Cybersecurity in the Age of the Everynet

Cybersecurity in the Age of the Everynet
New materials for mischief and magic

This presentation was given to the
British Computer Society IRMA SG
on May 9th 2017
09/05/2017 © 2017 Astius Technology 2

Bill Harpley MSc
• 30+ years in technology sector
• Founder of Astius Technology
• Organiser of Brighton IoT meetup group
(700+ members)
• Initiator of Brighton node of the global
Things Network
• Organiser of the Self-driving Cars &
Autonomous Vehicles meetup group
https://uk.linkedin.com/in/billharpley
bill.harpley@astius.co.uk
www.astius.co.uk
About your presenter

What you will discover today
• In this presentation we will talk
about:
– The Five Epochs of Computing
– The Everynet: its origins and meaning
– Emerging Cybersecurity challenges
– Why we need a new approach to
Cybersecurity
– What the future holds for the
Cybersecurity profession

Part 1: The Five Epochs

The Five Epochs
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
• The history and future of Computing can be divided into five epochs
• Although this is slightly arbitrary, it provides a solid basis for our
discussion today

The age of the Mainframe
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
1950 1960 1970 1974
IBM ship
S/360
mainframe
(1964)
IBM ship
S/370
mainframe
(1970)
TRANSIC - first
transistorised
Computer
(1954)
Intel
launch
4004
processor
(1971)
Work begins on
development of
TCP/IP (1973)
Work
begins on
ARPANET
project
(1969)
MULTICS
time-
sharing
operating
system
(1969)
AT&T ship
Unix
Version 5
(1973)
Research into virtual
machine technology
began in late 1960s
Ethernet developed at
Xerox Parc (1973-1974)
Gordon Moore
publishes
“Moore’s Law”
(1965)
Alan Turing
describes
the “Turing
Test”
1950
LEO
Computer
designed in
UK (1951)
First workshop
on Artificial
Intelligence at
Dartmouth
College (1956)

The age of the Ethernet
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
IBM launch
Personal
Computer
(1981)
1975 1985 1994
Apple I
computer
Launched
(1976)
Apple II
computer
Launched
(1977)
Apple
Newton
launched
(1994)
Domain Name
System created
(1983)
HTTP
protocol
created at
CERN
(1989)
Cisco ships
its first router
(1987)
NCSA
Mosaic web
browser
released
(1993)
Demon Internet pioneer
“tenner a month” dial-up
access to the Internet
in the UK (1993)
Ethernet standardised
as IEEE802.3 (1983)
Ethernet begins steady
rise towards dominance
UK home computer
boom led by
ZX Spectrum and
BBC Micro (1981)
Digital ship
VAX-11/780
mini-computer
(1977)
First ever
Internet worm
detected
(1988)
ChaosComputer
Club launchedin
Germany (1981)
NortonAntivirus
launchedto
combat rising tide
of software viruses
(1990)Microsoft ships
Windows 1.0
(1983)
Linus Torvald
announces
Linux OS (1991)
CMU Internet
Coke machine
(1982)
RSA crypto patent
granted(1983) DEC publishfirst paper
on Firewalls (1988)
Paul Benioff
proposes
Quantum
Computer
(1982)

The age of the Internet
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
Number of connected
hosts reaches
100 million (2001)
1995 2005 2014
Vmware release
‘Workstation’
(1999)
Amazon Web
Services
(2006)
Facebook
announce
‘OpenCompute’
project (2011)Apple
iPhone
launched
(2006)
Google
launch
search
engine
(1998)
Launch of
Facebook
(2004)
Commercialisation of Internet
gathers pace
Ethernet has attained
dominant position by
2000
SSL 3.0 released
(1995)
Linux gains commercial
acceptance
SATAN security
tool released
(1995)
Cloud Computing gains
commercial acceptance
BS7799 (Part 1)
published(1995)
BS7799 (Part 2)
published(1998)
BS7799 adopted
as ISO17799
(2000)
ISO17799
morphs into
ISO27001/2
(2007)
STUXNET
incident
(2010)
Google
acquires
Android
(2005)
End of Moore’s
Law widely
predicted
Google launches
self-driving cars
project (2009)
You Tube
launch
(2005)
Satashi Nakamoto
publishes Bitcoin
paper (2008)
OpenStack SDN
project launched
(2010)
IEEE802.11b
Wireless LAN
standard (1999)
Massive cyber-
attacks on
Estonia (2007)
ETSI hold first
NFV trials (2014)

