Surfing the Digital Tsunami

Surfing the Digital Tsunami

Speakers: Charles Forte, Director General and Chief Information Officer, UK Ministry of Defence

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=sYFXd3o3U7k

Overview

In his Black Hat MEA talk, "Surfing the Digital Tsunami," Charles Forte, the Director General and Chief Information Officer for the UK Ministry of Defence, delivered a compelling address on the escalating challenges and strategic imperatives of cyber defense in an increasingly digital world. Drawing on an analogy he first penned a decade ago, Forte described the relentless pace of digital innovation as a "tsunami" – a force that businesses once sought to surf for competitive advantage, but which now presents an existential cyber risk demanding an entirely new level of defensive capability.

Forte's central message resonated with urgency: in a world where nearly every aspect of life and enterprise is 100% digital and data-defined, cyber defense is no longer a "nice-to-have" but an "existential necessity." He outlined three critical priorities for organizations to navigate this digital deluge: mastering foundational IT disciplines, making substantial new investments in modern defense capabilities to counter advanced threats like AI and quantum computing, and rigorously securing the expansive third-party supply chain. His perspective, rooted in the high-stakes environment of national security, offered a stark reminder that digital excellence now defines winning and losing, making robust cyber resilience paramount for survival and success.

Background

▶ Watch: Introduction: The Digital Tsunami and Cyber Risk (0:00)

Charles Forte framed his discussion by revisiting an analogy he developed a decade ago: the "digital innovation revolution" as a massive tsunami wave. At that time, the challenge was for businesses to learn to "surf" this wave, leveraging digital transformation for new opportunities or risking irrelevance. Fast forward ten years, and Forte asserts that this wave has not only persisted but has increased in height, breadth, and pace by "a couple of orders of magnitude," with Artificial Intelligence (AI) now driving its surge even higher. While many businesses have successfully learned to exploit digital opportunities at massive scale, others have "gone under" due to their inability to adapt.

The core shift, Forte emphasized, is that while digital prowess once defined competitive advantage, it now defines winning and losing in an existential sense, particularly within the defense and national security sectors. The world has become "almost 100% completely digital and data-defined," influencing how we work, play, interact, build, and use things. This pervasive software ubiquitousness directly exposes enterprises to cyber risk in a way that truly threatens their existence if not properly addressed. Consequently, "surfing the tsunami" today fundamentally means excelling at cyber defense. The sheer expansion of digital footprints has made robust cyber defense an absolute necessity for all organizations, regardless of their size or existing cyber maturity. This background sets the stage for Forte's three critical priorities, designed to provide a foundational, organized response to this escalating and increasingly complex threat landscape.

Key Findings

▶ Watch: Deep Dive: Managing Legacy Systems and Patching (5:40)

Charles Forte presented three critical priorities as foundational elements for any organized response to the digital tsunami, emphasizing their independence from an organization's size or cyber maturity. These priorities, he argued, are essential for building genuine cyber resilience in the face of an ever-evolving and increasingly hostile threat landscape.

His first key finding was the enduring and paramount importance of old-fashioned IT disciplines and professionalism. In an era dominated by discussions of AI, Forte deliberately pivoted to highlight the "boring world" of fundamentals like asset management, patching, change controls, and risk assessments. He asserted that these form the bedrock of cyber defense; without strong foundations, even the most advanced security tools are rendered ineffective, leaving organizations vulnerable to sophisticated adversaries who actively seek these "open doors."

The second key finding centered on the urgent need for new levels of investment in modern defense. Forte underscored that the threat environment has "materially shifted for the worse," driven by organized crime, nation-states, and the blurred lines between them. This threat profile is now automated, fast, and adaptive, with AI enabling adversaries to scale reconnaissance, generate convincing social engineering attacks, and identify weaknesses far more rapidly than human analysts. The expanding digital attack surface, coupled with these advanced threats, necessitates a significant uptick in investment to keep pace and close existing gaps.

Finally, Forte highlighted the critical importance of the third-party supply chain. He stressed that an organization's supply chain exposes an entirely new threat surface, directly impacting its data and reputation. With regulators increasingly focusing on compliance, organizations must extend their cyber defense efforts beyond internal boundaries to encompass their entire ecosystem of suppliers. This means establishing clear compliance expectations and integrating them into contractual agreements, ensuring that minimum standards of cyber defense behaviors are adopted across the extended enterprise. Together, these three priorities form a comprehensive framework for navigating the "digital tsunami" and building resilient cyber defenses.

Technical Deep Dive

▶ Watch: Priority 2: New Investment in Modern Cyber Defense (12:00)

Charles Forte's address delved into the practical implications of his three priorities, providing technical specifics and strategic guidance for each.

