{"id":276,"date":"2010-06-17T08:49:54","date_gmt":"2010-06-17T08:49:54","guid":{"rendered":"http:\/\/rigf.asia\/?page_id=276"},"modified":"2024-01-25T06:49:59","modified_gmt":"2024-01-25T06:49:59","slug":"aprigf-roundtable-june-15th-2010-session-2","status":"publish","type":"page","link":"https:\/\/event.rigf.asia\/2010\/aprigf-roundtable-june-15th-2010-session-2\/","title":{"rendered":"APrIGF Roundtable – June 15th, 2010: Session 2"},"content":{"rendered":"

Security: Cyber-Security and Network Confidence<\/span>
\n________________________________________________________________________<\/p>\n

REAL TIME TRANSCRIPT: Security: Cyber-Security and Network Confidence
\nAPrIGF
\n11:00-12:30, Tuesday 15 June 2010
\nHong Kong<\/p>\n

DISCLAIMER: Due to the inherent difficulties in capturing a live
\nspeaker’s words, it is possible this realtime transcript may
\ncontain errors and mistranslations. An edited version of the
\nrealtime transcript which amends the inherent errors, will
\nbe posted later. LLOYD MICHAUX and APrIGF accept no
\nliability for any event or action resulting from the
\ncontents of this transcript.<\/p>\n

________________________________________________________________________<\/p>\n

>> :\u00a0 Now may I have Mr Mohamed Sharil Tarmizi, chief officer
\nof MCMC, to introduce the panel speakers for us.<\/p>\n

Please.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Good morning, everyone.<\/p>\n

Very happy to be here in Hong Kong.\u00a0 Thank you very
\nmuch for the introduction.<\/p>\n

Thank you to Edmon, Bianca, the guys from DotAsia.
\nYou have made my life a lot easier by helping in
\nplanning for this session.<\/p>\n

We are running a bit behind time, so I was advised
\nby the organisers to try to catch up.<\/p>\n

We have five, including myself, and I’ll explain
\nwhy.<\/p>\n

We have about six presentations to share with you.<\/p>\n

They are very brief presentations about security.<\/p>\n

Maybe as a sort of a prelude to that, I just wanted
\nto say that as we have heard this morning, the internet
\nhas become a critical infrastructure for most of us and
\nwhether you’re a developed country or a adopting
\ncountry, the internet has become very important.<\/p>\n

As with many other critical infrastructures, it is
\nalso susceptible to threats.<\/p>\n

If in the past we all looked at physical threats,
\nnow the threats we are talking about are of a cyber
\nnature.<\/p>\n

The risks that come up and the potential harm that
\nthey can cause is huge.<\/p>\n

I am joined by a panel of distinguished people.
\nI won’t read you their VCs in the interests of time, but
\nfrom the far right, we have Mr Michael Mudd who will be
\ntalking a lot about the education side, Mr Thomas
\nParenty is talking about the issues concerning cyber
\nsecurity.<\/p>\n

We have an antivirus man there by the name of
\nMr Matthew Chan.<\/p>\n

We have Christine, who is and we have ram.<\/p>\n

I am in a challenging position, because this
\nmorning, I represent the convergent of interests.\u00a0 My
\nday job, I’m a regulator in Malaysia.\u00a0 So I regulate the
\nbroadcasting broadband internet telecoms industry.<\/p>\n

But I have a dual role.\u00a0 I’m also a board member of
\nimpact.<\/p>\n

I have a third role later this afternoon, where I’ll
\nbe speaking on behalf of the ITU.<\/p>\n

So multiple heads, convergence or confluence of
\ninflicts, not conflicts.<\/p>\n

Very quickly, let me just share with you, to
\nkick-off, what impact is doing.<\/p>\n

We’ll go down the presentation this way.\u00a0 Some of
\nyou, anyone in the room who has heard of impact?<\/p>\n

Yeah.\u00a0 One.<\/p>\n

We are doing very well.<\/p>\n

Basically, impact stands for the International
\nMultilateral Partnership Against Cyber Threats.<\/p>\n

What is it?<\/p>\n

It’s non-profit.\u00a0 It looks at creating a team of
\nexperts on cyber threats.\u00a0 It looks at the high level
\ncyber threats, not national level, but international
\ncooperation level.<\/p>\n

Basically, based on a global partnership environment
\nand it’s supposed to be multilateral.<\/p>\n

All of us are going to be less than five minutes to
\nspeak, in the interests of time,.<\/p>\n

We launched impact.\u00a0 Impact is now the physical home
\nfor the global cyber security agenda of the ITU.\u00a0 It
\nhappens to be in Kuala Lumpur.<\/p>\n

What the coalition actually tries to do is to try to
\nbring together the industry experts, academia,
\ninternational bodies and think tanks into one place,
\na virtual place, called impact, where countries of the
\nITU membership can get together and essentially compare
\nnotes, share resources and capabilities.<\/p>\n

This is because these are some of the countries
\nwhere impact has already deployed some cyber security
\nservices.<\/p>\n

What it is that impact does is largely capacity
\nbuilding, particularly for the developing and lesser
\ndeveloped countries.<\/p>\n

Less are some of the advisory board members of
\nimpact, as you can tell, they are people in the industry
\nwho have been involved in a lot of the cyber threat type
\ninitiatives.<\/p>\n

They have a partnership with the ITU.\u00a0 They are not
\nan agency of the ITU, let me just be very clear.<\/p>\n

They are in their own.\u00a0 They have about 45 country
\nmembers right now, building up, but they have tied up
\nwith the ITU and also Interpol to look at cyber crime,
\ncyber threats.<\/p>\n

Recently, they signed up with the ITU, to be the
\nphysical home of the global cyber security agenda of the
\nITU.<\/p>\n

I must stress this because at the same time, they
\nare working with the UN.<\/p>\n

There’s a lot of hype floating around about what
\nimpact is, what impact does and so on, so I can tell you
\nthat they are quite independent of all of that.<\/p>\n

I’m going to basically skip this and focus on one of
\nthe areas that impact is working with the ITU and that
\nis protecting children on-line.<\/p>\n

This has become a major agenda, I think for many
\ncountries and many governments and impact is help
\nprogress viding capability and capacity.<\/p>\n

The final few slides I have is that the facilities
\nthat impact provides is actually a global response
\ncentre, a platform for experts to collaborate, in terms
\nof the cyber threats.<\/p>\n

Training and skills development centre, where they
\nwork with institutes and other people, counsels and the
\nrest.<\/p>\n

They have also this capacity building environment
\nfor government, where if governments want to know how
\nwell they faired, in terms of their readiness against
\ncyber attacks or cyber threats, you can have
\na benchmark.<\/p>\n

Last but not least, they have a centre for policy
\nand international cooperation.<\/p>\n

The partners you can see, I would invite you to go
\nand see impact’s website for who the partners are, but
\nbasically it’s intended to be an all uncollusive
\ncollaborative platform for governments particularly, but
\nalso multi-stakeholders to get together and discuss
\nabout cyber security and cyber threat issues.<\/p>\n

So that’s the presentation on impact.<\/p>\n

Let me switch back hats to becoming the moderator.<\/p>\n

That is only one slice of cyber security that I’m
\ntalking about.<\/p>\n

Maybe more on the slice where governments have some
\nconcerns, physical security, infrastructure security,
\nbut there are other aspects, such as the on-line
\nprotection initiative for children and my fellow
\ncolleagues here on this panel will be bringing to you
\nthe various aspects.<\/p>\n

The whole idea here is that we intend to try and
\nprovide the kaleidoscope of security issues for your
\nconsideration as a thought piece for the Asian Pacific
\nRegional Internet Governance Forum to think about.<\/p>\n

We can then, after this, perhaps, in the discussion
\nsession, if we have a bit of time, try and look at
\npriorities, areas of prioritisation, because the
\npriorities will be different for each one.<\/p>\n

Enough from me.<\/p>\n

Can I now invite my colleague, Ram Mohan, to do his
\npresentation.\u00a0 Thank you.<\/p>\n

>> Ram Mohan:\u00a0 Thank you very much.<\/p>\n

I’m delighted to be here in Hong Kong.\u00a0 It’s one of
\nmy favourite places in the world, with a great cultural
\ntradition and certainly a leader in the creation of an
\nAsian Pacific digital culture.<\/p>\n

I wanted to spend a few minutes in providing my
\nobservations on where we are when it comes to cyber
\nsecurity and cyber threats and provide some thoughts.<\/p>\n

