VB2024 Closing keynote: May you live in interesting times

### Overview In this closing keynote at VB2024, Brian Honan examines the phrase "may you live in interesting times," framing current cybersecurity challenges as both a risk and an opportunity. Honan argues that while the digital landscape has become indispensable to global society, business, and critical infrastructure, security practices have largely stagnated around decades-old baseline advice. Comparing the digital realm to the historical evolution of automotive safety, he calls for a collaborative shift—drawing on the traditional Irish concept of a *meitheal* (community cooperation)—to address emerging risks, embrace regulation, and prioritize human safety.

### Key Topics - **Global and Societal Risk Landscape:** Drawing on the World Economic Forum's Global Risks Report, Honan highlights AI-generated misinformation/disinformation and cyber insecurity as top short- and long-term concerns, particularly in light of over 120 global elections. Geopolitical conflicts also spill directly into everyday civilian life, illustrated by pro-Palestinian hackers disabling an Irish water scheme in Mayo because it ran Israeli-provided software. - **The Human Impact of Cyberattacks:** Honan emphasizes that cyber incidents are no longer mere IT or data issues. Using the 2021 Conti ransomware attack on Ireland's Health Service Executive (HSE) and incidents affecting UK and US healthcare providers, he notes extreme real-world harms: delayed surgeries, canceled treatments, turned-away ambulances, leaked medical records for 100,000 citizens, and oncologists reporting disruptions to cancer care worse than COVID-19. - **Automotive Safety as a Model:** Reviewing the automotive industry's progression from unregulated, dangerous machines in the early 20th century to modern crash-tested vehicles, Honan outlines how mandatory standards, structural infrastructure, training, and innovations like Nils Bohlin’s unpatented three-point seat belt drastically reduced fatality rates. He suggests cybersecurity must follow a similar path. - **Regulatory Shifts:** Honan discusses impending European regulations, such as NIS2 and the Cyber Resilience Act (CRA), alongside SEC reporting mandates and CISO liability in the United States, pointing out that governments will no longer accept unverified corporate security promises.

### Technical Details - **Emerging Threat Surfaces:** Expansion into cloud environments (citing state-sponsored intrusions into Microsoft 365 by Russia and China), consumer IoT (smart speakers, connected appliances, wearables), critical infrastructure (solar power and energy grids), and connected vehicles introduces massive exposure. - **Future Technologies:** AI is currently seen mostly in automated fraud, polished phishing, and business email compromise, while quantum computing threatens to render existing modern encryption obsolete. - **Systemic Insecurities:** Despite decades of awareness, software still frequently ships with default passwords and vulnerabilities like SQL injection, while organizations frequently under-scope penetration testing and vulnerability management. - **Legislative Mandates:** Under upcoming frameworks like NIS2 and the Cyber Resilience Act, vendors selling hardware and software into the EU must maintain baseline security standards, manage supply chain risk, and enforce structured vulnerability disclosure and remediation programs or face market exclusion.

### Takeaways - **Move Beyond Repeating 1980s Advice:** Advising end users to simply patch, run antivirus software, and use strong passwords has proven insufficient against modern threats. - **Secure by Default and Design:** Systems must be tested, vetted, and safeguarded before users interact with them, shifting the burden away from blaming the end user. - **Embrace Regulation:** Resisting compliance is futile; organizations must adapt to safety frameworks like the Cyber Resilience Act just as automakers adapted to crash testing and seat belt mandates. - **Industry Collaboration (*Meitheal*):** To protect society, the cybersecurity sector must collaborate across vendors, infrastructure providers, and regulators—working together like geese in a V-formation to share burdens and pioneer long-term safety solutions.