Protect Your Business in an Evolving Cybersecurity Landscape

Roger Howard

00:00:00,100 –> 00:00:44,277

Hello. And thanks for joining us today. A year ago, we talked about the cybersecurity landscape and what businesses needed to be thinking about. And while a year may not sound like a long time, in cybersecurity a lot has changed. Cyber threats are evolving. The tools we use to run and protect our businesses are becoming more sophisticated, and artificial intelligence is advancing incredibly quickly. It is creating tremendous opportunities and also new risks.

The goal of today’s conversation is simple: understand what’s changing, what it means for your business, and how you can stay a step ahead. And joining me today is Adam Evans, RBC’s Chief Information Security Officer. Great to be doing this again, Adam. Thanks for joining us.

Adam Evans

00:00:44,277 –> 00:00:45,178

Good to see you.

Roger Howard

00:00:45,178 –> 00:00:54,954

Listen, let’s jump right into it. Question one. How has the cybersecurity landscape evolved over the past year? And what should business leaders have on their radar?

Adam Evans

00:00:55,955 –> 00:02:13,133

The threat landscape has been evolving for the last few years. And what’s happened in the last year is really the industrialization of that landscape. What do I mean by industrialization? You have threat actors that are using more AI tools for automation. Historically, we know that they’ve been building platforms and services where they democratize criminal behaviour.

But the real step shift now has been putting AI in that threat actor toolkit. Speed, scale has been sort of the two major outcomes for them, but it’s also reducing barriers of entry into this landscape for would-be criminals. Language is no longer a problem. Cost is no longer a problem. Technical sophistication is no longer a problem. So all of a sudden, you have more people joining this sort of criminal activity. You’ve got AI that’s taking a lot of humans in the loop out of the loop, and they’re creating more autonomous and automated capabilities.

And what you’re going to see is more attacks globally happening, more targeting of victims, wider nets being cast. And I think the fatigue that everybody is feeling with regards to scams continues to rise just because of the frequency that we’re going to see attacks targeting individuals or organizations.

Roger Howard

00:02:13,133 –> 00:02:15,001

So, Adam, as we look at AI, clearly it’s become more sophisticated, but certain things remain the same. Can you double click on that for me?

Adam Evans

00:02:21,074 –> 00:03:11,391

So certainly with AI, AI is introducing speed and scale, and you’ve got some sophistication that’s coming along with it. These AI capabilities can detect vulnerabilities that were previously undetectable, as an example. But a large portion of what we see them doing are the same old, same old. Impersonation attacks, credential, you know, credential theft, information harvesting, privilege escalation. All of these things that we’ve historically seen from them. The AIs still have to be able to do them. They can just do them faster, and they’re doing them consistently in the same way every single time they execute an attack, it’s repeatable.

And I think that is the step shift in that it’s the speed, the scale and the frequency that we’re seeing them attack institutions, whether they be small, medium or large.

Roger Howard

00:03:11,391 –> 00:03:34,881

Anytime you read anything today in society, it’s about AI. It’s a hot topic for everybody. So as you look at businesses, which are all being challenged and excited to adopt new AI tools and processes and seek the benefits that it might be able to provide for their business, what are the biggest risks that you see when businesses adopt AI too quickly?

Adam Evans

00:03:34,881 –> 00:04:21,894

Typically, what we see when companies are rushing out to consume new technologies is they haven’t necessarily one built the maturity to go out and configure the environments in a safe and secure way. They’re trying to get their technologies up and running and start to consume them. And typically what we see is we see over provisioned access. We see systems that are not configured properly. We see security protections that are left behind and not put into that environment properly.

So all of a sudden, you’ve now put all of your technology out into an environment like the cloud. And certainly, what we saw with the rush to cloud is those things became a problem, hygiene, things that you would typically see when you’re hosting it yourself get missed when you’re trying to consume these new technologies as quickly as you can.