We meet at a time of significant focus on internet
\nsecurity.\u00a0 In my travels over the world, I have seen the
\ndirect and sometimes indirect results of this signal
\nglobal event.<\/p>\n

In Estonia, which boasts one of the world’s most
\nconnected economies, the country’s democratic
\ninstitutions, commercial organisations and news media
\nwere shut down for almost one week, due to a concerted
\ncyber attack.<\/p>\n

In China, the country’s major search engine,
\nBaidu.com, was shut down by the simple expedient of
\nhacking the DNS of the core domain name baidu.com.<\/p>\n

In other parts of Asia, it has been reported in the
\nnewspapers that about 30 per cent of official government
\nwebsites were infected with scripts that captured
\ninformation without the knowledge of the users.<\/p>\n

The Twitter service has been repeatedly hacked.
\nBoth on the site itself and most recently, through their
\nmanaged DNS provider.<\/p>\n

In countries in the Asian Pacific region and other
\nparts of the world, more user names and passwords were
\nstolen or compromised in 2009 than ever.<\/p>\n

I’m sure none of this has been lost on all of you
\ngathered here in Hong Kong.\u00a0 After all, you realise that
\nwhen a digital system weakens in one part of the world,
\nsecurity and credibility is hurt everywhere.<\/p>\n

My own company has been forged in the useable of
\nincreasing security threats.<\/p>\n

We manage critical internet structure, we manage
\ntechnology for about 10 per cent of all domains on the
\ninternet and respond to tens of billions of DNS queries
\nevery day.<\/p>\n

As a result, we are a constant target of cyber
\nattacks.\u00a0 Each day, we encounter takes and some days, we
\nencounter a combination of cyber attacks that wake some
\nof us up in 2 in the morning and keep up up thereafter.<\/p>\n

We work to endure the shock to our systems, learn to
\nanticipate more and growth in the teeth of ever
\nincreasing cyber storms.\u00a0 As we continue into this
\ndecade of the 2010s, I think we need to be careful in
\nhow we, as a global community, interested in the
\nsecurity of the DNS, marshall our resources and how we
\nspend our time and money.<\/p>\n

If you look at today’s threats, you hear a lot of
\nwords.\u00a0 Bot nets, mail ware, cyber terrorism,DDOS cyber
\nterrorism, clouds, a lot of different words and in some
\ncases, it’s almost an alphabet soup.<\/p>\n

In our changing internet, our first line of defence
\nmust be timely, accurate data that is shared,
\nintegrated, analysed and acted upon quickly and
\neffectively.<\/p>\n

Now, this generation on the internet faces a great
\ntest in the area of security.<\/p>\n

Unlike earlier digital security threats, we cannot
\ncount on an anti virus programme to bring this trouble
\nto a close.<\/p>\n

Right now, in distributed networks, and hidden
\nmessage boards, there are people planning to run massive
\nattacks on your systems.<\/p>\n

That is likely to be the case not just now, but 10
\nyears from now.<\/p>\n

In just the past few months, we have been reminded
\nagain of the challenge we face in protecting DNS users
\nagainst an enemy that is bent on hijacking them.<\/p>\n

While fragmented policy, fractious politics and
\nfragile protocols can often on security the hard work,
\nI think we need to be clear about what this moment
\ndemands.\u00a0 The internet as we know it can be affected
\nquickly, rapidly and comprehensively by focused and
\nunwanted attention on just a few problem areas.<\/p>\n

To respond to this, we need to come together to
\nbuild what I think is international cooperation against
\ncyber threats, based on the broad principles of
\nprotecting the consumer interest, preserving security
\nwithout compromising privacy and maintaining the
\ndemocratic principles of the internet.<\/p>\n

This responsibility is only magnified in an era
\nwhere governments are waking up to the power and
\npotential of the internet and technology gives a handful
\nof criminals the potential to do the great majority of
\nthe world tremendous harm.<\/p>\n

Let me be blunt.<\/p>\n

There are no neat or easy answers for some of these
\nproblems that I have raised in front of you.\u00a0 I wish
\nthere were.<\/p>\n

But I can tell you that the wrong answer is to
\npretend that this problem will go away if you maintain
\nwhat I believe is right now an unsustainable status quo.<\/p>\n

Internet security requires a delicate balance.\u00a0 On
\nthe one hand, a democratic internet depends on
\ntransparency.<\/p>\n

On the other hand, some information and techniques
\nmust be protected from public disclosure.\u00a0 For the sake
\nof security.<\/p>\n

Some information must be shared with appropriate
\nauthorities on an as needed basis.<\/p>\n

In many of these cases, money, freedom and sometimes
\neven lives are at stake.<\/p>\n

A decade into the new century, the internet is now
\ntaken for granted.<\/p>\n

Your children no longer are in awe of this
\ntechnology the way some of you were when it first came
\nabout.<\/p>\n

They just expect the internet to just work.<\/p>\n

This expectation has become one of the key drivers
\nof the global economy.<\/p>\n

To make the part of the internet system that we are
\nresponsible for, not just work, butt work well, you are
\nnow part of the human mesh that keeps this critical
\ninternet infrastructure viable and vibrant and each one
\nof us who is here is a member of a team that helps keep
\na big part of the internet up and running.<\/p>\n

Somewhere today, a relief worker is registering and
\nusing a DotAsia domain name, so that people can donate
\nto respond to an earthquake and help save lives a .IN
\ndomain name to appeal to customers using the somewhere
\ntoday a computer programmer is registering a dot info
\ndomain name to fulfil his dream.<\/p>\n

Somewhere today a tourism organisation is
\nregistering a .hk domain to showcase the beauty and
\nattractiveness of this low call region.<\/p>\n

That .in business, that .info entrepreneur and .hk
\norganisation depend upon all of us to keep the
\ninternet’s core, the foundation of the internet, running
\nwithout trouble, today, tomorrow and every day.<\/p>\n

Everywhere I go, there is now a great expectation
\nthat if you see technology on the internet, it will just
\nwork.<\/p>\n

And it will just work in a way that is more open,
\nmore secure and more accessible than any other system
\npreviously built.<\/p>\n

This expectation places upon us a great
\nresponsibility, a responsibility to strengthen our
\ndefences, to adopt safer computer security protocols, to
\nbuild strong alliances that foster open information
\nexchange.<\/p>\n

We cannot sacrifice the open internet and the values
\nand liberties that it entails in light of increasing
\nsecurity concerns, interoperability and accessibility,
\nin my opinion, must remain very high priorities, while
\nat the same time protecting security.<\/p>\n

As we gather here to share our thoughts on the
\ngovernance of the internet, the domain name system, and
\nto tomorrow’s computer systems and the internet, let us
\nreach for the same vision, high principles, hard work
\nand persistence that has brought us so far.<\/p>\n

Let us join hands across Hong Kong, across Beijing,
\nacross New Delhi, Dhaka, Singapore and Tokyo, as we go
\nabout building the future of the internet as we know it.<\/p>\n

The safety and security of tomorrow’s internet is
\nthreatened by more than just hacking and phishing
\nattempts.<\/p>\n

We need to first agree on common principles we
\nbelieve in.<\/p>\n

Principles that we promise to adopt and techniques
\nthat allow us to share, integrate, analyse and act on
\ntimely and accurate data.<\/p>\n

Speaking together on security, not getting scared
\nabout cyber threats, cyber war or cyber terror and
\nagreeing on common principles will ensure that there is
\na bright future ahead.<\/p>\n

I believe together we can security this future.<\/p>\n

Thank you.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Thank you.<\/p>\n

I think Christine.<\/p>\n

I’m just going to go, in the interests of time, run
\nthrough the speakers, then we can have a more
\ninteractive session at the end of the five
\npresentations.<\/p>\n

>> Christine Runnegar:\u00a0 Thank you very much.\u00a0 It’s a pleasure
\nto be here in Hong Kong and I would like to thank
\nDotAsia and our Hong Kong chapter for inviting me here
\nto speak to everyone.<\/p>\n

So thank you.<\/p>\n

The first step of today’s talk is mastering the
\ntechnology, so let’s see if I can get the slides to
\nwork.<\/p>\n

I’m going to be speaking about network confidence
\nand the Internet Society’s trust and Identity Initiative
\nand here is my first test on the technology.<\/p>\n

So let’s begin with a definition.<\/p>\n

What is confidence?<\/p>\n

Confidence is the belief that one can have faith in
\nor rely on someone or something.<\/p>\n

