Kingdom’s digital future plan outlined at security summit

“Times have changed. We are now closely connected due to globalization and a developed cyber platform. Cyber security is no longer just about tools, but requires an integrated global approach,” explained Carl Williamson, executive director of cyber strategy at Northrop Grumman Corporation.
Williamson was leading a panel discussion on the challenge of cyber security in an ever-changing global era at the Digital Security Summit, an initiative supported by the Communications and Information Technology Commission (CITC) and the Computer Emergency Response Team-Saudi Arabia (CERT-SA).
The two-day summit, organized by French business information company naseba, was held on Saturday and Sunday in Riyadh. The opening keynote address was delivered by Abdullah bin Abdulaziz Al-Darrab, governor of CITC, who outlined and highlighted the Kingdom’s plan on ways to secure its digital future. He said: “CITC aims to provide high quality and affordable communications and information technology services to the Kingdom and to be the reference point in information security for the Middle East.”
From the aftermath of the Aramco Shamoon hacks to the most recent activities of international hacking group Anonymous, the Saudi government has been developing its digital security by increasing awareness about ways to prevent, manage, detect and respond to instances of information security breaches at the national level.
Since then CITC and CERT-SA have been working to secure the country’s critical assets to prevent a repeat of the Aramco hacking or other cyber security crimes.
During a panel discussion on Saturday, experts in the field discussed ways to ensure organizations stay up to date with the latest security solutions with special input from Raoul Chiesa, cyber security adviser at the Ministry of Defense in Italy; and Badar Ali Al-Salehi, director of Oman National CERT. “Social engineers will always find a way out to break the mental resolve of the human target,” Chiesa noted.
Establishing and coordinating national response teams and considerations before implementing the cloud were also topics that featured on the first day.
With the Kingdom making digital security a top priority, post cyber-attacks on Aramco, CITC and CERTA-SA have focused on developing and supporting increased cyber awareness.
Al-Darrab addressed the summit along with foreign experts, including Robert Schischka, managing director of Austrian National CERT; and Walter Fumy, chair of IT security standard at the International Organization for Standardization (ISO).
According to Al-Darrab, there has never been a more pressing case made for the Saudi government to focus on developing its digital security.
This is a task that falls upon the CITC and CERT-SA, he said. Together, they plan to increase an awareness of how to prevent, manage, detect and respond to instances of information security breaches at the national level.
The two-day summit included a variety of strategic keynote addresses, workshops and panel discussions featuring Abdulrahman Al-Friah, general manager of CERT-SA and CITC; Robert Schischka, managing director of the Austrian National CERT; and Walter Fumy, chair of IT security standards at ISO. Solution providers like Huawei, Northrop Grumman, Websense and Cyberia were also participated in the event.
“Support from the CITC and CERT-SA meant the two days were a perfect platform for all the key players in the Kingdom to come together and discuss a fool-proof cyber security plan. It also showed strong commitment from the Saudi government on making the issue of digital security a top priority,” explained Nicholas Watson, naseba’s managing director.
Naseba, a business-to-business event organizer, talked to cyber security expert Hadi El-Khoury on why offense and defense tacticians must inform each other, including the lessons learned from Stuxnet and other advanced persistent threats.
Nothing but a deep and thorough knowledge and understanding of business and industrial processes could guarantee Stuxnet’s creators’s success in simulating the introduction, contagion and stealth of the worm, El-Khoury said. In fact, the creators of Stuxnet probably possessed a far better understanding of these processes than the target’s own security officers and risk managers.
Delving into the details behind business processes is considered absolutely pivotal to enabling the optimum cyber security and business continuity measures. It not only helps in a proper understanding of the former, but also ensures confidentiality, integrity, availability and traceability for the client.
The cyber security expert also outlined the top three key techniques used by all professionals to improve their understanding of data flows through people, process and technology.
El-Khoury advised people to start with a blank or a predrawn business process management page. “Subsequently, go through some automatic process discovery and try to reconstitute the business workflow through structured and unstructured data management and analysis. Abide by a formal and structured way of communicating the logical and physical relationships and dependencies between IT assets and resources to define the business services of a modern enterprise or industrial site,” he said.
“If you follow these three techniques, you will be well on your way to securing and developing a comprehensive business continuity plan. Failure to do so may just mean you will never get a good grasp on information, whether it is processed, transported or stored in information and industrial systems,” El-Khoury observed.
“Now that you have the know-how, it is up to you to see which of these three approaches can apply to your business. The last step is to break your political isolation and go out to the business to gather its security requirements.”