Hi, in this session we have a special guest today, he is Juan Cobo from Ferrovial. He's an expert because he is the Chief Information Security Officer of Ferrovial, that is a very big company. Hello, Juan, welcome. >> Hello, nice to meet you. >> And we are going to start with the interview. So, the first question is what do you think about the real security level of big companies like Ferrovial? >> Well, that's a very good question, a very interesting question. Let me say that in general, I mean, people who is in charge of security in a large company never say that our level of security is good. Now, that's a word that we never used here. What we are going to say that we do our best in order to improve security in order to avoid all the different cyber threats that are facing our businesses and our infrastructure. So we could say that in general large companies are going to find what we call another level of security. Wich means that in the end, taking into account that we are large companies, we have enough resources. We have people, we have budget, we are really sensitive to regulation. We are really sensitive to cyber threats, to cyber breaks. So we have all the different tools that we need in order to avoid this kind of risk, to mitigate this kind of risk. But it doesn't mean that in the end, I mean, it's sooner or later, we are going to be hacked, we are going to to be attacked, we are going to be penetrated. So we can say that we are good, we are working in this. We have the tools but I mean, you never know what is going to happen tomorrow. So we say we are in the good way in terms of large companies. >> It seems a huge talent. >> Yes. >> In few words, what do you consider are the main functions that are critical in the cyber security management today for a big company like yours? >> Well, my opinion, I mean, the most important thing is just to understand that cyber security, because we are talking about cyber security within management, is not about technology. I mean, technologies are truly powerful tool that we have but cyber security is not only about technology but also about people, about processes, about awarness, about compliance. So you have a very interesting and challenging mix that you have to manage. So this is one of the most important thing you have to consider, I mean, this is not about technology. I mean, this is about risk management, this is about just to have a global view of risk. What is going on in your environment, the environment you are protecting. And this is the first thing that you have to keep in mind, okay? Once you have this clear, you can take advantage of technology and the different capabilities that you can find in the market. But the first of all its cybersecurity is something that is not only about technology. This is something that you should treat like a normal professional company, a process which is in charge of risk management. >> You say that it's important to local regulations in companies. So in Ferrovial that they are present in maybe over the world. So, how important is local regulation, is it really a complexity for your work. >> Yes, yes, absolutely. Well, let me say that for those people who don't know Ferrovial, Ferrovial is a large Spanish company. We have activities in at least 30 countries throughout the world. We have four different business lines, which are airports, which are toll roads, construction, and services in different countries. So it means that in the end we have to manage complexity, not only for a regulation perspective but also in different perspective. But talking, focusing on regulation, yes, I mean, this is a very complex environment, in the end not only about cybersecurity in different aspect. I mean, just have to comply with local regulation means that you have to adapt your activity, your operation to different aspect. Different ways of doing things in different countries with different cultures, with different ways of doing things. So regarding cybersecurity, in the end, I mean, this is really complex. Let me just put an example, for instance, I mean, if we are talking about GDP, which is really important in the European Union nowadays. If you jump to the States, I mean, that if you are working with a European company, you should try to comply with GDP in the state. But maybe if you comply with GDP, you are not going to comply with a local regulation of the state, so this is very complex. I mean, in the end, I mean, you have to manage, to try to balance. On the different regulations, you have to comply in the different local environment. So this is a very important aspect. >> So, managing very large infrastructures like Ferrovial, do you think that new trends, new technology trends such as IoT, Internet of Things, or mobile technologies or something like that. It's making things more difficult for you, for the company, for security management. >> Well, yes, of course, I mean, in the end, well, first we have to say that nowadays emerging technologies are absolutely key, it's a very important business driver. I mean, the I mean, yes, and the opportunity that taking advantage of these new emerging technologies is going to provide us with is absolutely key. So it means that I mean, of course Ferrovial bet on 3D printing, bet on, of course, drones, bet on artificial intelligence and all these different new technologies that are now emerging. But on the other side, on the other hand, of course, I mean, this in the end is bringing us new and you kind of problems. I mean, new risks that we have to face that is something that has happening, I mean, for many, many years. Taking down that technology is all the time evolving, advancing, evolving, advancing. In the end you have to adapt the way we reach, we manage the risks to meet this new scenario, which is absolutely key in order to be successful with your businesses. So for a security perspective, I mean, the first ones who bet on the new technologies are the cyber securtiy guys. But on the other hand, of course, I mean, we have to manage manage this new week scenario, okay? >> Do you feel that people is aware about the risks of this kind of technology, new technologies. Because right now I can have a cell phone, I can take my work to home and maybe I can forget the mobile phone, I don't know, in a bar or in whatever, the place. Do you think people is secure about that, and what about a big company for example that have a lot of different employees. >> Well, in general, I would say that people are not aware of the different risks that they are facing every day. I mean, nowadays everything is about technology, and then this is a very used phrase, but in the end it's true that people is the weakest link in the chain. I mean, and people in the end are not aware about the different risks they are facing every day when they are