It’s a self-assurance arising from an appreciation
\nof one’s abilities.<\/p>\n

It’s also the telling of private matters or secrets
\nwith mutual trust.<\/p>\n

Such as you might have in a business partnership.<\/p>\n

It’s also a secret or private matter told to someone
\nunder a condition of trust.<\/p>\n

Such as your lawyer or your doctor.<\/p>\n

One of our strategic objectives for 2010 is to
\nactively promote and support the development of open
\nstandards, technologies, applications and policies that
\nengender trust in networked environments, to provide
\neducation and guidance on methods for ensuring full
\nparticipation from internet stakeholders and enabling
\nindividual accountability.<\/p>\n

Under our Trust and Identity Initiative, we have
\nthree major activities.\u00a0 They are understanding the
\ntrust ecosystem, which I will be speaking about,
\nsupporting open trust enabling solutions and stakeholder
\noutreach and support.<\/p>\n

So how do we achieve confidence?<\/p>\n

Confidence results from trust developed through
\npositive interactions experienced over time.<\/p>\n

If we go back to the definition of confidence, trust
\nis trust in oneself, trust in someone else or trust in
\nsomething.<\/p>\n

To increase network confidence, we must build upon
\nthe sesses of the internet model, including global
\nopenness and accessibility.<\/p>\n

We must support technologies that enable trust from
\nthe network layer to the application layer.<\/p>\n

We must encourage policies that take steps to
\nenable, extend, strengthen confidence with a chain of
\ntrust.<\/p>\n

And encourage the economics of innovation to support
\nvalue for all stakeholders.<\/p>\n

What are the components in the trust ecosystem?<\/p>\n

The components are technology, so things such as
\nprotocols, applications and hardware.\u00a0 There is also the
\nregulatory component and you’ll notice that under the
\nregulatory component, there is enterprise.\u00a0 Because
\nenterprise does play a role, for example, through self
\nregulation and coregulation.<\/p>\n

Then if we look at the third component, society,
\nit’s important to remember that there are not only on
\nline interactions, but off line interactions as well.<\/p>\n

What is trust?\u00a0 Trust is reliance on the integrity,
\nstrength, ability, et cetera of a person or thing.<\/p>\n

What contributes to that trust?\u00a0 What are some of
\nthe things?<\/p>\n

One of these things is authentication.\u00a0 Who are you?
\nWhat is the identity of the user and the device?<\/p>\n

Note there that I have used the word authentication.
\nIt’s important to remember that there is a distinction
\nbetween authentication and identification.\u00a0 Take, for
\nexample, a person who wishes to vote on an on-line
\nvoting system.\u00a0 It’s important that the system
\nauthenticate the person, but the person would want to
\nvote without revealing their identity, without being
\nidentified.<\/p>\n

Another factor which can contribute to trust is
\nauthorisation.\u00a0 Are you permitted?\u00a0 What privileges,
\nwhat access is allowed to the user?<\/p>\n

A third factor is encryption.\u00a0 Can others hear or
\nsee what you’re doing?<\/p>\n

Keep private that which should be kept private.<\/p>\n

Looking at the intersections and tensions, trust
\nencompasses several key components.<\/p>\n

It’s a willingness to take a risk based on shared
\ninformation.<\/p>\n

It’s the ability to judge and accept the level of
\nrisk in a given exchange.<\/p>\n

It’s also the ability to share sensitive information
\nwithin an agreed context.<\/p>\n

In on-line transactions, enabling a trusted
\ninteraction depends on a combination of security,
\nprivacy protection and importantly, useability.<\/p>\n

Looking at the constituent building blocks, then,
\nwhat are the buildk blocks of trust?\u00a0 They are security,
\naccountability, value enhancing and the evolving system.<\/p>\n

Just highlighting a couple of these items, if you
\nlook at accountability, for example, it’s important that
\nthe system be verifiable.<\/p>\n

If you think about it in terms of scientific
\nexperiment, we are all very familiar with the importance
\nof being able to reproduce the results of scientific
\nexperiment and the value that that provides to the
\nscientific community.<\/p>\n

Similarly, the system needs to be evolving.\u00a0 It
\nneeds to have provision for feedback, flexibility.\u00a0 It
\nneeds to be adaptive and evolving.<\/p>\n

It’s a balancing act in the trust ecosystem.<\/p>\n

A healthy solution includes all the components.
\nEach with varying weight according to their constituent
\nbuilding blocks.<\/p>\n

Consider two things.<\/p>\n

Suppose you have a healthcare advice forum.\u00a0 That is
\na place where you can go to obtain information about
\ndiseases or injuries.<\/p>\n

If you look at what components you would expect,
\nyou’d would expect a fairly sort of low tech solution,
\nrelatively low regulation and you’d have a lot of
\npersonal and community involvement.<\/p>\n

So what building blocks might you want for that sort
\nof system?<\/p>\n

You would probably want moderate security, several
\nreporting and you would want something that’s highly
\nflexible.<\/p>\n

By contrast, consider a healthcare records manager.<\/p>\n

That is a place where that records and stores and
\nmanages your personal medical records.<\/p>\n

In that situation, you would want a hi-tech
\nsolution, you want it to be highly regulated and you
\nwant to have high personal involvement, assuming you
\nhave some control over those records.<\/p>\n

In such circumstances, for trust, you want to have
\nhigh security, you would want to have regulated
\nreporting system, you want to make sure that the system
\nis stable and so forth.<\/p>\n

It’s also about maintaining the balance.<\/p>\n

Maintaining the balance or maintaining the balancing
\nof the blocks is as much an art as it is a science.<\/p>\n

The important thing to remember here is that there
\nare many possible successful configurations, not just
\none.<\/p>\n

Some blocks are going to be covariant and some are
\ngoing to be orthogonal.\u00a0 What do I mean by that.\u00a0 I mean
\nsometimes when you change one of the blocks it will
\naffect the others, whereas in other cases, there won’t
\nbe any need for change at all.<\/p>\n

Very importantly too, don’t forget, perceptions can
\nbe deceiving and they can become reality.<\/p>\n

The trust ecosystem also has a linked evolution.
\nConsider this example.\u00a0 Imagine a regulatory
\nenvironment, you have a new law and it necessitates
\na change in business practices, further accountability.<\/p>\n

This has a flow on effect to the technology
\ncomponent.<\/p>\n

To ensure compliance, we would require a change in
\na security mechanism and perhaps some modification of
\nsome functionality.<\/p>\n

This feeds down to the society component.<\/p>\n

The end result of the regulatory and technology
\nchanges may lead to a shift in the overall value in the
\nuser community affecting behaviour and also
\nexpectations.<\/p>\n

So the keys to building confidence, therefore, are
\na strong foundation built on open technology, best
\ncommon practices and proven methodologies, all
\nparticipants cooperating as valued stakeholders,
\noperational transparency with integrated feedback loops
\nempowering coordinated responses to emerging issues from
\nall participants in the ecosystem, functional frameworks
\nthat support deployments in various markets and
\njurisdictions, effective expectation management.<\/p>\n

What is expected and what is delivered must be
\nmatched?<\/p>\n

A mismatch in either direction can be disaster.<\/p>\n

So let’s turn to the internet ecosystem.<\/p>\n

Something which all of you would be very fact
\nfamiliar with.<\/p>\n

Now I will take you to the stakeholders in the trust
\nenabled ecosystem.<\/p>\n

They’re the same individuals, organisation and other
\nentities.<\/p>\n

Thank you.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Da thank you, Christine.
\nRemember when I started, I said that there were many
\nfacets, one facet came from Ram.\u00a0 He was talking about
\nbot nets, compromises to websites, hacking attacks,
\nDDOS, then we have Christine talking about trust,
\nauthentication, thoughts.<\/p>\n

Now for the third one, let’s see another perspective
\nof when you talk about security and governance of the
\ninternet.\u00a0 Please, Matthew.<\/p>\n

>> Matthew Chan:\u00a0 Thank you organisers to invite me to join
\nthe event.<\/p>\n

Everybody knows we are the antivirus company, but
\nactually our vision is absolutely provide the absolutely
\nsafe environment to the customer, to exchange data.<\/p>\n

Everybody knows the word virus.<\/p>\n

In the past, virus is damage the computer and the
\nnetworks, but now today, the virus is changed to botnet.<\/p>\n

Botnet, you can think about the network, one’s master
\ncan handle over a thousand computers to hit one of the
\ntarget customer.<\/p>\n

So on the other hand, the botnet is stealing the
\ndata and information like credit card information,
\nsocial security number, financial information,
\net cetera.<\/p>\n

