Andrew Rose (UK)
speaker
140 appearances
3 recordings
1 series
first heard Jun 2024
last heard Mar 2025
Andrew Rose (UK)’s voice in public audio — every appearance, attributed to the second.
Trend
recordings per month · last 12 monthsNo recordings in the last 12 months.Older appearances are listed below; set an alert to hear about the next one.
Appearances
They need to get sort of, they need to be able to continue to produce and continue to move the produce around and get it to the right place. So they need to focus very much on resilience or rather, sorry, resilience rather than recovery. You can't be down for two weeks and then recover it and go, well, fine. That's two weeks of produce loss. Goodness only knows the impact that could have.
How you get around that is, well, I think you just have to look at all the normal controls that people focus on these days. So how am I going to prevent ransomware? How am I going to keep my network segregated and safe from different external threats? And if we do get a breach internally, how can I make sure that other aspects of my network are segregated away from that?
And finally, I think probably the key thing to think about is, how most of these attacks start, which is very much the space I'm passionate about right now, which is the human side of the risk. It's really interesting to look at enterprises and what they do is they seem to spend about 90% of their security budgets on technology.
And yet when you look at the statistics, about 90% of the threat comes from people who will click on links, who will open attachments, who will do silly things, send information to the wrong place. So actually there's a real imbalance there. And normal large enterprises are still dealing with that themselves.
So I think as the agri-food industry starts to really get in and tackle cybersecurity, they need to think about this education and awareness to change the behavior of the people who are involved in the whole end-to-end process. Because that's where many of those vulnerabilities and those issues will begin, but they can be cut off with some good education and training.
It's interesting to sort of have the analogy with air traffic, because in air traffic control, I didn't care about confidentiality one jot. And we all talk about cybersecurity being the triad of confidentiality, integrity, and availability. I didn't care about confidentiality. If we lost our HR database, sure, that was a rough day, but hey, it could be so much worse.
We had to focus entirely on integrity and availability of data so the air traffic controllers could do their job. And if that dot was on the screen, we knew that was exactly where that dot was. And they'd rather have no dot than an incorrect dot. So integrity was vital and availability was vital. I think those aspects actually are true with the agri-foods as well.
The confidentiality is not that much of a big deal, but the integrity of the data to prove the provenance of their foodstuffs and the availability of their systems to process it and bring it through from farm to fork is really key for them so that they're not just a normal cybersecurity journey. It's slightly different. It's much more critical national infrastructure thinking.
It's much more about safety level thinking.
It is, and I think that chicken company I was talking about, they actually went through all of their processes and they worked it out that if they had no computers at all, they could still do it. They went back to the paper process. How would we do this with no technology? How could we know what we were doing? And I think that's a very wise thing to do.
We've seen other organizations do that when they had ransomware. There was Norsk Hydro, an aluminum or aluminum, sorry, smelting factory. And they again had to go back to manual processes because their computer systems wiped out by ransomware. So we do need to think all the way through how could we keep our services going when everything is gone and certain industries really need to do that.
I think agri-foods is one of them.
I think on that one, I think a lot of the cybersecurity people out there, most of them are very focused on that CIA triad and confidentiality is everything. And integrity and availability is probably IT operations problem. So they come at this from the wrong angle straight away. And I also had to retrain people who joined my team to sort of refocus them on the key things.
So I think they come at it from the wrong place. And I think there's a perception across society that agriculture is not technology based. You know, it's probably the one thing that's not technical. They see it as, oh, there's wheat in the field. Okay, that's not going to get, you know, malware. It's not going to get ransomware.
But actually, it's all the process of the technology that puts the wheat in the field, brings the wheat out of the field, and gets it to your store. Absolutely, that's technology-based. So I think there's just a perception that this is different, that this isn't at risk from those cybersecurity issues.
And with the lack of cybersecurity people focusing on the right aspects of it, I think that puts us into this really poor position, which is, again, why I got involved, because I... perceive this is the most critical national infrastructure. And yet it just gets so underserved in terms of commentary and governance and oversight and support generally.
Andrew? Probably about 48 hours due to food poisoning. I just couldn't keep anything down.
I absolutely learned it on the job. So I came from a legal sector, which was entirely different, entirely, couldn't be more different. And then I was an analyst for five years. So this opportunity just came along. And it's the sort of thing you just can't say no to because it's a security world that means something. You know, working in the legal sector is fine. You know, you're keeping one
very rich company, you know, rich and helping them make a merger and acquisition to make them a little bit richer the next day. And that's fine, but it doesn't really mean anything. But air traffic control and those critical infrastructure things really does make a difference to you keeping people safe. It's all about safety. And so for air traffic controllers, I had to learn that on the job.
It was very much about sort of transferring my knowledge into the operational technology environment, creating a culture within those operational technology engineers to make sure that they understood that cybersecurity applied to them in their context.
Showing 101–120 of 140 · page 6 of 7
← Previous
Next →