Unlocking Innovation, Mitigating Risk, and Staying Ahead of Cyber Threats

Transcript

we are actually nearing to one of our last fireside chats we have actually two more fireside chats for you both very interesting um and but I need to say that please plan in and stay with us and with the fellow audience speakers sponsors and partners for after the last five say chat for an upper RW in the backside there will be food there'll be drinks and also we can also go out to the teras where the weather is still beautiful so really kudos to you to actually making it still and staying in here for the content so with no further Ado I would like to announce the next firey chat the title is transforming banking with

DLT unlocking Innovation mitigating risk and staying ahead of cyber threats so we brought two experts for you to discuss this on stage in front of you you one of them so the the firesight chat moderator is Marcus Pat welcome on stage and he will introduce himself in detail and his partner in crime on stage will be Halburn CEO Jack B bong the floor is yours thank you very much [Applause] Benedict it's good to be here tonight can you all hear me all right perfect

today I'm here with Shu welcome Shak so we both got started in it infrastructure many many moons ago but while my career was pretty straightforward I did databases distributed databases in it infrastructure and now I do decentralized databases in financial crypto Financial infrastructure your career took a few more turns shock uh please tell me how does a PC salesman become CEO of a cyber security company and of course we did not prepare that question right yeah so yeah so I spent indeed 20 something years in a classical it infrastructure business with companies like IBM HP you are referring to and Del

Technologies and then I moved to the cyber security part of it and then from cyber security to web3 crypto and this new world this new realm of cyber security the step is easier so that's how it came so I am really from from the data center side of the equation but you can bring a lot of the ingredients of the traditional cyber security into that space especially now and that's the topic of today since we have this big convergence happening this convergence between web3 and traditional banking between Defi and trafi and that's where I would claim that company like mine but also people like like me are quite

useful yeah we see there are waves in technology and emerging technology and thinking back in 2019 when we saw a wave of crypto entering into traditional Financial Services I was leading PC's blockchain competent Center at that time and I felt it was very urgent to step up our smart contract audit capabilities so we purchased uh an audit firm chain security at that time only a few months years later to realize well wasn't the right time yet and coincidentally there's a similar story in ybe back when kudelski was

building up a blockchain competent Center and when you took that over I understand you had to deemphasize the team as well yeah so what you speaking about is this winter and summer of technologies that we may be may be happening as well with AI let's see so yes indeed we but it's a question of focus so that company I was a COO at that time so that was a traditional cyber security perimeter if you don't have the critical mass you cannot be successful and we were competing against company like albor so it was hard now it's hbor and Banks they see an upcoming wave of crypto as see lots of opportunities

they want to be Innovative and go into this emerging technology this emerging Financial Service base but they also see the risks and what do you tell them how can they balance that Innovation with the risk yeah so I think it's a great question so first I would say that the regulatory framework we are in today for instance with Dora about uh about resilience of digital infrastructure is a good indication when you look at the what do you need to do you need first to have a risk an ICT risk framework second what you need to do you need to report to the authority any incident third you absolutely need also to make testing of that critical infrastructure of the

critical systems fourth you need to assess your third party and fifth you need to be part of that community so imagine if you are a bank you have to do all that for the web two perameters and all of a sudden you add to that the web three if you are a large bank I can I can mention them because they are public if you a large Bank like UBS they have decided to do everything which is chain related on public chain on the main net of ethereum so suddenly you have Smart contract sitting there and you have your classical parameters but there is a lot of interaction you are for instance issuing Security on chain but then you make the settlement thanks to stable

coin on that same chain at the same time you have to do custody so it's a blend of web two and web three so you absolutely need to have an approach which where you pick the right Partners who are able to support you in that Journey so if we speak about Dora you need to have partner who have this level of accreditation and certification but you also need to have a secure by Design approach meaning that in everything you do in your development life cycle security always in you don't want to be the next by bit uh of the history of crypto nobody wants to be the next by it 1.4 billion hacked just about four or

five weeks ago but when you put it that way I mean that's traditional cyber security new acronym Dora but sounds it's pretty much the same thing that they do in traditional systems and map 3 isn't there a bit more to it no there is much more so D is indeed a traditional framework very similar to nist or sock two type two for instance we are sock two type 2 which is really a badge of honor I would call that with regard to cyber security but what I am saying is that you have to take that framework because if you are a financial institution in Europe you are forced you need to adopt Dora and you add the ingredient of web three and that's when

it comes that's when the hits the fan if you see what I mean so that when the level of complexity is such that in many cases that we are faced with we see the traditional cyber security team of the banks being overwhelmed by that because in a traditional perimeter Web Two when you have an incident you have multiple hours to react on chain you have minutes sometimes second and that's really the bybit example I was making so you need to have a different approach when you think about resilience and when you think about threat modeling and how do you deal with those threats so you need