Priority 1: The Enduring Value of Old-Fashioned IT Disciplines

Forte unequivocally stated that the "boring world of old-fashioned IT disciplines" remains absolutely essential. These are not merely administrative tasks but form the bedrock upon which all advanced security controls stand. He detailed several key areas:

• Legacy Systems: A significant inhibitor to cyber resilience, particularly in national security. Older systems often lack modern security configurations, use deprecated protocols, and may be unpatchable, yet support critical, sometimes fragile, business processes. Adversaries actively target these weak spots. Forte emphasized that simply replacing old technology isn't enough; organizations must understand their legacy inventory, perform accurate dependency mapping, and prioritize risks. Where replacement isn't feasible, containment strategies are crucial, including network segmentation, enhanced monitoring, and virtual patching. This reduces the "sprawling, uncontrolled attack surfaces" that adversaries exploit.

• Patching: Described as a "non-negotiable discipline." Forte highlighted that most cyber incidents exploit known, documented, and patchable vulnerabilities. Inconsistent patching, often due to organizational complexity, legacy dependencies, or fear of downtime, is a critical failure point. Effective patch management requires clear system and application ownership to prevent orphaned assets, a structured patching cycle with emergency processes for critical vulnerabilities, and, crucially, automation. Manual patching cannot keep pace with the scale of today's threat landscape. Patching must be treated as a disciplined, predictable operational routine.

• Asset Management: The "backbone of every other IT discipline." Forte stressed that "you simply cannot defend what you don't know that you've got." This includes hardware, software, cloud resources, and identities. A reliable, detailed picture of all assets is fundamental; without it, organizations inadvertently create "open doors" for adversaries.

• Access Controls: While broad, Forte focused specifically on privileged access account management and controls. He likened poor PAM to "taking multiple copies of your front door key and leaving them around town with your address as a label attached," effectively inviting attackers in. Robust Privileged Access Management (PAM) is paramount to securing critical systems and data.

• Risk Management: Forte asserted that cyber risk is a business risk, not just a technical one. Effective risk management involves translating technical issues into business outcome exposures. Disciplined organizations integrate risk assessments into every phase of technology management: strategic planning, change control (reviewing every change for cyber impact), and continuous operational management (evaluating new vulnerabilities, system changes, supplier behavior, and threat trends). The goal is not to eliminate risk but to make informed trade-offs and invest accordingly where exposures are highest. This approach helps secure necessary investment by framing cyber defense in business terms.

Priority 2: New Levels of Investment in Modern Defense

Forte argued that the threat environment has profoundly worsened, driven by automated, fast, and adaptive threats from organized crime and nation-states. AI is a game-changer, allowing adversaries to scale reconnaissance, generate convincing social engineering attacks, and identify exploitable weaknesses far faster than any human. This expanding attack surface demands a significant increase in investment.

• Identity as the New Battleground: Most breaches begin with compromised identities (stolen credentials, session hijacking, privileged misuse). In complex organizations, identity is often the primary attack surface. The solution involves moving to continuous authentication and stringent control over privileged access. Forte declared that Zero Trust is "no longer a strategic aspiration; it's an operational minimum."

• Data-Centric Approach: As data proliferates across cloud environments, partner networks, and AI systems, the traditional network perimeter becomes irrelevant. A data-centric approach necessitates data classification, policy-driven access, and privacy-preserving techniques to enforce control wherever data travels. This requires establishing fundamentally new digital architectures and developing new skill sets. Forte referenced the UK Ministry of Defence's strategic partnership with Google, announced in September, to build a national secret cloud capability, highlighting the need for secure, accessible data at higher classifications, even across corporate boundaries.

• Quantum Computing: Forte issued a stark warning about the immediate relevance of quantum threats, stating it's "not a put off until tomorrow conversation." He highlighted the "harvest now, exploit later" threat model, where encrypted data is collected today, awaiting future quantum decryption capabilities. Organizations must begin strengthening existing operational cryptographic keys and planning a migration to quantum-resistant cryptography to protect high-value, long-lived data.

• Skills and Talent: Acknowledged as one of the biggest challenges. While AI will aid in analysis and detection, it does not diminish the need for continuous investment in human talent and expertise. Organizations must reassess operational models and invest in educating their wider business populations on "good digital savvy behaviors."

Priority 3: Securing the Supply Chain

The supply chain, Forte stressed, is a "whole new threat surface" that exposes an organization's data and reputation just as much as its internal operations. Regulators are increasingly scrutinizing compliance expectations for third-party risk.

• Compliance and Contractual Expectations: The UK Ministry of Defence recently launched a new set of compliance expectations for all its suppliers, outlining minimum cyber defense behaviors and processes. These are being embedded as contractual expectations, ensuring that suppliers adhere to sensible, nationally advised cyber hygiene practices. This proactive approach aims to address the legal and accountability requirements increasingly placed on businesses regarding their supply chain security.

Forte concluded by emphasizing that while these practices might seem mundane, they collectively form the foundation of modern cyber resilience. In an age of constant adversary innovation, organizations that excel at these fundamentals are best positioned to remain secure, stable, and resilient, underscoring the professionalism and consistent investment required to achieve this.

