Panel: Public Systems, Private Threats: Cyber Defense Strategies for Governments

Panel: Public Systems, Private Threats: Cyber Defense Strategies for Governments

Speakers: Madalin Staniu (Lead for Cybersecurity and Defence, ANIS Romania Task Force); Eduard Mititelu (Member of Committee on IT&C, Chamber of Deputies); Madalin Dumitru (CEO, SCUT); George Dobrea (Cybersecurity Strategist, CEO, Xeduco Institute); Dan Gavojdea (Regional Manager SEE - Business Development - SecOps, Fortinet)

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=0ULtQVX-JF4

Overview

This DefCamp panel discussion, "Public Systems, Private Threats: Cyber Defense Strategies for Governments," brought together leading voices from Romania's government, industry, and academia to dissect the complex challenges of securing public sector digital infrastructure. Moderated by Madalin Staniu of ANIS Romania, the discussion was structured around four critical pillars: strategic landscape, collaboration, technology and operational resilience, and response and readiness. The panelists explored emerging threats, the evolving role of technology, and the imperative for robust collaboration between public and private entities to safeguard democratic stability and national security.

The core premise of the talk underscored that cybersecurity in public systems extends beyond mere operational efficiency; it is fundamental to the very stability of democratic nations, especially in the context of recent geopolitical events and escalating cyber warfare. The expert panel, comprising figures instrumental in shaping Romania's digital and cybersecurity policies, aimed to provide concrete insights, pragmatic solutions, and valuable lessons learned. Their collective experience highlighted the critical need for a unified, proactive, and collaborative approach to cyber defense, emphasizing that the burden of protection cannot fall solely on government bodies.

The discussion served as a clarion call for a paradigm shift in how governments approach cybersecurity, advocating for deeper engagement with the private sector, leveraging advanced technologies like AI, and fostering a national culture of security. From legislative priorities and attack trends to talent development and threat intelligence sharing, the panelists offered a comprehensive view of the landscape, pinpointing both significant vulnerabilities and innovative pathways toward building a more resilient digital society.

Background

▶ Watch: Public sector must open doors to private cybersecurity expertise (6:50)

The contemporary cybersecurity landscape is characterized by an ever-expanding attack surface and increasingly sophisticated adversaries. As Eduard Mititelu, a member of the Romanian Parliament, highlighted, the traditional model of governments handling all cybersecurity internally is unsustainable. He stressed that the private sector possesses the knowledge and personnel crucial for protecting public systems, advocating for a fundamental shift in mentality to open doors for private expertise through mechanisms like public procurement. This problem is exacerbated by the fact that many governmental bodies are "not so well prepared in front of attacks," a sentiment echoed by Madalin Dumitru, CEO of SCUT.

Dumitru elaborated on current attack trends, noting a move away from opportunistic campaigns towards highly targeted attacks on third parties and supply chains. A significant shift he identified is attackers increasingly focusing on non-human users, such as service accounts, APIs, and AI agents, as human users become more cyber-aware due to training. He cited examples of attackers being "very innovative" and adopting technologies like AI and deepfakes faster than defenders, exploiting a prevalent "lack of correlation" between signals generated by disparate systems, creating critical "blind spots" that attackers readily exploit.

The talent shortage is another profound challenge. George Dobrea, CEO of Xeduco Institute, articulated this with his "4B theory" for building efficient cybersecurity teams: build (internal development), buy (university graduates), borrow (outsource services), or bot (empowering people with AI platforms). He pointed out that while unemployment in cybersecurity is near zero globally, a significant gap exists in practical readiness, with only 70% of European technical universities requiring internships. This underlines the need for a more holistic approach to talent development and career pathing. Dan Gavojdea of Fortinet further emphasized that the relationship between vendors and governments is rapidly evolving from transactional to capability partners, driven by regulations like NIS2, which mandate a higher level of resilience beyond mere compliance checks.

