Accelerating digital strategy by investing in cyber security: an interview with Thales

The digital dilemma between radical transparency and the risks it entails is a particularly interesting one. With radical transparency, everyone has free access to all information. Some information, however, is highly personal, and free access would have major consequences for intellectual property and copyrights.” This illustrates perfectly how digital developments can be incredibly valuable but also come with their fair share of risks. “This is the dilemma that drives me: Either we end up in a world of fear, in which all rules have been pre-programmed - a kind of Big Brother on steroids. Or we create a society in which everything is still connected, but in which the inherent vulnerabilities of such a system have been addressed. Ultimately, this requires resilience.”

Roel van Rijsewijk believes that not avoiding digital risks at all costs is healthy for an ambitious organization. Facing threats head on and learning from them will make you stronger. “Proper management of cyber risks can speed up your rate of innovation and improve your results, which means you will get value from your technology at an earlier stage, will improve the effectiveness of your employees, and boost the services you offer your customers.”

Superhero in cyberspace

Van Rijsewijk is also the author of the book Cyber risks are an opportunity (Cyberrisico als kans), which aims to paint an optimistic picture of cyber risk management. “While preparing for a job interview, I asked my three daughters whether they wanted daddy to make the Internet better or safer. My oldest daughter said: “Better”. My middle daughter said: “Safer. You should catch bad guys.”. And the youngest said: “Catching bad guys? Superman!”. Basically, she saw me as some kind of cyber superhero who keeps everyone out of harm’s way. That got me thinking about cyber security as an opportunity. After all, why would a cyber security officer necessarily have a negative connotation?

Directors, especially those at the head of corporates, struggle mightily with the increasing uncertainty of the rapidly changing world around them. Business is losing its predictability. Still, an organization should not simply task its cyber security officer with preventing catastrophes, van Rijsewijk stresses. “This will only make them risk averse and prompt them to point out that everyone has a role to play. The famed cover-my-ass strategy.” Above all, organizations must identify opportunities, run experiments to find out what does and does not work, and learn. “You shouldn’t panic. One approach can be to create a safe space in the organization where employees are allowed and given the opportunity to experiment a little more, a place where they can come up with and test good ideas. Unfortunately, there are preciously few ideas that are then successfully implemented in the organization. Ultimately, organizations should incorporate innovation in their very DNA, creating a culture of experimentation and agility through trial and error."

“Ultimately, organizations should incorporate innovation in their very DNA, creating a culture of experimentation and agility through trial and error.”

Life and death

So how does this work at Thales? Thales is a French technology company that operates globally and focuses on critical infrastructure and systems in the aviation, aerospace, rail and defence industries. It creates, supplies and manages technology to support decision-making. Its technology consists of three components: measuring, processing large quantities of data, and making decisions based on those data. You’d imagine that the digital transformation could not have gone unnoticed by Thales. “We embrace digital technologies. We get them”, Van Rijsewijk agrees. “In that sense, Thales is as digital a company as they come. With regard to a digital transformation, however, the way we work at Thales poses a particular challenge. This comes down to the fact that we operate in zero-tolerance environments, where we supply the technology responsible for keeping everyone safe. It’s often a matter of life and death. Trial and error does not really work in these situations, because the products we supply have to be nothing less than perfect. Besides, these environments also raise crucial ethical issues, e.g. in the defence industry. "Ethical and explainable Artificial Intelligence (AI) plays a role in everything we do. Thales’s position is that for AI to be ethical, the decision-making process should always have a human link. AI should be a tool to help you collect all available information and make the right decision, but the actual decision should always be made by a human being. This is exactly why explainable AI is so important: if a system gives you a recommendation and you do not understand why, you cannot make a decision in good faith. Our mission is: 'Building a future we can all trust'."

“AI should be a tool to help you collect all available information and make the right decision, but the actual decision should always be made by a human being.”