Roger Howard

00:04:21,894 –> 00:04:35,241

That is so well said. So maybe on the on the flip side, we obviously didn’t hear about what AI can do for us. So how can AI protect our business clients from potential cybersecurity  threats going forward?

Adam Evans

00:04:35,275 –> 00:05:40,373

So most of the technology companies that, you know, organizations are familiar with are embedding AI into their tooling, whether that’s the Microsofts of the world, the Googles of the world, there’s a lot of people in the technology landscape, all of them are on their own AI-based journeys, and they’re putting AI capabilities into their tool sets. And if you’re taking advantage of those technology platforms, certainly, you know, you gain the benefit of the security that comes along with it.

For RBC, as we continue along our journey, making sure that we safely enable any new business services that have AI enabled capabilities in them, we want to make sure it’s done responsibly. We want to make sure that they’re operating as designed. So, a lot of diligence and governance goes into designing these things and deploying these things. As a heavily regulated financial institution we don’t have the maybe the luxury of not doing this properly. We really have to think our way through it. What kind of things do we want to offer up to our clients, and how do we safely enable those capabilities for the client?

Roger Howard

00:05:40,373 –> 00:05:41,574

Adam, on that point. Can you give us some specific examples, from the smallest businesses to the large corporates of what they can do?

Adam Evans

00:05:46,979 –> 00:06:57,550

So, for small businesses, the main sort of threat vector that we worry about as things like email and there are lots of companies out there that provide platforms that are AI-enabled platforms. Their catch rates are much better, and you can certainly rely on them to provide you those types of security services. For larger organizations, it’s a bit more complex, but I would say also start looking at common threat areas where you typically see threat actors targeting you. If it’s email, start looking at technologies that help you with that particular problem.

It also becomes a data issue as we sort of get into more complex threats and more sophisticated attack scenarios, larger companies may need access to that data and use AI to start using that data for early warning signs that they are under attack. So you can you can look at small companies. You can look at big companies, common threat vectors, email, web browsing. You can certainly use platforms that are readily available that are AI-enabled. And for larger institutions, it may require a little bit more bespoke kind of services, contextualized specifically for your business and using AI to use or to create early warning signs that you’re under attack.

Roger Howard

00:06:57,917 –> 00:07:12,632

Our clients watching this broadcast, a lot of them are C-suite, you know, the size of the business. Most of our business owners are what you call C-suite executives. What should C-suite executives be doing before, before a crisis hits?

Adam Evans

00:07:12,698 –> 00:09:57,029

So the first and foremost is have the plan. You want to be able to prepare your organizations. And this is not unique to AI, to be clear. But I think what AI will present to organizations is a speed and scale when a problem occurs that we’ve never really had to deal with before. So, you need to have a plan.

If it’s about AI when you’re enabling it, what is it touching? What are the what’s the data it touches? What are the accounts or identities that it uses? And then do you understand what good versus bad would look like? And have you got a plan to respond? If it’s not about AI, if it’s just about threat actors and technology, it’s the same plan. But you may have to have some different plans to be able to cut things off very quickly in your environments. Because AI can move so fast. It’s automated. There’s no humans in the loop. There’s no real friction. Once they successfully compromise a company, and they can move through it pretty quickly with an AI-based toolkit.

When you’re looking at your environment, you want to make sure you understand what are the things you’re trying to protect, what are the things that are most risky? And if you lost control of them, what would they impact? What would the impact to your business really look like? That could be your intellectual property. That could be your financial platforms, any of those things. Then you want to be able to make sure that the security that you’re investing in is protecting those most sensitive information assets.

And if you’re a C-suite asking your technologists, do they understand where are those systems? How are we protecting them? What kind of controls have we built or capabilities have we deployed to properly protect them and keep them safe, not put them in harm’s way?

Then I would say communicate. One of the things that we do really well in our organization is when you sit around the table during a crisis, we know exactly who needs to be around the table with us, and they are with us in every single crisis. They know exactly what role that they play. For C-suite people, identify the folks in your organizations that need to be part of that crisis. Empower them so they understand the role that they play and the decisions that they will need to make.