Key Findings

▶ Watch: The '4B theory' for building cybersecurity teams (17:00)

The panel's discussions coalesced around several critical findings, offering a roadmap for bolstering national cyber defenses:

1. Indispensable Public-Private Collaboration: The overarching consensus was that governments cannot effectively defend against modern cyber threats in isolation. The private sector's specialized knowledge, innovative solutions, and skilled personnel are essential. This collaboration must extend beyond mere consultation to active engagement through public procurement, shared intelligence, and joint incident response.
2. Shifting Attack Vectors to Non-Human Users: Attackers are increasingly targeting service accounts, APIs, and AI agents, bypassing traditional human-centric security awareness. This represents a significant paradigm shift, demanding a re-evaluation of security strategies to protect these often-overlooked digital identities.
3. The Critical Role of Context-Aware Automation and AI: While AI presents new threats (e.g., deepfakes, indirect prompt injection), it is also a powerful tool for defenders. Context-aware automation and SOAR (Security Orchestration, Automation, and Response) technologies can drastically reduce incident response times from hours to minutes by correlating data and automating responses, yet remain largely underutilized in government SOCs.
4. Talent Development Requires a Multi-faceted Approach: Addressing the severe cybersecurity talent shortage necessitates a comprehensive strategy, encompassing internal skill development, effective university-to-workforce transitions (including mandatory internships), outsourcing specialized services, and leveraging AI platforms to augment human capabilities (the "4B theory").
5. Unified Cybersecurity and Real-time Threat Intelligence are Imperative: A fragmented approach to security, characterized by a lack of correlation between signals and blind spots, leaves organizations vulnerable. A unified cyber security vision, supported by real-time intelligence sharing through platforms like ISACs and MISP, is vital for situational awareness and proactive defense.
6. Policy and Legislation as Enablers, Not Just Compliance Checklists: Regulations like the NIS2 Directive, DORA, and the AI Act are crucial for establishing frameworks and enforcing accountability. However, their true value lies in driving a culture of security and resilience, moving beyond mere "checkbox compliance" to actual operational effectiveness.
7. Citizen Engagement as a National Shield: The concept of involving every citizen as a "sensor" in a "digital national shield" through user-friendly reporting mechanisms (e.g., mobile applications for suspicious messages) was proposed as an innovative way to gather early threat intelligence and foster collective defense.
8. Clear Leadership and Trust are Foundational: Within government, clear leadership and accountability for cyber crisis management are paramount. Furthermore, building trust between public and private sectors – and among citizens – before a crisis is essential for effective cooperation during incidents.

Technical Deep Dive

▶ Watch: Proposal for protecting white hackers reporting vulnerabilities (26:00)

The panel delved into several technical dimensions crucial for modern cyber defense, highlighting both emerging threats and sophisticated countermeasures.

A significant shift in the attack landscape, as described by Madalin Dumitru, is the targeting of non-human users. This includes service accounts, APIs (Application Programming Interfaces), and AI agents. Attackers are exploiting the fact that these entities often have broad permissions and are less susceptible to traditional human-centric security awareness training. A compelling example cited was the potential for data exfiltration via AI-powered assistants like Microsoft Copilot. A simple email sent to an external address, if connected to Copilot, could inadvertently lead to sensitive data leakage, demonstrating how attackers are leveraging the interconnectedness and evolving capabilities of AI systems. This necessitates a fundamental re-evaluation of security controls around automated processes and interfaces, treating them as critical attack surfaces.

The role of Artificial Intelligence (AI) was a recurring theme. While attackers rapidly adopt AI for tasks like generating deepfakes for sophisticated social engineering or crafting highly effective phishing campaigns, defenders must counter this with their own AI-driven capabilities. Dan Gavojdea of Fortinet specifically highlighted the emerging threat of indirect prompt injection. This technique involves embedding malicious instructions within seemingly innocuous data (like a PDF file) that, when processed by an internal AI system, can trigger unintended and harmful actions. This underscores the need for robust input validation and contextual understanding within AI-powered defense systems.