Business and consumer, like inundated with data.
\nThe amount of the data running through today global
\nnetwork is currently being measured in petabytes.<\/p>\n

Not only there’s a lot of data, but it’s now mobile.<\/p>\n

I saw everybody have a notebook here, net book,
\nsmart phone, all is mobile device are there.<\/p>\n

All capable of receiving data and using applications
\nthat reside in a cloud.<\/p>\n

Data is no longer reside on just one server or
\ndevice.<\/p>\n

So how can we ensure that such vast amounts of
\ninformation are secure?<\/p>\n

We believe the answer is in the cloud.\u00a0 That is
\ninternet cloud or we can say the public cloud.<\/p>\n

To protect against threats coming from the cloud,
\nTrend Micro turn to the cloud itself to deliver the
\ntrend microsmart protection network.<\/p>\n

Some of the industry argue the cloud computing will
\nresult in security consolidation, but I don’t see this
\nhappening.<\/p>\n

Whenever there is the computing, how can security be
\npossibly consolidated.\u00a0 Security needs to be at every
\nlayer to be effective.<\/p>\n

What matters most is the protection of the data.<\/p>\n

Don’t care where the data is coming from, but they
\ndo care how it is protected.<\/p>\n

Most of the businesses or stakeholders thinking
\nabout where is my data?\u00a0 Who is accessing my data?\u00a0 Is
\nmy data being modified?<\/p>\n

This is a new environment requires security
\ninnovation.<\/p>\n

Solutions will need to address the issue of
\nprotecting the cloud infrastructure itself.<\/p>\n

Trend Micro, our understanding, understands that
\ninnovation has to be evolution rather than revolution.<\/p>\n

IT firms want to leverage the cloud, but need.<\/p>\n

They also realise that if they don’t make a secure
\ncloud available to their internal customer, that
\ncustomer will go around them and get access to the cloud
\nwithout them and perhaps without security that requires
\nto ensure the great protection.<\/p>\n

I thinks this Trend Micro position, within 2
\nminutes.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Thank you, Matthew.\u00a0 That’s
\nvery kind of you.<\/p>\n

Thomas?<\/p>\n

>> Thomas Parenty:\u00a0 I would also like the thank the
\nconference organisers for the opportunity to talk to you
\nthis morning and also as one of the few Hong Kong people
\non the panel, to welcome the rest of you to the city and
\nyes, the food is very good.<\/p>\n

What I would like to talk about is security,
\ninformation from a slightly different perspective, not
\nso much from the perspective of issues with respect to
\nthe underlying infrastructure, but more from an
\norganisational perspective, specifically not how to
\norganise things, but rather from the perspective of
\norganisations.<\/p>\n

I’m going to be talking about sort of trends in the
\nkinds of security threat, security crimes that are
\nexisting and that I see showing up in the near future.<\/p>\n

One of the cautions I want to say is that whenever
\npeople talk about computer crime or computer dangers,
\nthere’s this tendency to be somewhat alarmist.<\/p>\n

I’m simply going to be describing what I see as
\nhappening and what is possible, but not something that
\nyou should necessarily lose sleep over.<\/p>\n

Also, to put things in context, there is a story<\/p>\n

I heard a while back, I can’t remember the origin of the
\nstory, but if you and a friend are walking in the woods
\nand you happen to run into a bear, it’s not necessary
\nthat you actually run father than the bear, just faster
\nthan your friend.<\/p>\n

With respect to certain internet issues, you just
\nwant to make sure you’re a little faster.<\/p>\n

To simplify the world, in terms of threats, one can
\ntalk about insider threats and outsider threats.<\/p>\n

The particular kinds of attacks up until now that
\nyou’ve been subject to, either inside or outside depend
\nvery much on what the target of the attack is.\u00a0 For
\ninstance, if the attacker wants something that is easily
\nidentifiable, such as a credit card number, a social
\nsecurity number, that’s a relatively easy thing to do
\nfrom the outside.<\/p>\n

Actually, newspapers are full of stories of people
\nfrom the forger Soviet union hacking into computers
\nhalfway around the world to harvest credit numbers that
\nare then sold to other people who then sell them to
\nsomebody else who then actually commit the crime.<\/p>\n

If you look on the other side, let’s say concern
\nabout intellectual property, trade secrets, corporate
\ninformation, that has, up until now, tended to be more
\nof an insider crime.<\/p>\n

Part of the reason is that to be able to identify
\nwhat’s important versus what isn’t, requires a lot of
\ncontextual information that somebody halfway around the
\nworld isn’t necessarily going to know.<\/p>\n

What I’ve noticed recently is there’s starting to be
\na merging of these two sort of sources of attack, where
\nyou have the actual attack coming from outside using
\nvarious forms of mail ware or phishing or traditional
\nattacks that have come from the outside that tools from
\nmy panellist can help address.<\/p>\n

But it’s those attacks are being guided by insider
\ninformation in order to know where is the specific
\ntarget within an organisation that I should look for.<\/p>\n

The recent hacking attacks on Google and other
\ncompanies actually are examples of this sort of merging
\nof the insider and outsider.<\/p>\n

So it’s something that for an organisational
\nperspective, it used to be some simple.\u00a0 We had outsider
\nattacks, we had insider attacks, but now we have this
\nmerging of them.<\/p>\n

So that’s one trend that I have seen that is — that
\nactually is in practice today.<\/p>\n

The second thing that I would like to talk about are
\nthreats that we can anticipate.<\/p>\n

It’s something that historically, there has been
\na division between the physical security world and the
\ndigital or information security world.<\/p>\n

Being in the information security world, I sort of
\nlook down at the people who look at CCTVs and if the
\nguard is in the right place and things like that, though
\nI do recognise the importance of them.<\/p>\n

However, with the emergence of IPV6 plus very low
\ncost, low computational or I should say computationally
\nefficient wireless technologies that distinctions
\nbetween the physical world and the digital world is
\ngoing away.<\/p>\n

Specifically, one particular instance of technology
\nthat I’m talking about is a wireless protocol that goes
\nby the name Zigby.<\/p>\n

Think of WiFi, the WiFi alliance, but now think of
\nit in terms of wireless devices that are very, very
\nsmall.<\/p>\n

Ones that you can put in very small devices like the
\nlock to your front door into your fire alarm, into your
\nrefrigerator if you wanted it.<\/p>\n

But also more significantly, into critical parts of
\ncritical infrastructure, such as controllers for
\nfloodgates for hydro electric dams, in controllers for
\nelectric metres.<\/p>\n

What we’re going to find going forward is that the
\ncontrol over physical devices is now being controlled
\nand enabled through the internet that we have — I was
\ngoing to say that we have grown to love, I’m not sure
\nthat is quite the characterisation, but that we have
\ngrown to rely on.<\/p>\n

So there will be a whole new host of security issues
\nthat we’ll have to deal with that very, very much affect
\nthe physical world in which we live.<\/p>\n

Again, looking at sort of categorisation of the
\nkinds of threats that we’ll look at, I would say look at
\nthe motivations of those that might be perpetrating the
\nattacks.<\/p>\n

I’ll just make two sort of choices.<\/p>\n

One of which is, if there is somebody who has
\na criminal intent, then in terms of location of the
\nattacker and location of the attack, I think actually
\nthey could be sort of fairly close.<\/p>\n

Not that I would do this and not that I would
\nrecommend this for you, but if in the future, you would
\nlike to get into the burglary business, then looking at
\ncompromising wireless networks that control physical
\nlocks is actually a good way of going about it, much
\neasier than dealing with old lock picks, although they
\ndo have their charm.<\/p>\n

If on the other hand I am looking from the
\nperspective of somebody who is trying to engage in some
\nsort of extortion or terrorist attack, where the goal is
\nnot to open a door into some physical environment into
\nwhich I want to steal something, but rather that I want
\nto disrupt some critical infrastructure, they can be
\ncompletely on the other side of the world.<\/p>\n

I would say that, again, not meaning to be alarmist,
\nbut rather to simply provide another perspective of
\nthings that we’ll have to look forward to, is the
\nmerging of insider and outsider threats and the merging
\nof physical and digital security issues.<\/p>\n

With that, thank you very much.\u00a0 And, Michael.<\/p>\n

>> Michael Mudd:\u00a0 Thank you very much, Thomas.<\/p>\n

Again, thanks very much for giving us the
\nopportunity to be here.<\/p>\n

I’m the industry association guy, so that’s why I’m
\ncoming from.<\/p>\n

I would like to address very quickly, because I know
\nit’s only myself separating you from lunch.<\/p>\n

