The game of cyber security

Listening to motivational speeches about cyber protection is in some ways similar to other industries, especially life insurance, and people like Alvin Rodrigues, Fortinet’s market development director for Southeast Asia and Hong Kong, is as smooth as it gets. 

Rodrigues called on the audience to rethink what customers want from Internet security, move away from the product spin and change the potential customers’ mindset by presenting them with a worst-case scenario when their company’s system is hacked.

Vendors and partners from the region recently gathered in Seoul to discuss cyber security.

“Risk is the currency for security. Understand their appetite for risk and attitude to risk,” Rodrigues told his audience, which included 20 Thais.

He said they should ensure that they and potential customers learn from each other’s failures. 

Among the names mentioned by the veteran marketing executive were Sony and Target.

Sony’s case is infamous. It was allegedly orchestrated by North Korea’s Bureau 121 cyber-warfare division in retaliation for the satirical film “The Interview”, in which the North Korean leader Kim Jong-un is mocked and killed. 

Sensitive e-mails within the Sony organisation were posted publicly, including unreleased films, songs, salary data and more, embarrassing the company and its executives. 

As for Target, information of 40 million credit and debit cards was stolen, leading to a serious negative impact on the company’s stock price. 

According to Fortinet’s global security strategist Derek Manky, an average of 310,000 hacking attempts take place around the world every minute, while Fortinet manages to process 35 million cyber threats every minute. On Android phones, he said, there are well over a million attacks per week across the world. 

“The bad news is there’s a lot of activity,” he said, adding that it’s the predictive elements of security that count instead of simply being reactive. 

“We predict the threat, update the threat real-time, 24/7, and have anti-virus experts who can reverse engineer the attack and figure out what they [the hackers] are trying to do,” Manky explained.

In cyber security, he said, it’s imperative to try and beat the attackers before they get into the game – hence the need to be predictive and preventive, as well as networking with organisations such as Interpol, United States Computer Emergency Readiness Team, Korea Internet Security Agency and more.

“We see the threat that they don’t see,” he said. “We don’t share everything, but the goal is to team up to fight the bad guys. We can’t take down servers, but these guys can.” 

To predict, prevent, detect and remediate are thus important to firms like Fortinet, which is deemed one of the top cyber-security providers. In fact, combined with fear of the bad guys, it’s their selling point.

If this fails to convince the potential customer of the risk, Rodrigues’ closing-sale remark might be this: “If my security is tougher then they go after him. And I am spared. The mindset out there is that there’s no company that is a 100-per-cent secure.”

Though Rodrigues never used the word “insurance”, George Chang, Fortinet’s vice president for Southeast Asia and Hong Kong, admitted that selling Internet security was like selling insurance. 

Currently Fortinet is the world’s third-largest player, and the biggest player in the Southeast Asian region, including Thailand. 

Peerapong Jongvibool, Fortinet regional director for Indo-China, said it’s not easy to convince mid-size firms that they need competent Internet security protection and solutions, adding that the level of awareness about Internet security is still not up there with developed economies like Singapore. 

“Technology is changing rather rapidly and creating awareness about security requires education,” Peerapong said.

Fortinet has had a presence in Thailand for a decade now, and half of its clients come from the government sector, though Peerapong estimates that less than half of the country’s medium-size firms have any external Internet protection services from companies like Fortinet or its competitors.

Peerapong pointed out that multi-function protection for small firms is necessary and requires the ability to readily provide support or change products in a timely fashion. 

On the positive side though, the Thai market can still grow, with the forecast for this year at US$46.6 million (Bt1.5 billion), up from $39.2 million last year, and the forecast for 2017 is $66.3 million. 

However, Thailand’s market size lags behind Indonesia, Malaysia and Singapore. 

Cyber vocabulary 

Watering Hole: According to Wikipedia, this is a cyber-attack strategy identified in 2012, in which the victim is a particular group (organisation, industry or region). The attacker guesses or observes which websites the group uses most often and infects one or more of them with malware. Eventually, some members of the targeted group get infected. 

Sandboxing: According to Fortinet, sandboxing is like a landmine. The suspicious code is isolated in a virtual detonation chamber and does what it was intended to do. The difference though is that the sandbox is completely isolated from your network and applications so if the code is malware, it’s not going to do any harm to your real environment. Once the code is extracted and installed in the sandbox, it’s easy to examine the damage it intended to do. If it is assessed as a threat, the malware is quarantined and blocked from entering your network.

Phishing: According to dictionary.reference.com, phishing is an attempt to obtain financial or other confidential information by sending you an e-mail that looks as if it came from a legitimate organisation, but is linked to a fake 

website that replicates the real one.