The age of the Everynet
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
Hype begins
about 5G (2015)
2015 20342020
Mira IoT
DDoS attack
(2016)
Amazon Alexa
launched in UK
(2016)
Infamous
‘Jeep’
hack
(2015)
IoT concept
starts to go
mainstream
(2017)
First wave of near-
autonomous cars
takes to the roads
(2020)
Launch of 5G
mobile network
in UK (2023)
~ 20 billion
devices
connected to
the Everynet
(2020)
~ 30 billion
devices
connected to
the Everynet
(2025)
IP protocol stack
replaced by Next-
generation
protocol ( ~2030)
Anything from 2020 onwards is idle speculation
First demonstration
of quantum-safe
cryptography
(2028)
Steady progress is made towards building viable quantum computers
The last smartphone
rolls off the production
line (2027)
Moore’s Law
comes to an
end (2022)
Neuromorphic
Computing
grows in
popularity
(2026)
First generation quantum
computers come to
market (2030)
Early signs that
innovation in
Everynet paradigm
has peaked (2032)
Concern about
election hacking
(2016-2017)
Resurgence of interest
in AI and Machine
Learning
5G standards
agreed (2018)
LPWANs grow
in popularity

The age of the Quantnet
1950 1975 1995 2015 2035 2055
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
Your guess is as good as mine
2035 2045 2055
Fully autonomous
cars common site
on roads (2035)
Launch of 6G
mobile network
in UK (2036)
Quantum computing is now where
mainframes were in the 1960s -
primitive but with great potential
for growth and improvement.
The Singularity
arrives when
machine intelligence
can match human
intelligence (2045)
Bio-hacking to improve human
performance is now commonplace
~ 80 billion devices
connected to the
Quantnet (2035)

The expanding attack surface
The age of the
Mainframe
The age of the
Internet
The age of the
Ethernet
The age of the
Quantnet
The age of the
Everynet
Rapidly inflating size of attack surface

Internet traffic forecasts
According to Cisco Visual Networking Index global Internet report, by the year 2020
there will be:
4.1bn global
Internet users 26.3bn devices
and connections
82% of Internet
traffic will be video
2.3bn zetabytes of
traffic per annum

The past and future of cybersecurity
Mainframe
Ethernet
Internet
Everynet
Quantnet
Long-term drivers of complexity
 Increasing Computational Power
 Evolving network architecture
( Fixed, Wireless, Mobile, Satellite)
 Increasing data transmission rates
 Increasing network bandwidth
 Expanding user population
(People, Things, Machines)
 More distributed intelligence
 Changing traffic diversity (Email,
Video, Web, Voice, Raw data)
 Changing expectations of users
Question: how can this growth be
securely managed in the future?
Answer: reduce complexity!

Part 2: ‘Everynet’: it’s origins and meaning

The Internet of Nonsense
Origins of IoT phrase
British born researcher and
entrepreneur Kevin Ashton is
credited with coining the term
‘Internet of Things’ in an article
which he wrote in 1999
My personal view
• The phrase ‘Internet of Things’
has zero resonance with
non-technical people.
• It’s widespread use has
bemused non-technical people
and delayed development of
the market.
Photo: Wikimedia Commons
To be fair, Kevin Ashton cannot have anticipated
that the phrase ‘Internet of Things’ would be
picked up by corporate Marketing departments
and turned into a stupid marketing sound-bite.