Threats, authentication and network confidence.<\/p>\n

The concentration of criminals into transnational
\ngangs is not unusual.\u00a0 We have seen the mafia before.
\nWe have seen triads.\u00a0 What we now have is about
\ntransnational gangs who make it a business from separate
\nyou, the internet user, from your money or from your
\nidentity, which is then used to separate you from your
\nmoney.<\/p>\n

So money is the underlying motive for this from the
\npoint of view of regularly organised criminals.<\/p>\n

I shan’t talk about cyber terrorism.\u00a0 That’s
\ncompletely different.<\/p>\n

With ID theft now topping about 9 million in the
\nUnited States, this is very costly.<\/p>\n

It takes on average nine months and about $5,000 to
\nfix a stolen identity.<\/p>\n

So this is very important.\u00a0 This is where education
\ncomes into play.<\/p>\n

That is really what I think is part of the softer
\nissue, the nontechnical issue, which needs to be
\naddressed as we move towards IPV6 and the internet of
\nthing, as Thomas mentioned.<\/p>\n

New technology, Zigby, et cetera, will change just
\nabout everything and everything that we do.<\/p>\n

Clearly, there needs to be close coordination
\nbetween industry, industry groups, regulators and law
\nenforcement at all levels, in particular in Asia,
\nI believe that the multilateral organisations such as
\nAPEC, ASEAN which all have working groups which are
\naddressing various things are very important and not the
\nleast of which is working with the banking system.<\/p>\n

The FATF which was the legislation on terrorist
\nfunds transfers, money laundering, has been very
\nsuccessful in closing off this, also for drug smugglers
\nand other criminals in the real world.<\/p>\n

I believe that this can be extended to the cyber
\nworld, because again elicit funds do have to be moved
\narticled the world, although the sums are generally
\na lot smaller.<\/p>\n

Continued collaboration, working with the ISPs and
\non-line security companies is also vital.<\/p>\n

We also have to look at some of the other issues
\nwhich are coming across on cross-border and not just the
\ntheft I have name, but also such areas as libel, the
\ncreation of fake identities on-line, the rise in crimes
\nwhich actually have been brought forward from the
\nincrease in social media.<\/p>\n

We have seen and this is going to be addressed later
\non, social media on line bullying, these types of things
\nwhich are very important to address.<\/p>\n

In particular, the education of children for social
\nmedia.<\/p>\n

When you look at the fact that the advice on face
\nbook is that nobody under the age of 13 should register,
\nalthough of course there’s no reason that anybody can’t,
\nit is clear that education should start at 12.<\/p>\n

Education should be very important with respect to
\nthe parent as well.<\/p>\n

I’m a parent.\u00a0 I educated my kids at a very early
\nage not to go and play in the road.\u00a0 This is not a good
\nidea.<\/p>\n

There is danger there.<\/p>\n

I think that today, this has to be extended into the
\non-line world as well and that a lot of parents are
\nabrogating their responsibilities.<\/p>\n

This brings me down to the final thing, which is
\nnetwork confidence.<\/p>\n

It’s the same as any trust reliance service.\u00a0 For
\nthose of you that threw to Hong Kong, you made
\na decision to fly on an airline that you trust.<\/p>\n

There are airlines that you don’t trust and ones
\nthat you do and I’m pleased to see that you all made it.<\/p>\n

This is based on their experience.<\/p>\n

When we start to look at the growth of the internet,
\nthe fact that it came out of government programmes,
\nacademic programmes, to where we have today, the private
\nsector has played a major role in the development of the
\ninfrastructure, the regulatory frameworks that were
\nadopted by governments.<\/p>\n

Indeed, the formation of the IGF itself is very
\nimportant with the support of the commercial sponsors
\nthat we see here today.<\/p>\n

Therefore, the system of governance, of the IGF, of
\nthe internet, and as put forward through the IGF, we
\nbelieve is the very important, that the
\nmulti-stakeholder basis of governance should be
\nmaintained and that indeed, the funding which is put
\nforward should be also contributed by the public sector,
\nas well as the private sector, but considering that most
\npublic sector funds are strained today, that the private
\nsector perhaps has a greater role to play.<\/p>\n

With that, I think I better stop.\u00a0 Thank you.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Thank you very much,
\nMichael.<\/p>\n

So there you have it, ladies and gentlemen.<\/p>\n

Five different people on the panel and five
\ndifferent perspectives when we are talking about
\nsecurity.<\/p>\n

I think that shows the complexity of the issue, as
\nwell as the challenge that faces all of us who are
\nlooking at it.<\/p>\n

I think I would like to use this opportunity just to
\nrefresh some of the points, the highlights that each
\nspeaker has brought out and invite you to engage the
\npanel in the usual manner and form.<\/p>\n

We have approximately — I will try and stop by
\n12.30.\u00a0 We have 15 minutes to go.<\/p>\n

Thank you to all the speakers for your cooperation
\nin speeding up the presentations.<\/p>\n

I am going to stand up.<\/p>\n

What is interesting is I started talking about
\ninfrastructure, Ram started talking about applications,
\nChristine was talking about confidence in the network.<\/p>\n

So we move from physical security to things that we
\nuse on the net, to our reliance on the systems.<\/p>\n

Matthew talked about where they think the threats
\nwill be, cloud computing and how to manage viruses.<\/p>\n

Thomas talked about something interesting.\u00a0 Looking
\nat the future possibility, thinking about security from
\nan inside versus outside perspective and combining it
\nwith the ral digital and real world.<\/p>\n

Of course, Michael was talking about the education.<\/p>\n

So many facets, many perspectives, many layers.<\/p>\n

It’s almost like when you go to your physical world,
\nwhen you talk about security, you enter your house, you
\nprobably have your electronic gate.\u00a0 That’s one level of
\nsecurity.<\/p>\n

You move into your front door.\u00a0 That’s another level
\nof security.<\/p>\n

Then you move into the house, there’s probably
\nanother level of security, camera or something in the
\nhouse.<\/p>\n

So that seems to be what’s coming.<\/p>\n

So any questions down at the back on the right-hand
\nside, left-hand side?\u00a0 Feel free.\u00a0 You have an eminent
\ngroup of panel its here.<\/p>\n

Any insights, concerns, thoughts that you might want
\nto pick up from this panel?\u00a0 Or ask in.<\/p>\n

>> Stephen Lau:\u00a0 I have a specific question to the panellists
\nand a general one to the entire panel.<\/p>\n

The first one is to Thomas.\u00a0 When we talk about
\ninternet of thing, of the trend moving towards, even
\nlooming, not danger, looming phenomena is internet of
\npeople, through people talking about instead of being —
\nsort of invasive of kind in plants and all that.<\/p>\n

How do you see in terms of security protection, with
\nthis sort of trend, do you see any sort of new phenomena
\nand how do we protect ourselves with respect to that?
\nThat’s my specific question.<\/p>\n

On a general question is this.\u00a0 In global IGF, in
\na lot of forums, we talk about global issues, obviously
\nwe do actually using cases with respect to particular
\nincident or economy or even a region.\u00a0 This is
\na regional IGF for Asian Pacific.\u00a0 We are talking about
\nregional issues.<\/p>\n

I was wondering from the panel whether in fact are
\nthere anything, any specific issues in Asian Pacific
\nrelating to cyber security which are unique or which are
\nmore sensitive which are more prominent upon which we
\ncan understand and can focus ourselves in our future
\nendeavourses?<\/p>\n

Thank you.<\/p>\n

>> Thomas Parenty:\u00a0 First off, I would have to say, thank you
\nvery much for asking an incredibly hard question.<\/p>\n

See if I accept another panel invitation.<\/p>\n

Basically, when I say a hard question, the solution
\nto this problem is incredibly hard.\u00a0 To put this in sort
\nof a more concrete example, something that people are
\ndealing with right now is a lot of implanted medical
\ndevices are accessible via wireless.\u00a0 Pacemakers would
\nbe one example.\u00a0 You have a very, very real problem of
\nhow can doctors under the proper circumstances access
\nand cross this device so as to — as part of providing
\nmedical care, while preventing sort of bad guys from
\nessentially remotely killing somebody by turning off
\ntheir pacemaker.<\/p>\n

Unfortunately, there are no good solutions right
\nnow.\u00a0 Actually, one proposed solution and I think this
\ncame out of France, although I couldn’t say exactly, was
\nto basically tatoo on somebody’s body in an ink that
\ncould only be seen under ultraviolet light the password
\nto the device, to try to balance the fact that you don’t
\nwant to have a device that’s completely unprotected,
\nbecause then bad things can happen, but you don’t want
\nit to secure that when somebody is needing medical care,
\nthat the doctors are saying, like, how do we get in
\nhere?<\/p>\n