And then you want to flex that muscle. You want to keep testing and making sure that as you go through these crises, you keep refining your capability and you keep refining your decision making. And before too long, just like anything, practice makes perfect, right? You get good at it. No incident that I’ve ever seen in my career is the same. They’re different every time. Flexing that muscle is just about mobilization. It is not about how you, you know, how do you stop a crisis by numbers set. This is all about getting in the room together, understanding how you’re going to operate with one another and making sure people know the decisions that they’re going to have to make.

Roger Howard

00:09:57,029 –> 00:10:17,516

You know, the bank, one thing that we do are tabletop exercises. We anticipate a crisis. And then how would we respond when we layer on more complexity as we go through the crisis. It’s a wonderful example, Adam, of what our business owners should be thinking about in advance and preparation and case something does happen.

Adam Evans

00:10:15,147 –> 00:11:13,339

You’re absolutely right. We’ve seen it done really well. We’ve seen it done very poorly. And I think having the plan, practicing the plan means that when the crisis event happens to you, it’s not a matter of “if”, it’s a “when” event, that you understand how to get started and who needs to be with you for that journey that you’re about to embark on. Because these things can last days, weeks, months, and you need to be crystal clear on what that remediation plan looks like. People that are figuring it out on the fly inadvertently miss key pieces.

And I think when you’re in a crisis moment, how you respond to the crisis can actually build more trust with your customers and clients than, you know, when you’re when you’re leading into it, people that do it well actually build more trust. People that don’t do it well erode that trust. You need to have that plan and you need to have the capability to be able to respond to it in an organized fashion.

Roger Howard

00:11:13,339 –> 00:11:24,383

So now just maybe in a real type of scenario, we’ve got a client now and they’ve been attacked. They’ve discovered a breach. Walk me through what their actions should be in the first 24 hours.

Adam Evans

00:11:24,717 –> 00:13:06,786

So the first and foremost is you get your plan, you get your people around the table. Then the next question is, are you going to need additional help? Do you need a cyber coach? Do you need a breach response provider. This should also be part of your plan. If we have a ransomware event, we need somebody to come in and help us respond to it. As an example, once you get the people around the table and you get your coach in that can help you manage, now it is about putting the plan into motion. Do you need to, you know, disconnect yourself from the internet? Do you need a forensic firm to come in and look and see what was touched in your environment? Do you have to notify a regulator? Do you have to notify your customers? More than likely, if you’ve got business service interruption, you’re going to start getting inbound calls from affected customers. Do you have a script? Do you know what you want to tell them?

All of these things happen in that first 24 hours, but it’s really about a current SWOT analysis. What’s happened, what’s affected, what are the symptoms that we’re seeing. And then start, I would say in an organized fashion, moving your way through the different technology platforms of your organization. Start your investigations, bring in third parties where you need to because you still have a business to run. A lot of people forget that I have to run a bank. Even when we’re in crisis, our bank still needs to function. So the teams that you know that secure the bank every day, they’ve got day jobs and they have to continue to do those day jobs while we’re responding to a crisis event. Organizations are all the same. You need to continue running your business, but you also need to make sure you can respond to the event. So yeah, you need to make sure you’ve got the right resources in the right places.

Roger Howard

00:13:06,886 –> 00:13:56,802

Great advice. Adam, really huge thank you again for joining us today. And you know, more importantly, some actions we can all take.

And if there’s one takeaway from this conversation. It’s that as cybersecurity threats evolve, so must the ways we protect our businesses. And staying informed, prepared and proactive is an important part of that. Whatever the size of your business, I encourage you to review RBC’s Digital Safety and Scams Guide for practical tips and resources.

And for the latest on cybersecurity, bookmark our cybersecurity site at the link below. Because protecting your business isn’t a one time exercise, it’s about staying alert, asking the right questions, and making cybersecurity part of how you do business every day.

Thanks again for joining us, and we’ll see you again next time.