The Everynet concept
Meaning: you can connect every thing to the global Internet.
As a concept:
• It’s more readily accepted by non-technical people (which is
the majority of humans on the planet)
• It can be understood as the next phase of evolution towards
the creation of a rich global communications fabric
• It’s not just a stupid marketing phrase!
CONTENT
Video, voice, email,
web
INDUSTRIAL
Data collected from
sensors and to
control actuators
CONSUMER
Data collected from
sensors and to
control actuators
Management and Supervisory
Traffic
on the
Everynet

Part 3: Emerging Cybersecurity Challenges

An overview of current threats
Here are a few tasty nuggets from the Cisco Cybersecurity Report 2017
• On average, organisations only have
capacity to deal with 56% of the
security alerts which they receive on
a given day
• It’s thought that 27% of connected
cloud applications introduced
by employees pose a security risk to
enterprise infrastructure (due to
O-Auth single sign-on)
• Spam accounts for 65% of global
email volume and 10% of global spam
is thought to be malicious
• Organisations which have not yet
suffered a security breach believe
their networks to be safe
• There is growing concern about the
expansion of the attack surface.
• Security professionals surveyed by the
report expressed similar degrees of
concern:
 Mobile Devices (58% expressed
concern)
 Data in the Public cloud
(57% expressed concern)
 Cloud Infrastructure
(57% expressed concern)
 ‘Dangerous’ user behaviour
- e.g. clicking links in emails (57%)

Errant Actors on the cyber-stage
Cyber-criminals Violent terror groups State-sponsored actors
Hacktivist groups Script kiddies

The size of the potential attack surface is about
to increase dramatically
This will create yet more opportunities for
malice and mischief

The world of Cyber-physical systems

Wikipedia definition
A cyber-physical system (CPS) is a mechanism controlled or
monitored by computer-based algorithms, tightly integrated
with the internet and its users.
In cyber-physical systems, physical and software components
are deeply intertwined, each operating on different spatial and
temporal scales, exhibiting multiple and distinct behavioural
modalities, and interacting with each other in a myriad of ways
that change with context.Examples of CPS include smart grid,
autonomous automobile systems, medical monitoring, process
control systems, robotics systems, and automatic pilot avionics
Source: Wikipedia
In other words, it’s where the digital world meets
the physical world

Example: M2M applications
M2M is a broad term which describes any kind of wired or wireless
communication between electronic or electro-mechanical end-points.
M2M is
employed in
a wide range
of vertical
market
applications

Example: Industrial monitoring and automation
SCADA systems are employed in monitoring and control applications
• Industrial Processes: e.g. oil refining, electrical power generation
• Infrastructure Management: e.g. Windfarms, Water treatment, Energy grids
• Facilities Management: e.g. Air-conditioning, Heating, Ventilation

Connecting critical systems
A great deal of industrial and public infrastructure
was designed and built in a more innocent age:
• Many components in a SCADA system were designed to have a
long operational life (15+ years)
• They were built using a patchwork of proprietary and industry
de facto standards
• Such systems were never intended to be connected to an
enterprise network
• Trend is towards making these systems IP enabled, which poses
major security challenges
These types of systems make modern life possible: e.g. National Electricity Grid, Mass
Transport, Food Distribution – growing concern that cyber-attacks on critical infrastructure
could cause major economic disruption and potential loss of life.

Massive attacks
UKRANIAN POWER GRID (2015)
Three electricity power distribution
companies were subject to a massive
cyber-attack:
• 225,000 customers were without
power for several hours
• Call centres were flooded with
bogus calls to hinder the response
to the outage
• It’s thought that the attackers
gained access to the system via
email ‘phishing’ and malware
attacks
• The source of the attack was
suspected to be a foreign
government agency
STUXNET (2009)
Targeted at Iran’s nuclear
programme with a view to disrupting
production of nuclear material
• It was a malicious computer
‘worm’ which targeted industrial
control systems
• It’s thought to have been
introduced into the system via a
USB storage device
• The infection caused the nuclear
centrifuges to spin out of control
• Good example of use of zero-day
software defects to launch
malicious attack on a system

Protecting UK critical infrastructure
• Government classifies Critical National Infrastructure
(CNI) on the basis of potential for disruption
– Responsibility for managing risks lies with CNI operators
– Not everything can be ‘critical’, so priorities have to be set
According to the Cambridge Centre for Risk Studies, the economic impact of a
major cyber-attack on a regional electricity supply network would be £12bn in
terms of direct and indirect losses
https://www.sbs.ox.ac.uk/cybersecurity-capacity/system/files/Integrated_Infrastructure_Cyber_Resiliency_in_Society_8_Apr_2016.pdf