Demo / Proof of Concept

▶ Watch: Priority 3: Securing the Third-Party Supply Chain (18:00)

This talk was a strategic and policy-oriented address, focusing on high-level priorities and architectural shifts in cyber defense. As such, it did not include a live technical demonstration or proof of concept. The content was delivered as a prescriptive framework for organizational change and investment.

Defensive Implications

▶ Watch: Conclusion: Opportunities for Cyber Professionals (19:00)

Charles Forte's presentation offers clear and actionable defensive implications for organizations grappling with the digital tsunami. Defenders must fundamentally shift their approach from reactive tool deployment to proactive, integrated resilience built on both foundational principles and strategic future-proofing.

Firstly, the call to master old-fashioned IT disciplines is a critical reminder. Organizations must prioritize and consistently invest in the "boring" but essential tasks:

• Comprehensive Asset Management: Maintain accurate, up-to-date inventories of all hardware, software, cloud resources, and identities. You cannot defend what you do not know you possess.
• Rigorous Patch Management: Implement automated, disciplined, and predictable patching cycles with clear ownership. Establish emergency processes for critical vulnerabilities, recognizing that most breaches exploit known flaws.
• Legacy System Containment: Identify and map dependencies for legacy systems. Where replacement isn't feasible, deploy network segmentation, enhanced monitoring, and virtual patching to minimize their attack surface.
• Robust Access Controls: Implement strong Privileged Access Management (PAM) to secure administrative accounts and sensitive access, treating it as a top priority to prevent credential theft and misuse.
• Integrated Risk Management: Embed risk assessments into every stage of technology management, from strategic planning to daily operations. Translate technical risks into business impact to secure executive buy-in and appropriate resource allocation.

Secondly, defenders must advocate for and implement new levels of strategic investment to counter evolving threats:

• Adopt Zero Trust: Move beyond traditional perimeter defense by implementing Zero Trust architectures with continuous authentication and strict identity management. Treat identity as the primary battleground and secure it accordingly.
• Embrace Data-Centric Security: Focus controls directly on data, regardless of its location (cloud, partner networks). Implement robust data classification, policy-driven access, and privacy-preserving techniques to ensure control where data travels.
• Prepare for Quantum Threats Now: Begin assessing current cryptographic dependencies and develop a roadmap for migrating to quantum-resistant cryptography, especially for high-value, long-lived data that could be harvested today for future decryption.
• Invest in Talent and Awareness: Continuously develop high-end cyber security skills within the organization and throughout the supply chain. Simultaneously, invest in widespread user education to foster "digital savvy behaviors" and reduce human-centric attack vectors.

Finally, the supply chain demands equal attention. Defenders must:

• Establish Clear Supplier Expectations: Develop and enforce minimum cyber defense standards for all third-party suppliers, embedding these requirements into contractual agreements. This ensures that the extended enterprise operates with a baseline level of security, mitigating risks to the organization's data and reputation.

In essence, Forte's message is a call for a holistic, disciplined, and forward-looking approach to cyber defense. It requires recognizing that "80% good might not cut it" in the current climate, demanding real professionalism and continuous effort to build true resilience against an increasingly sophisticated threat landscape.

Key Takeaways

• Cyber Defense is Existential: In an almost entirely digital world, robust cyber defense is an existential necessity for enterprises, not merely a competitive advantage or "nice-to-have."
• Foundational IT Disciplines are Paramount: Mastering "old-fashioned" IT disciplines like asset management, patching, privileged access control, and risk management forms the indispensable bedrock of any effective cyber defense strategy.
• Identity is the New Perimeter: With the traditional network perimeter dissolving, identity has become the primary battleground. Implementing continuous authentication and Zero Trust principles is an operational minimum.
• Strategic Investment is Crucial: Organizations must significantly increase investment in modern defense capabilities, especially to counter AI-driven threats, secure data in dispersed environments, and prepare for the imminent challenge of quantum computing.
• Supply Chain Security is Non-Negotiable: The third-party supply chain represents an expanded attack surface. Organizations must extend their security rigor and contractual expectations to all suppliers to protect their data and reputation.
• Talent, Skills, and Awareness are Vital: Continuous investment in developing high-end cyber security talent and fostering digital savvy behaviors across the entire workforce is essential for long-term resilience.

About the Speaker(s)

Charles Forte is the Director General and Chief Information Officer (CIO) for the UK Ministry of Defence. In this pivotal role, he is responsible for overseeing the vast and complex digital infrastructure and cyber security posture of one of the world's leading defense organizations. His insights are informed by direct experience in safeguarding national security assets against sophisticated state-sponsored and organized criminal threats. Forte's perspective emphasizes the strategic imperative of digital transformation and cyber resilience, highlighting the critical need for robust defense mechanisms in an increasingly interconnected and perilous digital landscape.