A Kiwi take on Israel’s information security industryBy: Peter Bailey, General Manager at Aura Information Security
In June, my colleague and I were lucky enough to join a New Zealand delegation on a trip to Tel Aviv, Israel, to learn more about its world-leading cybersecurity industry.
During our time in Tel Aviv we were able to take a look behind the normally closed doors of leading cyber security facilities and meet with some of the world’s foremost experts in cyber defence. This in itself was a truly eye-opening and informative experience – one that I will look back on for many years to come.
Perhaps the one thing I was most surprised by during the trip is the number of similarities between our approach to cyber security and that of our Israeli counterparts. While this serves as good affirmation that we are doing a lot of things right here in little old New Zealand, it’s the observations I made regarding their collaborative approach that indicated we could be doing better.
While there were many learnings, here are six key outtakes from my trip – all of which I believe serve as an opportunity for New Zealand’s cyber-security industry to step up, collaborate; and take a bigger role in promoting our ability and capability to the world:
1. Information security is big business globally
Like New Zealand, Israel is a small nation, with around 8.5 million people. However, its security industry demonstrates just how big a business this is internationally. There are more than 350 companies, with over 90 per cent of those start-ups, and 20,000 people working in Israeli cyber security. The export value of these companies in 2016 was around US$3.5 billion – to put that in perspective, the entire technology industry in New Zealand generated exports of around US$4.6 billion in the same year. Some of the top Israeli cyber security companies are familiar names like CheckPoint and CyberArk.
And what the Israeli cyber security industry also demonstrates is that there is enormous opportunity for those who can provide security solutions that not only make computing safe, but which are easy to use. With Kiwi ingenuity and the right support and focus, the possibility for creating a world-class information security industry exists. It is up to us as a nation to turn it from an idea into reality, and we should be considering this seriously.
2. Insecurity is a fact of life
The timing of the trip was uncanny; international ransomware attack ‘NotPetya’ hit during the delegation, which followed on from similar cyber security breach ‘WannaCry’ just over a month earlier. The widespread attention the two attacks drew was arguably a positive for highlighting the serious impact lack of cyber security can have, and proved that this is largely the case – many businesses lack sufficient cyber security measures and adopt an ‘it won’t happen to us’ approach, which could prove disastrous for NZ companies in an ever-advancing digital landscape. It also showed a new normal, where high profile ‘era of consequence’ attacks will take place constantly.
3. The frenetic pace of innovation in information security
Seeing the pace of innovation and how the industry in Israel works was eye-opening. Structurally, there is a high level of collaboration between various players, from the government, to academia (including schools and tertiary institutions), the defence force and private business. Notably, recognising the crucial role that cyber security plays in the modern world, the government has driven investment in the sector, with coordination from a National Cyber Security Authority that was established in 2014.
4. Information security is a societal issue
With education and awareness noted as one of the key defences for any organisation (or even individual), it is noteworthy that cyber security subjects are included in school syllabi for learners from 13 years of age. This establishes a ‘security mindset’ that is backed by research and development at universities, Government level Cyber Ops Centres and a dedicated Cyber Security Tech Park that collocates successful cyber security businesses with startups, further fostering collaboration. And well-trained military personnel from the largest military unit in the Israel Defence Force – the cyber intelligence unit – routinely graduate from their national service into private industry.
5. New Zealand can stake a bigger claim in cyber security
Most aspects of Israel’s successful approach to creating an industry around cyber security can all be emulated in New Zealand. Already, there are moves towards ‘digitisation’ in the education sector, and an increasing number of schools include various aspects of information technology in the way they teach, the way students learn and what they learn. Since cyber security is an essential component of being online, putting specific focus on it at school would be highly desirable.
New Zealand is already home to several ‘tech centres’ and incubators, with government taking an active role in driving innovation through grants and subsidies such as those available from Callaghan Innovation on a national basis, or ATEED on a local one.
6. Intense collaboration drives innovation
What the intense collaboration in the Israeli industry delivers is the necessary innovation in cyber security. That tends to focus on new ways of dealing with attackers: how fast do they move, how rapidly do they adapt to defences. It is necessary to invest a good deal of effort on research to stay ahead of a constantly changing threat environment, where attackers have the upper hand (because they only need to find one way through, while defenders must close every single possible route of ingress).