The digital dilemma

Still, Van Rijsewijk is aware that there are many people out there who are still rather hesitant about the digital future: “The more a company knows about me, the better the services it can provide. But am I willing to make that sacrifice?” Would you want the Tax Authorities to know every single detail about your life? Just imagine, you would never have to do any paperwork anymore and never have to fill in VAT returns, as there would be total transparency. Part of me does love the convenience. But then again, what if the algorithms go haywire? Or what if a political party that I disagree with comes to power? That is the digital dilemma. Another example: insurers can really help their customers by deploying digital technologies and collecting data. If you have car insurance, for example, it’s also in the insurer’s interest for you to drive safely, and insurers can help prevent damage and encourage people to live healthier lives. Ultimately, it’s an issue of trust. Consumers have to be able to rely on the fact insurers will not use all their information to tinker with their premiums. Any insurer that manages to create this level of trust is in for great success.” Again, ethical AI has a major role to play here: “Many decisions made by an insurer come down to one crucial question: do you pay out or not? Do you really want to leave that entire decision to machines? Some cases can be rather complex or touching, but algorithms cannot make that distinction. Just look at the mess caused by the Tax and Customs Administration in the recent childcare benefits scandal. For insurers, inhumane decisions are a huge risk.”

“The more a company knows about me, the better the services it can provide. But am I willing to make that sacrifice?”

Is anarchy a potential solution?

Van Rijsewijk thinks that blockchain technology could hold part of the solution to the digital dilemma: “Blockchain is currently in the trough of disillusionment, which it will have to break out of in order to be successful. I am still convinced, however, that smart crypto has the potential to solve lots of these dilemmas, simply because it is an excellent way to prove that you have certain attributes or that you are entitled to something without revealing your identity. Take bitcoin, for example, a crypto currency that works without anyone being in charge. With bitcoin, you can successfully enter into a transaction with someone on the other side of the world without ever meeting them or knowing anything about them. It’s what I call ‘distributed thinking’.

Van Rijsewijk points out that the network effect has created a situation in which several dominant platforms such as Facebook and Amazon have created monopolies: they have access to all the data and make the rules. “A search engine set up on a blockchain would belong to everyone and no one at the same time. It’s a potential game-changer, but the issue is the protocol. To understand how this works, try comparing soccer to chess. In soccer, the rules restrict the game: you can unfairly influence the game by breaking rules, which means you need a referee to enforce them. Not a single soccer match goes by in which the players or fans don’t argue about a certain situation or decision. In chess, the rules make the game. You could start breaking those rules, but you wouldn’t be playing chess anymore. Because there is complete consensus, you don’t need a referee either. And that’s what we call protocol.” Van Rijsewijk believes that we will have to agree on such a protocol together: “Open source is the future. In my field, making code accessible to everyone is rather counter-intuitive. At the same time, more eyes also mean that bugs can be identified and shared more easily. The best software is produced by a community of coders. I consider myself a digital anarchist of sorts, because digital technology has the potential to actually make anarchy work.”

“Open source is the future. In my field, making code accessible to everyone is rather counter-intuitive. At the same time, more eyes also mean that bugs can be identified and shared more easily.”

Investing to accelerate strategy

Vital infrastructure is also becoming increasingly digital, and Van Rijsewijk would be the first to point out the risks: “Digitized infrastructure is more vulnerable to attacks, that much is true. However, it is also safer, because all those connections and digital technologies open the door to greater resilience. I am convinced that digitization is the way forward, but it’s also the biggest challenge I face on a day-to-day basis. You could argue that digitizing a major dam complex would only make it less secure, because what if someone were to crack the passwords? At the same time, digitization allows for improved security, because it enables you to monitor assets remotely, detect problems at an early stage and act immediately. All the information that makes something vulnerable can also be used to detect and respond to threats. The very problem is also the solution.” Van Rijsewijk’s advice to boards fits in seamlessly with this philosophy: realize that cyber risks have an upside. “In every single boardroom out there, you will find that ‘digital’ is fundamental to strategy. The notion that digital technologies lead to cyber risks is here to stay and I do think that boards are well aware of this. A key message I would like to convey to boardrooms, however, is that they can also accelerate their digital strategy by investing in cyber security, that cyber security is an enabler. Resilience is agility’s twin brother. One cannot exist without the other!" You have to be flexible and be able to adapt quickly to changing circumstances and deal with uncertainty.”

“Resilience is agility’s twin brother. One cannot exist without the other."

_________________________________________________________________________________________________

About the interviewee

Roel van Rijsewijk is Director Cyber Defense at Thales and author of the book Cyber risks are an opportunity (Cyberrisico als kans). He has more than twenty years’ experience in advising technology-driven organizations on risk management and information security. Before Thales, Van Rijsewijk advised, as Senior Fellow at Deloitte’s Center for the Edge EMEA, board of directors on risk management at the cutting edge of business and technology.

This interview was conducted by Arjan Gras, Interviewer.