It’s something, speaking as a technologist, this is
\nan incredibly hard problem.\u00a0 I’m at a loss as to what
\na sort of good solution is.<\/p>\n

Ultraviolet tatoos, well, it’s something that it
\ndoes have some appeal, but it’s not really a long-term
\nsolution.<\/p>\n

So I would say that for any of you people who are
\nlooking at areas in which you could actually do work in
\nthe information security field, that would have very,
\nvery prominent sort of social benefit, here is a problem
\nfor you to look at.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Thanks, Thomas.<\/p>\n

>> Ram Mohan:\u00a0 Thank you.\u00a0 This is to address the question
\nabout, you know, potential unique things that are
\nhappening here in the Asian Pacific region.<\/p>\n

At least from my perspective, there are two things
\nI see and I know there are people here in the audience
\nwho may bring their unique perspective and add their
\nexperience here as well.\u00a0 There are ISP folks and folks
\nfrom cyber cafes, other areas.<\/p>\n

One things that I see that seems pretty unique is
\nthat in recent times, if you look at the origin of DDOS
\nattacks or the origin of where the botnets are coming
\nfrom, often you find the alleged source of it tends to
\nbe from the Asia region, a lot of it, and what happens
\nis that in the global press, that gets converted into,
\nyou know, this country or this region is the source of
\nthis problem with internet security worldwide.<\/p>\n

Asia then gets probably the biggest amount of
\nburden, if you will, in that area than any other part of
\nthe world.<\/p>\n

I think that’s somewhat significant.<\/p>\n

I do know that there are others here in the
\naudiences who might have a different perspective.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Switching hats, speaking as
\na board member of IMPACT, what IMPACT does is it gets
\nfeeds from all its private sector members, Kaspersky,
\nTrend Micro and all of that, in terms of the latest
\nbotnet attack, the patterns and profiles of signatures
\nof viruses and all and also the attacks and the
\nincidents of attacks.<\/p>\n

Statistically what we have seen, is Asia has become
\na hub or confluence point where attacks emanate from.<\/p>\n

That is going to have other consequences on us,
\npeople who operate ISPs, services, in Asia, because we
\nare going to be eventually, if we don’t do something
\nabout it, labelled as a potential security risk, it’s
\ngoing to cost us more to connect with perhaps networks
\nin Europe, in America and so on.<\/p>\n

That is one area which I think really needs to be
\nlooked at.<\/p>\n

Maybe from a business continuity standpoint.<\/p>\n

Anyone else on the panel?<\/p>\n

Charles, you had a question?<\/p>\n

>> Charles Mok:\u00a0 .\u00a0 I just have a very quick question about
\nwhat do you see as the most urgent issue in the AP
\nregion that you see has to be dealt with in this
\nparticular concept about security.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 The most urgent issue for
\nthe AP region, one each.<\/p>\n

Since the panel thinks so, we have maybe about five
\nmore minutes.\u00a0 Summary question, one of the panellist
\nsays.<\/p>\n

Any other questions before we come to that?<\/p>\n

>> :\u00a0 My name is Robert Cara, I’m with Freedom House.\u00a0 It’s
\ngreat that all the panellists are speaking on different
\nperspectives and the thing I found nice at the beginning
\nwas the talk about multi-stakeholder approach in regards
\nto security and what I’m struck in some of the comments
\nyou just made, Ram, in regards to some of the perceived
\nthreats are coming from Asia, but also a variety of
\nactors in Asia are also being particularly targeted.\u00a0 So
\nwhat I’m interested in hearing is to what extent the
\ngovernments and business sector seems to have a place
\nwhere they can go to for sharing the information about
\nattacks, getting trained.\u00a0 I didn’t hear civil society
\nand there are a lot of commands from that type of group
\nin the region and I’m just curious what efforts are
\nbeing done, what IMPACT is doing and if not, is that
\nsomething that they could do, doing forward, working
\ntogether, because I think the threats, whoever gets
\nattacked first, might be an early sign of other actors
\nbeing attacked as well and then ISPs having to deal with
\ngigabit attacks will cause all the sites hosted there
\ngoing down as well.<\/p>\n

So I’m just curious as to the civil society aspect
\nand what that could be done going forward.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Thank you, Robert.<\/p>\n

Sorry, you wanted to respond, Paul?<\/p>\n

>> Paul Wilson:\u00a0 I wanted to make a comment.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Who was the second in line?
\nJust very quickly, I think we’ll take the question.<\/p>\n

>> :\u00a0 I’m Atit Sri Unkun? or advertise sir from Bangkok<\/p>\n

Thailand, working for a Thai network.<\/p>\n

I just wonder from the panel, I see something
\ncontradicting, like, for example, Ram say that to
\nprotect the security of the internet, for example, we
\nhave to make it like protect it to be like sort of
\na secret, but at the same time, Christine from Internet
\nSociety say we are all to making trust equal system, we
\nhave to go for open standards, open technology.\u00a0 Does
\nthat contradicting to each other?<\/p>\n

>> Ram Mohan:\u00a0 Let me quickly respond.\u00a0 I actually think that
\nthat is the fundamental balance that has to be struck in
\ndoing internet security.\u00a0 In some cases, as you find out
\ninformation about an attack, you want to keep some of
\nthat private, so that you don’t give away everything.<\/p>\n

But the really important thing and one of the points
\nI was making was that that has to be totally balanced
\nagainst internet democracy and openness and that piece
\nof trust.\u00a0 Without one, the other becomes basically an
\ninternet dictatorship.<\/p>\n

>> Thomas Parenty:\u00a0 I was going to say, to reply to that from
\na slightly different perspective, more of if you are
\ndesigning a system that needs to be secure, you want to
\nminimise the number of things that need to be protected
\nin order for that security to hold true.<\/p>\n

So, for example, in the area of encryption, you want
\nit to be that all of your security is based on the
\nstrength of the — the secrecy of the key, not on the
\nsecrecy of the algorithm, because if you’re relying on
\nthe secrecy of the algorithm, that is a much more
\ndifficult task because all these people know about it
\nand nobody can keep their mouth shut.\u00a0 In terms of
\nopenness versus secrecy, in order to protect yourself,
\nthere are some things that need to be secret.\u00a0 You
\nabsolutely want to minimise what those are, minimising
\nthose dramatically increases the level of protection you
\nhave.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Thank you.\u00a0 I’ll just very
\nquickly respond.<\/p>\n

There are other organisations at the moment which
\nI think engage the civil society a lot closely, IMPACT
\nat the moment is focusing on, because of the limited
\nresources, is focusing on dealing with governmental
\nissues for the moment.<\/p>\n

I think the last thing you want is governments going
\naround trying to do things themselves without any
\neducation and that’s one of the reasons why IMPACT came
\nout very quickly, to try and at least help fill that
\nvoid, because in the government system, I think you
\nwould have heard from Markus this morning, that it’s
\na very complex set of layers and layers of governance.<\/p>\n

Paul, you had a question.<\/p>\n

>> Paul Wilson:\u00a0 I just wanted to make a point again about
\nthe stakeholders who we need to address here and there’s
\none group of stakeholders who are the internet operators
\nan engineers.<\/p>\n

The internet is not created by policy analysts, not
\ncreated by an IP address registry, it’s not created by
\nsecurity experts.\u00a0 It’s created by a group of foot
\nsoldiers or coalface workers who are the engineers who
\nactually make the network that we all use.<\/p>\n

The different between a network that is well run by
\nfully trained expert engineers and one that is not is
\na difference in cost, efficiency, critically it’s
\na difference in security as well.<\/p>\n

The training and education challenge of getting to
\nevery one of those engineers, the foot soldiers in whose
\nhands are the routers, the DNS servers, even are you
\npiece of equipment that we rely on is a really huge
\nchallenge and I think that simply the task of training
\nis one that needs to be really emphasised and rolled
\nout.\u00a0 It’s one that’s been going on for many years
\nthrough on in profit and voluntary activities, such as
\nrun by the Internet Society, such as the Apricot
\nconference, but it really must not be forgotten, because
\nwe can talk about policy and analysis and all sorts of
\nthing, but on the ground there really is a big
\nchallenge.<\/p>\n

