C (22:25)
At a practical level, there is no Internet without a telecommunications network. All of the traffic across the Internet goes across the telecommunications network. So when you're the CEO of the biggest telecommunication network and the national network in the country, you basically are responsible for the network where most malicious cyber activity is actually going. And so as a consequence of that, I needed to be very thoughtful about it because I became the CEO in 2015, and from that period of time, cyber malicious activity really increased quite dramatically, sort of internationally. And so I was both concerned from protecting our own customers perspective, but then I started to work very closely with the government from a national policy perspective and how do we help defend the country and how do we get on top and address this challenge? And then through that, as you say, I chaired the expert advisory boards and subsequently since stepping down from Toronto, I've had a number of roles in this whole landscape. At the end of the day, though, this risk, in a sense has got parallels with any other type of risk that boards and management have to deal with cybersecurity. I think often people are looking for some sort of silver bullet solution. Well, there is no single silver bullet solution because the problems or the vulnerabilities exist all over your infrastructure. And so actually it requires quite a comprehensive program of activity. It's not a surprise, is it, that as we have chosen to do more and more things online, such as banking, shopping, making our reservations, doing business online, studying online, it's unsurprising that the people that used to do bad things to us in the physical world have followed us online. It's entirely sort of, if you like, predictable. And so I think, you know, part of my philosophy on this is that I think again, sometimes people fall into the trap of saying, right, well, you know, we've got to eliminate the risk of any malicious cyber activity ever happening. That's just deluding ourselves. We don't live in a world where we sort of say, you know, there's going to be no crime out there. Unfortunately, There is every single day, houses get robbed, cars get stolen. But the question is, is how do we manage our society or how do we manage our business, or how do we manage our personal lives to mitigate the risk of those things happening to us? And I think the philosophy on cybersecurity is exactly the same. And I have a four point plan to tackle that. So basically the first thing is you can't protect what you don't know that you have. First thing you've got to do is put together an inventory of all of your digital assets. So what do I mean by your digital assets? What I mean is your devices, your, your applications, your software, the data sets that you have online. You're trying to protect all of your digital assets and they're all a bit different, but you've got lots of them and it's a big job. So now I actually have an inventory of all of my digital assets. The second thing I would say is that not all digital assets are the same, but they are all defendable. And by that what I mean is, is that some things are more important than others and how you choose to defend them. You could take a different approach. So, for example, really sensitive data, if you're, for example, the Department of Defense or Department of War, you know, some of that data is incredibly support, even to the point where you would actually keep it offline. So it would actually never touch a public Internet. Whereas other pieces of information, such as at a personal level, my Netflix account, yeah, of course I want to protect it, but it's. I don't worry as much about my Netflix account as I do my bank account. And so once you've got your inventory of digital assets, you can actually start to adopt a differentiated approach to having a different security posture on each asset. Define what you want that to be and make sure that you've got those protections in place. The third thing I would say is that the worst possible time to develop a crisis response plan is in the middle of a crisis. Somebody once sort of said to me that you need to touch the Bunsen burner to know that it's hot. In other words, as a kid doing chemistry, you can be told that the Bunsen burner is hot, but of course you still touch it and then you realize it's hot. And it's that experience, that visceral experience that is the learning. And so actually when companies do scenario testing and they sort of role play, if you like a cyber security incident, the more visceral you can make that, the more the learnings from it will stick. And then the last thing I would say is that what is safe today may not be safe tomorrow. You may have put in place a comprehensive cybersecurity risk management plan and it's, you know, it's pretty robust, can't guarantee nothing bad's going to happen. But you, you can put your hand on your heart and say I've taken all reasonable steps but actually the world's changing. And so we talked about AI, malicious cyber actors, more tools with which to do as harm. Another great example would be quantum computing. The risk of quantum computing through the security of encryption keys that we have distributed in systems is quite significant. It's something that's getting a lot of attention at the moment. So we think that our data is safe because it's encrypted today. What if somebody using a quantum computer could crack that encryption code and suddenly release all that information? And quantum computers are not that far away. And so that's the fourth point really. You just need to keep an eye on new technologies and developments that are happening to keep on top of the whole cybersecurity risk management plan.