to combine both of them pit has shown that you might not even have seconds because when a transaction is signed and available on the blockchain it's out there you don't know where it goes and soon it will be North Korean control sitting in a Bitcoin somewhere how do banks deal with that major change because I mean today when somebody makes a fat finger mistake and accidentally wires a billion to Bangladesh wherever they have 24 hours time through the correspondent banking system to get the money back 0 seconds so the byit example is fascinating because it's it is almost the three of the Dora requirements it's

third party because remember what happened in the case of bit it was the credential of an engineer year of safe on AWS which was stolen in the first place this is what happened so they prepared that I would say that Mastermind hacking months and months ago so if you really apply this kind of diligence if you really assess very price precisely in that case your third party and also if you have an understanding of the processes they were doing in that case for instance they were doing Blind multi Sig that was part of the risk so you had all those components in one go so I would claim that if you have the proper management

system but again you need to be helped to create that management system you are able to prevent buybits from happening right and we have that zerc risk but maybe thinking a bit further ahead when more and more banking happens in a web 3 infrastructure could there also be a possibility that in can become more secure than it is today yeah so at the end of the day if you think about blockchain DLT that was the ID the ID was to make a transaction being immutable so so the ID Remains the Same and if you if you remember also Bitcoin as an example I I do remember in 2019 you were referring

2019 to to reverse the consensus on bitcoin you needed to invest in4 billion dollar of Hardware so 2019 so I would claim that to some level that infrastructure is more secure I would still say that the junction between the different components of your perimeters web 3 and web two are really the critical point so typically oracles are very critical Bridges between chain and you will have plenty of bridges when you go into that Blended environment are very uh high level of vulnerability that you can have in your infrastructure but again it needs a lot of I would say

again secure by Design approach to be able to to get everything under control Dora or no Dora we spoke about Banks we speak about Frameworks applicable to Banks now you mentioned oracles and and uh maybe in general smart contracts crypto protocols do you guys with hurn also work with the Crypton native side of things yeah so we we come from the crypto native the company was a established by a guy who is honestly a genius in cyber security who comes from the web too but then the company was more focus on Smart contract audit those kind of very specific web three assessment and then more and more we had banks in the United States so we have

many of the largest bank in the United States who became customer of us because of that so we we have been expanding from a web three base to the rest of the financial services Universe some fintech as well in the traditional space so it's an interesting Journey from that standpoint and we are bridging those gaps and we are bringing that knowledge to combine it with our Focus which is financial services when we look at the Swiss ecosystem and we have many Swiss banks here but we also have international European Banks here last year I took the PS of 20 Swiss banks and we released a

pulse survey blockchain banking where I asked what is your strategy for blockchain and do you have a strategy are you at least working on a strategy and more than 60% of all banks were eager to do something crypto even more than 80% of banks in blockchain generally but when we drill deeper into this I found that there were clearly a a segmentation in two groups one of the group was actively working on the strategy and not just thinking about it they were either already live with a blockchain offering or close to going live they might be live by now and there was a long gap of banks just thinking about it they might not go live this year in Switzerland when we reflect with

your client base and your experience in the market do you see a similar wave how do you see Banks and traditional Financial Services go into crypto now yeah you have always kind of for runners and the laggar that's really true and we can see that with our customers but I would say that some changes that happen in the legislation for instance in the United States which means that for instance when you are custodian of a crypto asset you don't need anymore to have them on your balance sheet is accelerating the adoption and accelerating uh the willingness of banking institution to go into the custodian space and that's really where the risk start start to hit that's where

when you go when you make that move and you start to make custody of digitized asset or of crypto yourself because you can do that it's not anymore on your balance sheet you really need to double down on that secure by Design you really need to have a custodian approach which is secure by Design but also Dev SEC UPS you know from it you you remember the dev seup the SE part is Extreme important it's more important on chain than anywhere else so that's really the call to action for the banks and yes they do that but security of course I'm speaking for my shop but I think it's quite obvious cyber security cannot be

an afterthought because a blockchain it's all about security and that's the key element of the thinking in our view at albor when we stay at security and don't go too much into regulatory or other things but stay with security what are like some of the big unlocks that might come that will make it easy for more banks for more traditional Financial Services to move on chain so for instance we are developing an AI based of course buz words an AI based system which will when you have a smart contract which is key in everything which is defi key for Market

makers for all those community of uh of players in decentralized finance we are developing an AI tool which will do First Quality assessment so the QA and the testing the functional testing before we go into the vulnerability so what I'm saying here is that we have when we work together with our customers we have really the means to put some element of Automation and of industrialization of the process and of the security in the core processes of the bank so it will become part of their core banking system in one of the panels they were speaking about core banking system it will become but

again we need to put those kind of guard rails in place to make that happen thank you shock I'm excited about the future there's lots more things to get onto and into the banks what I would encourage all of you is now that we need to wrap up hit us up after the event the next couple presentations are also going to be very interesting so stay here but afterwards we'll share a few drinks and we be available for chatting thank you all thank you very much