In my experience, in this region, the pace of growth
\nof the internet is so rapid, the dearth of trained human
\nresource is so severe, the mobility of professionals to
\nmove from one job to the next, one company will train
\nand then lose those trained experts to others and it’s
\na real challenge.\u00a0 It’s something that we really mustn’t
\nforget.<\/p>\n

Thanks.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Thank you, Paul.<\/p>\n

There were a few others.<\/p>\n

>> :\u00a0 I’m Sue Ng from Malaysia.<\/p>\n

I’m just want to draw attention to the fact that who
\ndefines cyber threats?\u00a0 What is the definition?\u00a0 Because
\nthere are some repressive governments that use that term
\nto silence dissent and it’s interesting that the chair
\nbrought up the issue of educating the government,
\nbecause I don’t know why the MCMC is going after an
\non-line news site for reporting, for doing its job of
\nreporting something that could be sensitive to the
\ngovernment of the day and the tie example as well.
\nThanks.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 That is interesting.<\/p>\n

Thank you.<\/p>\n

And you know who is the guy?\u00a0 Me.<\/p>\n

I’ll respond to that bilaterally.<\/p>\n

That goes to show that, you know, when you talk
\nabout security, everyone has their own take of what is
\nsecurity.<\/p>\n

I think just sort of coming back to the issue at
\nhand, some will look at content issues as relating to
\nsecurity as well.\u00a0 I mean, I’m, for example, I just came
\nback from Geneva, the protection initiative by the ITU.
\nThat was a whole debate by governments there was about
\nwe need to protect children on-line.<\/p>\n

I don’t deny the fact that the point she raised,
\nthere were some people in government who felt that
\ncontrol over information is a security issue.<\/p>\n

But there are others who felt that that was not the
\ncase.<\/p>\n

I think more to the point of this AP region, perhaps
\nnow is an opportune time to come to Charles question.
\nIf we were to try and, you know, with all that that’s
\nbeen floating about in the last half an hour or so in
\nthe dialogue, if we were to try and look at the priority
\nareas for this region, in relation to security, what
\nwould it be?<\/p>\n

Would it be training and education that Paul talked
\nabout?<\/p>\n

Would it be what Stephen talked about?\u00a0 Shall we be
\nfocusing there, because this particular region also
\nmanufactures a lot of products, applications services.<\/p>\n

Most of the devices that come up with V6 capability
\nis probably going to be manufactured in this region.<\/p>\n

Or would it be something a along the lines of
\nbuilding trust and confidence in the system, because we
\nhave a lot of people coming on line with many
\ngovernments in this region trying to push broadband
\npenetration up and yet not having the right people with
\nthe right skill sets managing these networks.<\/p>\n

So everywhere, as you keep growing these networks,
\nyou find that vulnerabilities increase, because people
\njust don’t know how to handle it.<\/p>\n

Where would that be?\u00a0 I just like to invite maybe
\na few immediate reactions from the floor and then go to
\nthe panellists before I sum up.<\/p>\n

>> :\u00a0 My name is yap sue sing.\u00a0 I’m representing Asian Forum
\nfor Human Rights and Development, based in Bangkok.<\/p>\n

It was very interesting to listen to some of the
\npanellists talking about this cyber threats and cyber
\nattacks and how to strike a balance.<\/p>\n

Ram talks about striking a balance between this
\nsecurity and also democratic control of these tools.<\/p>\n

But I agree to that point, but I would just like to
\nalso add that it is also important to strike a balance
\nbetween security and fundamental human rights.<\/p>\n

Because I think a lot of times we are seeing is is
\nthat a lot of time governments are using the pretext of
\nsecurity to undermine human rights, the rights to
\nprivacy, the right to freedom of expression and freedom
\nof information to cover up corruption, scandals.
\nI think this is very fundamental and so in terms of
\nI think when we talk about internet management and
\ngovernance, this is one of the key principles that
\nshouldn’t be left out when we think about the management
\nof internet.<\/p>\n

So it is important I think democratic control and
\nhuman rights is two different concepts and it has to be
\ndifferentiated, because democratic control talks about
\nprocesses, it talks about decision making and democratic
\ncontrol sometimes can be contradicting with human
\nrights, because a lot of times, the rule of majority
\noverrule the rights of the minority or individual, very
\nbasic human rights.<\/p>\n

So I think it is very key and important to also
\nemphasise the principles of human rights.<\/p>\n

The other point is about cyber threats.\u00a0 From the
\npanel, from the discussion I gather that the paradigm of
\ntalking about cyber threats and attacks is more from the
\nstate perspective, to control, to minimise security.<\/p>\n

But there is also a lot of threats that is sponsored
\nby states or even initiated by states to a threat of
\nuser of internet, especially when it comes to very
\nfundamental rights of the people.<\/p>\n

How do we address that kind of cyber threats?
\nBecause for governments, it seems there is a platform
\nfor them to address these issues through complaint about
\nthese issues and to discuss how to have a global
\nstructure to address this issue, but when it comes to
\nthreats that is created by governments, where is the
\nplatform or what is the mechanism to address this issue?<\/p>\n

Thank you.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 I don’t think anyone is
\nresponding to that one.<\/p>\n

Any other comments?\u00a0 Sorry, I have two more.<\/p>\n

I’m just trying to take up notes and sum up.<\/p>\n

>> :\u00a0 This was in response to the comment made by the speaker
\nwho spoke.<\/p>\n

Earlier, this initiative in Brazil —<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Where are you from?<\/p>\n

Parminder:\u00a0 Parminder from an NGO IT For Change in India.<\/p>\n

The Brazil, there is an initiative by government and
\ncivil society to start looking at internet governance,
\nnot from a control and security point of view, but civil
\nrights point of view and address the same set of issues
\nand they have come up with a draft and what is
\nsurprising and good is that the same kind of issues do
\nget addressed even from a rights basis, even the right
\nto security is a right and they have come up with
\na draft which looks at security issues from a rights
\npoint of view and I thought that could be something
\nwhich people can take note of.<\/p>\n

Thank you.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Thank you.\u00a0 I see a trend
\ncoming up.<\/p>\n

>> :\u00a0 Dale Johnson from Hong Kong.<\/p>\n

I want to thank you the panellist, I think they
\nraised some very good points in their presentations from
\na diverse range of perspectives.<\/p>\n

A couple of points I want to raise is, the topic of
\nsecurity in itself.\u00a0 It means so many things to so many
\ndifferent people.\u00a0 We will never solve the problem
\nwhilst we’re taking it in such a broad specifictive.\u00a0 We
\nhave got child on line protection down here, we have
\nhardware infrastructure protection over here.\u00a0 What
\nmakes it even more complicated is all the volunteer
\nevents versus the standards efforts versus the private
\nefforts and it’s very, very challenging.<\/p>\n

Going back to some of the points the panel itself
\nmade, what are the fundamental principles upon which we
\nare working here?\u00a0 What are the actual assets that we
\nare going to protect?\u00a0 Let’s get the facts down on the
\nproblem, because I don’t think we have solved anything
\nhere.<\/p>\n

We can come back here in five years’ time and we
\nwill be in the same position and having the same
\nconversation and not being any more advanced apart from
\nDNS may be in place.<\/p>\n

The other thing is, solving the problems of today,
\nthe pace everything is moving, the problems of today are
\nprobably already gone by the time we get around to
\nsolving them.\u00a0 Why don’t we start thinking about
\narchitecting security into whatever is going to be
\ncoming in the future, which is part of what we’re doing.<\/p>\n

The example of running faster than the bear.\u00a0 That’s
\na very good example.\u00a0 How can we security an environment
\nwhere security is only as strong as the weakest link?
\nSo all these big ISPs, for example, are doing really
\nwell, but all the small ones are doing very poorly, so
\nthe back door infrastructure are coming into the weakest
\nlink is what’s called compromising the efforts of the
\ngood people.<\/p>\n

The other aspect is how do we develop all these
\nprinciples and everything when we have to take into
\nconsideration developed nations and undeveloped nations,
\nbecause olof them are all using this infrastructure more
\nand more commonly.<\/p>\n

I just want to put all those thoughts on the table,
\nbecause it is a very big challenge and I think we need
\nto need to start narrowing down the challenge into
\ncategories of security rather than tackling the concept
\nof security.<\/p>\n

Thank you.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Absolutely.\u00a0 Thank you,
\nMr Johnson.\u00a0 I don’t think there’s anyone who is going
\nto be agreeing with you there.\u00a0 The question is: where
\ndo we start?<\/p>\n

Any other comments or reactions?<\/p>\n

Then I would just like to come back to Charles’
\nquestion and then after that, respond to one or two
\nobservations I have.<\/p>\n