Safety v. Security
Potential source of conflict exists between Safety and Security
• Example: automotive safety stand ISO26262
• Problem: adding security features (e.g. firewalls) may impede
the performance of time-critical software functions, which may
degrade safety
• It may be difficult to retrofit security to existing cyber-physical
systems
• New systems must be carefully designed to meet requirements of
both Safety and Security

Novel forms of attack
• Side-channel attacks aim to gather cryptographic
intelligence about a system by indirect means
• Examples include:
– Cache monitoring attack on shared computing
environment
– Electromagnetic monitoring attack
– Power monitoring attack
– Data remanence
The proliferation of ‘things’ will increase scope for these type of attacks

Protecting consumers

A problem of Trust
• There is no recognised trust model for designing security into
connected consumer devices.
• These devices can potentially be controlled and used to eavesdrop
on the local environment from anywhere in the world.
INVASION OF
PRIVACY
RANSOMWARE
THEFT OF
PERSONAL
INFORMATION
MALICIOUS
HIJACKING OF
DEVICES
A February 2017 survey showed that 72% of consumers were not sure how to
check whether their devices had been compromised.

Common issues
MANUFACTURER
 May have left “back-door”
into the device software
 May put onus on consumer to
apply software updates
 May cease to provide
software updates after a
relatively short period of time
( ~2-3 years )
CONSUMER
 Not obligated to change
well-known default
passwords
 May choose weak
passwords which are easy
to guess or readily cracked
with dictionary attack
 May be unaware of the
manufacturers default
settings for the device
(2016) Mirai bot attack compromised thousands of IP Cameras and home routers.
Exploited ‘old’ versions of Linux to launch a massive DDoS attack.

The perils of Software Complexity

All code is vulnerable
Commercial code is
estimated to have about
25 bugs per thousand
lines of code
Safety critical code is
estimated to have 1 bug
per thousand lines of
code (e.g. Aviation)
Software (and hardware)
may be compromised
within global supply
chains.
Questions for you to ponder
1. Do you feel that some manufacturers
prioritise ‘time to market’ over security?
2. Do you think that modern ‘dev-ops’ fast
release software cycles in any way
diminishes security?
3. How can we ensure the integrity of
hardware and software products within
the context of long global supply chains?
4. Do you think that we need better
methods of designing and testing
software?
5. Would you be prepared to pay more for
products if you knew that they
conformed to strict security standards?

Two cultures, One big problem

A tale of two cultures
Enterprise
Security
Automation /
Process Control
Security
Cyberphysical
Security
You have a major
challenge ahead!
What happens when
two security teams
from within the same
organisation have to
work together for the
first time?

Emerging Solutions

The attackers advantage
Attackers have plenty of time to research, plan and execute their attack.
What can we do to minimise their strategic advantage?

Designing for Security and Privacy
GOLDEN RULE: Design a system that is as secure as possible,
given the prevailing needs and constraints
SOFTWARE / HARDWARE
• Define the security, availability and
privacy goals of the system
• Define the types of threats that the
system will encounter in use
• Prove that the design meets criteria
(1) and (2)
• Implement the system using a
‘defence in depth’ strategy
• Processes must run with the lowest
level of privileges needed to
execute a task
PRIVACY
• ‘Privacy’ should be the default design
goal
• Collect only the minimum amount
of information needed for the system
to fulfil its purpose
• Securely store user credentials
• Understand how “anonymised” data
can be exploited in undesirable ways
• Securely destroy data which is no
longer required

OWASP guidelines
Minimise attack surface area Reduce the number possible attack vectors
Establish secure defaults Application should be secure “out of the box”
Principle of Least Privilege Processes should be assigned lowest level of privilege
needed to fulfil its task
Employ ‘defence in depth’ Fortify with diverse set of security measures
Fail securely Processes which fail must not divulge confidential
information
Don’t trust services Mistrust applications provided by external service
providers
Separation of duties Employ role based access control
Avoid ‘security by obscurity’ Use only as part of a broad set of security measures
Keep security simple Complexity is the enemy of security, so always strive for
simplicity
Fix security issues correctly Ascertain root cause and test fix thoroughly
Based on OWASP Developer Guide https://www.owasp.org/index.php/OWASP_Guide_Project