using, as you say, mobile. They're connecting to a cloud environment, they're using they don't know. So this is one of the most important things that we have to consider, that we have to improve, that we have to bet on. Which is awareness, just to try to keep people conscious about what they have to face in their day-to-day. >> Let me ask you about the other trends in technology. What about cloud? So, I hear that everything is in the cloud right now. So for me, it's really difficult to understand because if everything is in the Cloud, maybe you can lose a little of control about the information. What about that in a big company? Are you migrating things to the Cloud, this better solution? >> Let me say that when we are talking about cloud environments, not all the different cloud environments are the same. The concept Cloud is a very wide concept, which means that you can have cloud environment which are really good. Or you can have cloud environments which are not as good as you would like. So in order to try to make difference between the good environments and the bad environments, large companies. And this is the case of Ferrovial, have a specific framework in order to choose the right environments. Those environments that are going to allow us to know what is going on to detect the different cyber threats. To contain the cyber threats, to be able to manage the different incidents, to react and so on. So the main message is not only all the different cloud environments are the same. >> So you were very close with the service providers usually in this kind of scenario, okay. >> It is very important just to have a formal framework in order, I mean, to analyze what you are going to buy. The service you're going to hide is as good as you would like the service to be. >> As the proper one for your situation, okay. Okay, it's a very interesting point, and let me talk to you about our last word. What about artificial intelligence? It's a talent, it's an opportunity, it's something that is not required to consider in cybersecurity? What about that in a big company like Ferrovial? >> Well, artificial intelligence absolutely is something that Ferrovial that we can take advantage of. Okay, nowadays something that you have to consider. In the end in terms of IT, you have to know that little by little all the different IT environments are going to be the same. There are no differences between several companies when we are talking about IT. Or this is something that is going to happen in the. Which means that now this IT is something that we should consider as a commodity, okay? So what is important is the treatment that you are going to do with your data with all the information you have. And in this way, artificial intelligence is going to become something absolutely important to be successful with your businesses. This is regarding the business. So of course, this is an important bet for Ferrovial just to go farther with the different capabilities artificial intelligence can provide as with, okay? And in the same way, of course, is absolutely key. It means that through the use of artificial intelligence, we are going to be able to analyze. To detect suspicious behavior in all our services, all our infrastructure. And artificial intelligence is going to help us to make the right decisions, to go farther, to go faster. And of course, and even is going to think for us, no? Which is something that we could say it's a little bit scared. But it's something that is going to happen. Anyway, artificial intelligence is something absolutely important, not only in terms of security. But also for the business, something absolutely important for Ferrovial. >> What do you think about talent, the talent management in the company? Because we are speaking here about cybersecurity but also about artificial intelligence joining all together. So I guess the current profiles maybe are a little outdated. I don't know. What do you think about that? >> We're talking about just the talents and regarding cybersecurity or? >> Yeah, yeah, of course, cybersecurity but with the big challenges today. >> Well, in my opinion, when we talk about talent, we have to make differences between two types of tallent. Technical talent and management talent, okay? You were talking about our company as Ferrovial in the way what we are looking for is management talent. In the end, it means since, as I told you, we are company which in terms of IT and digitalization, we are very service-oriented. It means that the operational level is all without source. So that means, in the end, we have very good partners in terms of IT. What we need is just to manage our partners. So we look for very good talents in order to manage cybersecurity. But also, you need good talent in terms of technical talent- >> Technical skills. >> Absolutely. So in general, I have to say that we have lack of talent in the Spanish market. Mainly because the good talent is not paid enough. It's not really well-paid. So we have very good people in Spain. For instance, very good people coming from the University. Very good people that have realized that cybersecurity is one of the main pillars we have to consider in the future in order to do businesses. So we have very good talent. But when this talent, they realize that they are going to have a very good career abroad out of Spain, they leave Spain. That's the problem that we are having nowadays. But considering the two types of talent, in the case of Ferrovial, we look for management talent, not from technical talent. This is something that we obtain from our IT third parties, okay? Our partners in terms of IT. >> Okay, one of the main concerns in this course, it's about identity, identity protection. So we are really worried about to provide people with tools in order to protect their own identity, identity in their daily lives. What about the identity protection in a very big company with thousands of employees like Ferrovial? How do you manage that in the day-by-day operation? >> Well, first of all, let me say that that's true nowadays. Identity management has become one of the main priorities in terms of cybersecurity. The reason is that nowadays, since everything is service-oriented, everything is going to the Cloud. Nowadays, taking into account that there is a direct relation between cloud consumers and the Cloud. In the past, when everything was based in our on-prem data centers, all the traffic, all the connection had to go to our data centers. But nowadays, everybody can go directly to, for instance, Office 365 environment at home. And they can consume these services directly. So it means that if you're not able to protect, to manage identity in a proper way, everybody having. Or not having the proper rights, could access your information resources. So taking into account