And just hearing your story today reminds me of a talk that Casey Ellis gave last year, which is the importance of the B side level conferences. This is the place where we create the next generation. And when I. And I don't mean that in sense of the one age group or the other. It's just the next cohort of cyber leaders which can cross all kinds of demographics. And what's interesting is Ellis's point was it's the place where the two fools can meet. The old fool who says new knowledge isn't valuable and the young fool who says old knowledge isn't valuable. I know I've paraphrased that awfully, but it's the place, the meeting place. And to see what you've taken and what that investment from Phil and others has been that you've now gone forward and done some good with, it is just amazing. So I really appreciate the conversation. I appreciate the chance to catch up on a talk that I wasn't able to actually attend. So this is becoming my sort of my opportunity to catch up. Really excited. Thank you so much for the conversation today and I hope you have a wonderful weekend.
- [29:13]
B
Thanks, David. This was a pleasure. Great just to catch up with you. What a terrific conversation.
- [29:19]
A
No, this was great. It's always fun to meet somebody that thinks about all the bad and all the things that can that we need to be thinking about. And I genuinely love the point that you made. If you're out there listening and thinking somebody else has thought of my thing, I wouldn't bet on it.
- [29:38]
B
We might look for it. Don't hang up on yourself.
- [29:43]
A
Awesome. Thank you so much.