Share cyber intelligence
Information Sharing and Analysis
Organizations (ISAOs)
These are a global community of organisations
which share threat intelligence
• Facilitates adoption of a proactive
stance towards cybersecurity
• Likely to become more predictive
in the future and better able to
prevent or mitigate attacks
• May play an important role in
helping to secure consumer grade
connected devices
• Example: Cyber-threat Intelligence
Network (http://ctin.us )
UK Cyber-security Sharing
Information Partnership (CiSP)
• Joint industry and Government
initiative
• Hosted by National Cyber
Security Centre (NCSC)
https://www.ncsc.gov.uk/cisp
• Currently has more than 2,225
participating organisations
engaged in sharing of cyber-
intelligence
Also see NIST 800-150
https://www.nist.gov/publications/guide-cyber-threat-information-
sharing

Mining for cyber-intelligence
One emerging approach is to employ Big Data and
Machine Learning to detect real-time cyber incidents
Apache Metron originated as a Cisco project but is
now curated by the Apache Foundation
•Store massive volumes of telemetry
data for current and historical analysisSecurity Data Lake
•Can ingest and parse data from
common security apps (e.g. Snort,
Netflow, pcap)
Pluggable
Framework
•Performs standard SIEM1 analysis,
plus forensic facilities such as packet
replay and evidence storage
Security
Application
•Anomaly detection and analysis, plus
machine learning tools
Threat Intelligence
Platform
1. SIEM “Security Information and Event Management (SIEM)”
https://metron.incubator.apache.org

Improving Software Quality
• Developing secure bug-free software would be a
significant step towards reducing complexity
• NIST recommends the goals of security design
should aim to reduce complexity at all levels by:
– Reducing software engineering complexity
– Making security more science and less art
– Provide secure building blocks for creating complex
software.
• By abstracting the complexity away from software
development, the ‘average’ developer could
produce secure software

NIST IR 8151 (draft October 2016)
NIST study “Dramatically Reducing Software Vulnerabilities” recommends:
• Software analysis based on mathematical methodsFormal Methods
• Eliminate vulnerabilities such as ‘buggy’ APIs and
tightly manage resourcesSystem-Level Security
• Tools to analyse software and eliminate problems
(improves long-term quality of code base)
Additive Software
Analysis Techniques
• Employ proven frameworks which promote the
development an reuse of high quality, thoroughly
tested software
Domain-specific
Software Development
•Reduce the attack surface by dynamically adjusting the
interface presented to the attacker and/or regenerating
system components that have been compromised
Automatic Software
Diversity
Goal is to achieve 25 errors per 100,000 lines of code for commercial software.

Moving Target Defences (MTD)
• “Virtualise” the attack
surface that is presented to
the attacker
– Configuration interface
presented to an attacker
constantly “morphs”
– Reduces the attackers
‘window’ for planning and
executing an attack
– This does not reduce the
number of software defects!

MTD: how it works
• MTD is very active area of
research
• Currently more that 40
methods have been
proposed
• Examples:
– Non-persistent execution
environments
– randomized execution of code
– randomized network and host
identities
– randomizing compilers
– dynamic address spaces
– automated patch synthesis
and installation
http://blog.morphisec.com/moving-
target-defense-common-practices

Inspired by nature
DARPA ‘CRASH’ programme: Clean-Slate Design of Resilient, Adaptive, Secure Hosts
• Biological immune systems can detect and
supress ‘Intruders’
• Immune systems possess mechanisms
that could enable us to build effective
MTD systems:
 Distributed processing
 Pathogenic pattern recognition
 Multilayered protection
 Decentralized control
 Diversity
 Signalling between co-operating cells
http://www.darpa.mil/program/clean-slate-design-of-resilient-adaptive-secure-hosts

Biohacking
• “Biohacking” has several
meanings but here we mean
physical augmentation of
human capabilities by
hardware and/or software
means
• Examples include:
– RFID implantation for personal
ID purposes
– Control of physical
environment using Brain—
Computer Interface (BCI)
https://dangerousthings.com/

Security designed for people
• Security Ergonomics is
emerging as a field of
UX research
• It seeks to understand:
– How people react to security
alerts
– The influence of personality
traits on attitudes to security
• Emphasis is on observing
people in their working and
home environments
Example: Carnegie Mellon University's
Security Behaviour Observatory (SBO)
https://www.cylab.cmu.edu/index.html