this new scenario, consumers and Cloud having relationships directly. The proper management of identity is absolutely key. So in the case of Ferrovial, we have been working in a formalized away many years, in terms of identity management. So when you are talking about thousands and thousands of employees that you have to manage. Thousands and thousands of identities that you have to manage, you need a formal process. This is very important. Once again, I said that cybersecurity is not about technology. In the same way, identity management, which is a very specific and important aspect of cybersecurity is not about technology. It's a very complex process. So first, you have to formalize your process. You have to know very well your company and then you can choose the technology that's going to support your process. Afraid you have to think in the process, you have to define the process and this is what we did in for a really long time ago. This is something that is continuously evolving because as I told you identity management in the past was something related to your on-prem and data centers now, the identity management is about the way you are going to manage identity in a cloud environment. In which you have data relation between the consumers and the cloud environment. >> It sounds very tricky it sound is because I remember what I studied in the university server security. >> We usually protect our services or equipment just with a firewall but today is very complicated. What with calcio cloud computing. There's no firewall really? >> Well, I mean it's- >> The limit is your identity. >> Yes. I mean and because of that identity has become so important. Nowadays because as you're saying I mean when all the traffic all the communication have to have to do with your on prem data centers, I mean, you could control everything you have firewalls. You have another kind of a cyber security devices, but nowadays everything is in the cloud. Of course. I mean, you don't see these different devices. Could you have firewalls you have ideas you have anti-malware solutions. But in the end I mean is you have a correct ID you could access everywhere. So it's nowadays the challenge is just to be able to make differences between the suspicious behavior, the right behaviors, the right users, the bad users. This is once there is a very trained in concept nowadays which is user behavior analytics this becoming a very important practice just to make differences between the right people and the bad people trying to access your environments, most. >> It's interesting. So you're not only authenticated users. But also also you're analyzing the real behavior the user online in order to verify that the user is the identity of the user is the identity the he or she provide. >> Yes. >> When authenticate. >> In my data you have a laptop and your laptop been compromised has been hacked and the bad guys have your credentials they could access simulating a being you but imagine that you usually access your Cloud environment. I mean from 9 to 5 in this specific type of laptop something like that if your user behavior analytic process detects that maybe the ID is a separate ID, but they are trying to access from a different country in a different time table. Just trying to do something different. Of course. I mean if you're able to make these differences you will be able to avoid the bad behaviors inside. I mean, you're a cloud environment the something that nowadays is a priority for all the different large companies are of course. It's a priority for Flavia. >> So I get also several security awareness courses like this one is also important for every company. >> But as I told you before I mean, it's user behavior users in general, people in general is still the weakest, the weakest link in the chain. So it means that we are I mean we have to be continuously just well teaching people. I mean just what behaviors are the correct behaviors what behaviors are not a very good behaviors. >> And in reminders all the time. >> Absolutely every time I mean, I mean, I mean you know that when we are talking about cybersecurity you have a lot of different processes and aspect that you have to cover that talking about technical aspect, monitoring, detecting, incident management, but you have on the other hand you have identity management company as management, business continuity management. You have a lot of different things that you have to consider and one of the pillar which is absolutely important is awareness just to let our people know what is good. What is not good, because in the end, well, I have to recognize that nowadays seen this world is a very idea and technical world is absolutely difficult just to know what is good and what is not good. >> Okay, and one more question Juan what do you think about the market? Do you think there are opportunities for another companies or maybe one or two people that join together in order to create a new innovation of a server security that can be a good Improvement. For example, a big company like Ferrovial? Other environments in cybersecurity. >> Well, absolutely. I mean nowadays. I mean the market is plenty of opportunities in order to innovate. Not only in the field of cyber security but also in every field and since nowadays the use of technology, of new technologies emerging, technologies is becoming a priority. If you want to survive in the market, if you want to become successful, so it means that you can innovate, you have to innovate in order to take advantage of the new technologies and in the Phillips curve, it is happening the same. Another thing that for instance, of course, I mean we talk about the core of our activities when talking about Ferrovial just innovation in the field of cyber security is not one of our core activities but is absolutely needed just to take advantage of the innovation that other companies are going to carry it out. Okay, so there is a lot of room in order to in order to innovate not for sure. >> You think that companies are usually open to innovation and uncertain in the market for innovation? >> And apart from that apart from that sorry we have to consider that everything is changing very fast, quickly, very quickly. So it means that in terms of cybersecurity what was really good in the past in order to prevent, to detect, to contain things. Maybe nowadays something good in the past maybe is not as good as you would like nowadays why because everything is evolving continuously. So it's in a very fast way so it means that there are a lot of space for improving and for innovating. >> It sounds great. So I think we are done. Thank you very much Juan. It's been a very- >> My pleasure. >> Interesting and fruitful conversation. So thank you very much to everyone. See you in their systems. >> Thank you very much.