Gavojdea further emphasized the underutilized potential of context-aware automation in Security Operations Centers (SOCs). Many organizations collect vast amounts of data, but the response to threats remains too slow. Technologies like SOAR (Security Orchestration, Automation, and Response) platforms are critical for bridging this gap. SOAR systems leverage playbooks to automate repetitive tasks, correlate disparate security signals, and orchestrate responses across multiple security tools. This automation can dramatically reduce the time to respond to incidents from "hours to minutes," a crucial factor in mitigating the impact of fast-moving threats in today's hybrid environments.

The discussion also touched upon the technical mechanisms for threat intelligence sharing. While not explicitly detailing technical architectures, the concept of ISACs (Information Sharing and Analysis Centers) was mentioned as a proven model. Dan Gavojdea referenced his experience as a founding father of an ISAC in Romania for the energy sector, which utilized the MISP (Malware Information Sharing Platform). MISP is an open-source threat intelligence platform designed for sharing, storing, and correlating indicators of compromise (IOCs) and threat intelligence. It supports standard protocols like TLPs (Traffic Light Protocol) to govern the dissemination of sensitive information, ensuring that intelligence is shared appropriately and securely among trusted parties. This highlights the technical infrastructure required for effective, real-time information exchange between private and public entities.

Finally, Eduard Mititelu proposed a legislative project to create a "register of threats" where white hackers could report vulnerabilities. This initiative aims to formalize Vulnerability Disclosure Programs (VDPs) at a national level, protecting ethical hackers from legal repercussions so long as they do not cause damage. This technical framework would provide a structured, legal, and secure channel for the cybersecurity community to contribute their expertise directly to national defense, bridging the gap between independent researchers and government agencies.

Demo / Proof of Concept

▶ Watch: Need for clear leadership in national cyber strategy (42:30)

As a panel discussion focused on strategic and policy-level discourse, this talk did not feature a live technical demonstration or proof of concept. The speakers, however, frequently referenced real-world scenarios, attack trends, and proposed practical solutions that serve as conceptual proofs for their arguments. Examples included the potential for AI-driven data exfiltration, the benefits of SOAR in reducing incident response times, and the operational models of ISACs for threat intelligence sharing.

Defensive Implications

▶ Watch: Honest assessment of public institutions' cybersecurity readiness (56:30)

The insights gleaned from this panel discussion offer several critical defensive implications for governments and organizations striving to enhance their cybersecurity posture:

1. Embrace Public-Private Partnerships Actively: Governments must proactively engage the private sector for cybersecurity expertise. This means not only consulting but also initiating fair and transparent public procurement processes for advanced services like audits, incident response, threat intelligence, and specialized security solutions. Edward Mititelu's call to "open the doors to the private sector" is a core tenet.
2. Secure Non-Human Identities and AI Interactions: Given the shift in attack vectors, defenders must implement robust security measures for service accounts, APIs, and AI agents. This includes strong authentication, least privilege access, continuous monitoring, and specific controls to prevent indirect prompt injection and other AI-specific exploits. The example of Copilot data exfiltration highlights the urgency.
3. Invest Heavily in Context-Aware Automation and AI: Deploying SOAR (Security Orchestration, Automation, and Response) platforms is no longer a luxury but a necessity for government SOCs. Automating data correlation, alert triage, and response actions can drastically improve efficiency and reduce incident dwell time, as emphasized by Dan Gavojdea.
4. Prioritize and Operationalize Threat Intelligence Sharing: Actively participate in or establish Information Sharing and Analysis Centers (ISACs). Leverage platforms like MISP (Malware Information Sharing Platform) and adhere to protocols like TLPs (Traffic Light Protocol) to facilitate real-time, actionable intelligence exchange with trusted partners in both public and private sectors.
5. Foster a Comprehensive Security Culture: Move beyond annual "checkbox" awareness training. George Dobrea's argument for building a "human firewall" through consistent awareness, accountability, and a "word of trust" is crucial. This involves aligning management and employees on the shared responsibility for security, moving away from a blaming culture.
6. Establish Clear Leadership and Accountability: Within governmental institutions, define clear roles and responsibilities for cybersecurity leadership and incident response. As Edward Mititelu pointed out, a lack of clear leadership during a crisis leads to inaction and disarray. A designated "boss" for cyber threats is essential.
7. Implement Vulnerability Disclosure Programs (VDPs): Governments should establish legal frameworks, such as the proposed "register of threats," to protect white hackers who report vulnerabilities. This encourages ethical hacking and leverages the broader cybersecurity community's skills for national defense.
8. Shift from Compliance to Resilience: Regulations like NIS2 should be viewed as a foundation for building resilience, not merely as a checklist. Continuous testing, adaptive strategies, and a focus on actual defensive capabilities are paramount.
9. Engage Citizens as Part of the Defense Strategy: Explore innovative ways to involve citizens in threat reporting, such as mobile applications for suspicious messages or links. Madalin Dumitru's vision of every citizen as a "sensor" can significantly enhance early warning capabilities for a "digital national shield."
10. Rethink Talent Acquisition and Development: Governments must adopt a multi-pronged strategy for talent, incorporating internal career development, mandatory university internships, strategic outsourcing, and AI-powered tools to augment existing staff, as outlined in the "4B theory."