A role for blockchain
• Blockchain is a distributed ledger
technology which creates a
permanent and immutable record
of transactions
• It is being used to record and
secure data in many Smart City
projects around the world
– Secure data from IoT sensors
– Enable smart contracts
http://wwwf.imperial.ac.uk/blog/security-institute/2017/04/04/the-role-of-
distributed-ledgers-in-securing-urban-infrastructure

A role for legislation
EU Networks and Information
Security Directory (2016)
This obligates member states to:
• Adopt a national cyber security
strategy
• Assign a national body the task
of enforcing compliance
• Establish a national CERT team
to monitor threats and respond
to incidents
• Participate in a new
Co-operation group to support
the strategic exchange of
information between member
states
General Data Protection Regulation
(2017)
The GDPR aims to strengthen privacy
rights an impose large fines for non-
compliance. Member states must:
• Raise public awareness of
cybersecurity
• Support cyber training at all levels
• Work with service providers to
ensure that the Internet is safe to
use
• Provide support for Critical
Network Infrastructure (CNI)
providers to promote best practice
and test cyber defences

Global governance
Budapest Convention on
Cybercrime
• Aims to foster global co-operation
on combating cybercrime
• Currently has 52 signatories
• Key states such as China, Russia
and India have declined to sign the
convention
Strong argument to say that further international treaty needed to
both combat cybercrime and curtail state-sponsored cyber attacks

The science of Security
• There is no “Science of Security”
• According to NASA the foundations of such a discipline are:
•Develop methods to enable the construction of secure systems
which have known propertiesScalability and Composability
•Develop methods to enable policy based data handling and
sharing across different authority domains
Policy-driven Secure
Collaboration
•Develop metrics which allow us to predict how a system will
behave in a given context
Security-Metrics-Driven
Evaluation
•Design resilient architectures which continue to deliver services
even when subject to attackResilient Architectures
•Develop models of human behaviour (both users and
adversaries) which enable us to build systems which have
known security properties
Understanding and accounting
for human behaviour
https://www.nsa.gov/what-we-do/research/science-of-security

Quantum Computing: the joker in the pack
A few final thoughts on Quantum Computing…
• It is very different than conventional notions of
computation!
• From a security perspective, the main interest is the
theoretical ability of a Quantum Computer to break
conventional cryptography
• The security researcher Peter Shor estimated that a modest
hybrid quantum/conventional computer could crack a
powerful RSA cypher faster than a conventional computer
could encrypt it. So this topic is the subject of a great deal
of research
• We are probably at least two decades away from the age of
the Quantum Internet ( or the Quantnet, as I like to call it )
• At the present time, you need a large and expensive
laboratory to perform even simple tasks
http://systemdesign.altera.com/cares-quantum-computing
http://www.etsi.org/images/files/ETSIWhitePapers/QuantumSafeWhitepaper.pdf

Training and skills development
• Expect the Cybersecurity profession to change
dramatically over the next decade
• There will be increased automation to cope with
complexity and skills shortages
• It will become more proactive (rather than reactive)
• It will become more multidisciplinary:
– UX
– Psychology
– AI and Machine Learning
– Safety conscious ( as more ‘things’ come online)
You will need to engage more in training and professional development!

Conclusions

Dividing the history of Computing into five epochs is useful for the thinking
about how Security has evolved in the past (and may evolve in the future)
We need to devise methods to manage the expanding attack surface and
help us deal with increasing complexity
Attaching critical cyber-physical systems to the Internet brings with it the
potential for devastating and disruptive large-scale cyber attacks
We have surveyed a variety of emerging methods to help us build better
quality software and to reduce the asymmetric advantage of the attacker
Legislation and global governance will play an important role in the future
Age of the Everynet
Quantum Computing is still at the ‘hype’ phase but has the potential to
break conventional cyphers
The Cybersecurity profession will experience major transformation over the
next decade.
What have we learned today?

Any
Questions

Advanced System Technologies
in Urban Spaces™

Cybersecurity in the Age of the Everynet

More Related Content

What's hot (20)

Similar to Cybersecurity in the Age of the Everynet (20)

More from Bill Harpley (7)

Recently uploaded (20)

Cybersecurity in the Age of the Everynet