Newsroom
For the occasion of the 10th anniversary of Usbek&Rica, which we’ve celebrated with the publication of a beautiful book addressing the outcomes of the past decade, we wanted to project ourselves 10 years into the future. With Thales, we explore the themes of ‘motorways of information’. This second point focuses on the future of cybersecurity, to which we have devoted this fiction describing a more secure world.
March 2032. In the approach to the presidential elections in France, the cybersecurity services are stuck. The lesson has been learned: the hacking of Hillary Clinton’s emails in 2016, the ‘MacronLeaks’ in 2017, ‘deepfakes’ of Joe Biden and Donald Trump during the 2020 campaign…. Without forgetting the Ukraine war in 2022 which posed the threat of a major cyberwar, encouraged the Europeans to strengthen their means of defence, and to reinforce the resilience of infrastructure and communication networks. In the programme: fight against ‘cyber-interference’ (consisting of analysing available data on social networks and quickly detecting robots and fake accounts), improving the detection of attacks….
If everything is connected, everything can be hacked!
It must be said that at the beginning of the decade 2030, the task of cybersecurity services became all the more difficult, as a very large number of hackers now have unprecedented capabilities, and for good reason: many of them are mandated by secret and military services. Amateur hackers, also known as kiddies, are now only an anecdotal danger. In addition, with the increase in digital tools and connected objects (50 billion by 2030 according to the WGSN trends firm), the number of potential targets has exploded. A danger summed up in September 2021 by the President of the European Commission, Ursula von der Leyen, to stress the importance of developing a European cyber defence policy: “If everything is connected, everything can be hacked!” The same goes for the cloud, according to a report by the National Agency for Information Systems Security (2022) which states companies increased their vulnerability by storing their data on the cloud, exposing themselves to theft of authentication tokens.
Reverse the balance of power
The good news for cybersecurity is that over the past decade, the intensity of threats has been matched only by the strengthening of defenses. The first project led by a large number of structures: a careful review of the code to fix bugs and fix security flaws. It is a constant effort to improve that will make the difference between companies and organisations that are able to put in the energy and resources to stay ahead of the attackers, and those that will continue, like the majority of them in 2022, to address new vulnerabilities as they arise. The most secure sites have been awarded a good CyberScore, allowing users to know the level of security of their data as with the Nutriscore model for food products.
Good habits have also made their mark: employees, who are now accustomed to partial or integral teleworking, are working in secure workspaces. An evolution following the Covid-19 outbreak that, with the rapid rise of remote working, has led to increased investments in cybersecurity in Europe (securing access and terminals) as 52% of European companies have seen an increase in attacks, according to a Cisco report in 2020.
The use of AI to detect unusual behaviour has become a widespread practice.
In cybersecurity, perhaps even more than elsewhere, experience has shown that there is strength in unity. Entering the operational phase in 2022, the Cyber Joint Unit, the joint entity for cybersecurity launched at the initiative of the European Commission, has managed to significantly improve the response to attacks by focusing on cooperation between companies, the institutions, and states of the European Union via a “virtual and physical platform of cooperation” connecting the CERTs (centers of warning and reactions to computer attacks) of the continent.
Another critical point is that the consideration of sovereignty issues has also gained ground. These include the hosting of data, which some extraterritorial laws once threatened, like the CLOUD Act in the United States (Clarifying Lawful Overseas Use of Data Act), which allows law enforcement and intelligence agencies to access data from US cloud service providers even when hosted on servers in other countries. It is precisely for this reason, to reverse this balance of power, that the Gaia-X consortium was set up in the course of the 2020s; creating a sovereign ‘made in Europe’ cloud infrastructure not subject to the law of third-party countries, while guaranteeing a high level of security.
AI and quantum technologies: the extension of cybersecurity
Beyond the fight against vulnerabilities, cybersecurity services have also been able to strengthen the detection of attacks. The European “cyber shield” developed by the Cyber Joint Unit will prove its worth during the 2020s. With the establishment of security operational centres equipped with artificial intelligence, it has been possible to anticipate attacks in an ever more sophisticated and advanced manner. The use of AI to detect unusual behaviour has become a widespread practice, signaling the advent of what is called “behavioural” authentication, which takes into account, in the case of human users, the stroke speed and movement of the mouse.
“The seabed is a new balance of power that we must master to be ready to act, to defend ourselves and, if necessary, to take initiative, or at least to respond.”
Florence Parly, Army Minister
As technologies evolve, the field of cybersecurity has expanded. The progression of quantum, which saw the first computers appear over the course of the decade, presented new challenges as it was necessary to develop post-quantum algorithms capable of resisting attacks that would benefit from quantum power; thus, avoiding the dreaded “quantum apocalypse” that would have rendered cybersecurity obsolete as it existed before. But quantum has also made it possible to develop new encryption methods that are more robust than ever, capable of securing communication protocols with quantum key exchanges. This comes with a huge advantage; to know if a third party – a hacker – inspected the exchanged key, in which case the latter would have automatically changed the quantum state of the particles carrying the key. Enough to know, certainly, if there was espionage and then avoid using that key.
From space to abyss, a space to defend.
All these efforts would probably have been in vain if they had not been accompanied by a preventative action at the hardware level. We remember the Bloomberg magazine report in 2018, which claimed the Chinese secret service was spying on the United States for years by inserting chips the size of a grain of rice into Super Micro Computer motherboards. And it doesn’t stop there; from underwater cable satellites – monitored by the NSA according to the revelations of Edward Snowden in 2013 – threats are being deployed on all the hardware fronts of the computer equipment. The proof, for example, with the attack on the first day of Russia’s offense in Ukraine, which targeted the KA-SAT satellite network operated by the American group Viasat - causing the Ukrainian state ‘an enormous loss of communication at the very start of the war’, according to the words of Viktor Zhora, the joint director of the Ukrainian Cybersecurity Agency.
Conscious of these risks, satellite operators have since taken the lead. So, the European Space Agency launched, in early 2022, a call for ethical hackers to hack one of its satellites and therefore strengthen its cybersecurity, before establishing a cybersecurity operational centre in 2024 to guarantee the cyber-resilience of European space assets. On the seabed, the French navy has been able to extend its control to ensure the safety of cables that criss-cross the abyss to allow the global exchange of data, thanks to the oversight provided by robots and drones. The Army Minister, Florence Parly, was not mistaken when she stated at the start of 2022, some time before the start of the war in Ukraine which raised the risk of a sabotage of the cables by the Russians: ‘The seabed is a new balance of power that we must master to be ready to act, to defend and, if necessary, to take initiative, or at least to respond’. In the field of cybersecurity, the best defence is anticipation.