Key Takeaways

• Collaboration is Paramount: Effective cyber defense for public systems hinges on deep, proactive collaboration and trust between government, the private sector, and academia, moving beyond transactional relationships.
• New Attack Vectors Demand New Defenses: Attackers are shifting focus to non-human users (APIs, service accounts, AI agents) and leveraging advanced AI (deepfakes, indirect prompt injection), requiring defenders to secure these new attack surfaces with targeted controls.
• Automation and AI are Critical Enablers: Context-aware automation and SOAR technologies are essential for accelerating threat detection and response, reducing incident resolution from hours to minutes.
• Culture and Talent are Foundational: Addressing the cybersecurity talent shortage through multi-faceted strategies (the "4B theory") and fostering a consistent, top-down culture of security and accountability are vital for building a resilient human firewall.
• Policy Must Drive Practical Resilience: Regulations like NIS2 provide a framework, but their implementation must focus on building actual operational resilience and security capabilities, not just achieving compliance.
• Unified Vision and Intelligence Sharing: A unified cyber security approach, enhanced by real-time threat intelligence sharing through platforms like ISACs and formalized Vulnerability Disclosure Programs, is crucial for comprehensive situational awareness and proactive defense.

About the Speaker(s)

Madalin Staniu is the Lead for Cybersecurity and Defence at ANIS Romania Task Force, one of Romania's largest IT associations representing 66% of the IT sector. He plays a key role in aligning the private sector's voice with public policy and serves as an institutional partner for the National Directorate of Cyber Security and the NCC Romania.

Eduard Mititelu is a Member of the Romanian Parliament and serves on the Committee on IT&C, where he is a key advocate for digital transformation and cybersecurity. Previously, as Secretary of State at the Ministry of Research, Innovation, and Digitalization, he led strategic efforts such as Romania's national artificial intelligence strategy and played a central role in incorporating the NIS2 directive into Romanian law. He has a technical background and is active in academic work in AI and cybersecurity.

Madalin Dumitru is the founder and CEO of SCUT, a leading cybersecurity company in Romania, with over 28 years of experience in the field. He promotes a "cyber-dome vision" for proactive security, guarding data through its lifecycle. Under his leadership, SCUT delivers advanced services and resilient solutions, forming strategic partnerships to combat evolving cyber threats.

George Dobrea is a Cybersecurity Strategist and CEO of Xeduco Institute, bringing over 35 years of international experience in cybersecurity consulting, education, and strategy across military, commercial, and public sectors in over 30 countries. He is recognized with more than 15 Microsoft MVP awards for security and six SANS GIAC instructor of the year honors, shaping the next generation of cyber professionals.

Dan Gavojdea is the Regional Manager SEE for Business Development in SecOps at Fortinet, and a leading security and AI security expert with decades of experience at companies like Fortinet, Microsoft, Cisco, and SAP. He helps governments and critical infrastructure operators fortify defenses against advanced threats, driving innovation in SOAR operations and regulatory compliance to deliver unified threat intelligence and scalable AI-enabled cyber resilience.