I think one of the things that I’ll be honest,
\nI didn’t see coming, on this panel as we were preparing,
\nwas looking at the issue from a civil liberties or civil
\nrights standpoint or human rights standpoint.<\/p>\n

I think when we were preparing for the panel, a lot
\nof the questions we were thinking of were physical
\ninfrastructure, physical security, application security,
\nmachine to machine communications and all of that.\u00a0 So
\nthank you for your inputs.\u00a0 I think that is quite
\nuseful.<\/p>\n

You are quite right, the Brazilian delegation
\nI think in many of their iterations,\u00a0 did start from
\nthat environment.<\/p>\n

If we were to look back at the whole plethora of
\nissues that have come up, we are not going to solve this
\nissue of security in one day, nor are we going to solve
\nthis issue of security in one meeting, but I think it
\nhas sparked off quite a bit of debate, quite a bit of
\ndiscussion.<\/p>\n

What the point of the exercise is now that we have
\nstarted the engagement, we have to continue to engage in
\nthis bottom up process that I think Markus is talking
\nabout.\u00a0 This is the very first time we are doing it in
\nAsian Pacific.<\/p>\n

But if I could just quickly ask each one, if each
\none of the panellists just want to put forward a prior
\nto issue for consideration, not necessarily for
\nrecommendation, but just for consideration of people in
\nthis room, in terms of what may be a prior to coming
\nforward in the next couple of years, what would it be,
\nfrom this region?\u00a0 Let’s start with Michael.<\/p>\n

>> Michael Mudd:\u00a0 Thank you very much.\u00a0 I look at it from the
\npoint of view of another infrastructure that we trust
\nimplicitly or at least we did, the banking system.<\/p>\n

There are two areas of security in the banking
\nsystem.\u00a0 The individual security and the physical
\ninfrastructure, the bank, their computer systems
\nthemselves.<\/p>\n

Then there is the security of the governance system
\nof the banking system.<\/p>\n

We have seen that that has failed in several areas
\nrecently.<\/p>\n

So for me, it is quite simply the governance of the
\ninternet which is the most important area to examine and
\nto make sure that we do have a multi-stakeholder
\napproach to ensure the security of the governance
\nsystem.<\/p>\n

>> Thomas Parenty:\u00a0 Even though I would like to think of
\nmyself as a technologist, if I were to pick one area
\nthat we would need to work on in Asia, it would be
\neducation and not so much just in the sense of learning
\nabout this technology or that, but rather more broadly
\nhaving discussions about what security actually does
\nmean.<\/p>\n

One thing this panel demonstrated is that there are
\nas many different perspectives on security as there are
\npanellists, actually for some of us, we probably have
\nmore than one.\u00a0 Sort of a schizophrenic panel.<\/p>\n

But it is something that from the time that I have
\nspent in Asia and I have been here just seven years, the
\nlevel of sophistication with respect to the dialogue on
\nsecurity, it’s something that there just needs to be
\nmore discussion.\u00a0 In the absence of that discussion, any
\ntechnological decisions we make are not going to be
\nparticularly relevant.<\/p>\n

Actually, I would say I’m sort of reiterating
\nMichael’s comments from his primary, from his initial
\npresentation, is that education.<\/p>\n

>> Matthew Chan:\u00a0 We started doing the threat management to
\nour customer, because everybody have a lot of security
\ndevice or application control, everything is there, but
\nnobody can say it is secure.<\/p>\n

In the past, the company is working the local
\nnetwork infrastructure.\u00a0 Last few years, it is global
\nnetworking structure.\u00a0 Now day, it is cloud
\ninfrastructure.\u00a0 That is a different perspective on the
\nsecurity concept.<\/p>\n

Trend Micro is now starting the work with the
\ncustomer about the threat management.\u00a0 Whatever this is
\napplication, network security and all different kinds of
\nplatform, we are working on that.<\/p>\n

>> Christine Runnegar:\u00a0 I would just like to start with an
\nobservation, that the Asian Pacific region is a very
\ndiverse region with different issues in the internet
\nspace, not just in security.\u00a0 So my one area to mention
\nat the moment is to continue the multi-stakeholder
\ndialogue locally, subregionally and regionally, share
\nyour experiences, your knowledge and work together in an
\nopen, transparent and inclusive process to try and solve
\nthese issues.<\/p>\n

>> Ram Mohan:\u00a0 To me, that fundamental human rights that our
\nown institutions could become a threat to the internet
\nor to ourselves ourselves is an interesting perspective,
\nsomething that I have gained simply out of being here.
\nSo thank you for your point of view on that.<\/p>\n

My summary here would be to achieve a vision for
\na safer internet that is also more accessible,
\ninteroperable and open.\u00a0 If you want to achieve that
\nvision, then I think we first need to agree on common
\nvalues and principles.<\/p>\n

Bringing together consensus on common values and
\nprinciples on internet security is arguably the most
\nimportant challenge and action for this APRIGF and for
\nthat to continue forward into the global IGF.<\/p>\n

After all, if we don’t agree on why we are trying to
\nsolve the issue, we cannot expect to bring together all
\nthe different perspectives on security into convergence.<\/p>\n

>> Dato Mohamed Sharil Tarmizi:\u00a0 Thank you, Ram.<\/p>\n

I think for myself, not so much as the moderator,
\nbut as also a panellist, one of the things that I think
\nwould be of value that we can bring, particularly for
\nthis region, is because of our diversity, because of our
\nmultifaceted and multiracial, cultural environment that
\nwe have here, it’s going to be very, very challenging to
\nfind commonality of views, I would say.<\/p>\n

That’s because we have also various levels of
\nsystems, various systems of governance, various types of
\ngovernments, various types of administrations in the
\nregion.<\/p>\n

But that said, notwithstanding the political
\nchallenges, I would think it is still very, very
\nimportant, despite the diversity, for us to continue to
\nengage in a multi-stakeholder environment such as this,
\nto try and find that common value, perhaps it’s
\ninteroperability of internet, something that sounds
\nbasic like that, or perhaps it’s the continued — for
\nus, security could be interoperability or continued
\noperations of the internet and that may be the one
\ncommon thing we can agree on in this region.<\/p>\n

Going into other aspects could be too difficult for
\nsome, but I think if we build on the commonalities that
\nwe can find hopefully after these two days or three days
\nwe have here in Hong Kong, that should be a useful
\ncontribution I think into the IGF process.<\/p>\n

With that, wearing my hat as the moderator, I would
\nlike to thank all of you for being a very participative
\naudience.\u00a0 I think it was very good.\u00a0 Hopefully the
\ndiscussion doesn’t end here, we will be meeting each
\nother for coffee, tea and lunch.\u00a0 You can continue with
\nthe panellists.<\/p>\n

May I also request and invite that you thank the
\npanellists in the usual manner.<\/p>\n

Ladies and gentlemen, thank you for your time.
\nThank you for your participation.\u00a0 Thank you very much.<\/p>\n

>> Thomas Parenty:\u00a0 Now it is the lunchtime.\u00a0 Lunch will be
\nserved for all registered participants.\u00a0 Please proceed
\nto your right-hand side to enjoy your lunch.<\/p>\n

Moreover, dinner tickets are to be collected at the
\nregistration table.\u00a0 So if you wish to go but do not
\nhave one, please go to the registration desk to ask for
\none, because tickets are given out on first come, first
\nserve basis.<\/p>\n

We will be back at 2 o’clock, so enjoy your lunch.<\/p>\n

(Lunch Break)<\/p>\n","protected":false},"excerpt":{"rendered":"

Security: Cyber-Security and Network Confidence ________________________________________________________________________ REAL TIME TRANSCRIPT: Security: Cyber-Security and Network Confidence APrIGF 11:00-12:30, Tuesday 15 June 2010 Hong Kong DISCLAIMER: Due to the inherent difficulties in capturing a live speaker’s words, it is possible this realtime transcript may contain errors and mistranslations. An edited version of the realtime transcript which amends the … <\/p>\n

Continue reading “APrIGF Roundtable – June 15th, 2010: Session 2”<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":"","_links_to":"","_links_to_target":""},"class_list":["post-276","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/pages\/276","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/comments?post=276"}],"version-history":[{"count":1,"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/pages\/276\/revisions"}],"predecessor-version":[{"id":550,"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/pages\/276\/revisions\/550"}],"wp:attachment":[{"href":"https:\/\/event.rigf.asia\/2010\/wp-json\/wp\/v2\/media?parent=276"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}