From folding phones and flying taxis to VR driving experiences and 5G beehives, you could be forgiven for thinking that cybersecurity is the ugly duckling amongst MWC’s technological glitz and glamour. Walking through Cisco’s enormous, smart double decker booth on our way to see Gee Rittenhouse, it is easy to see the buzz generated by its huge IoT and connected car displays and many other demos.
Having navigated the crowds and located our meeting room (these booths are equally as vast in private, off limits space), we sat down to talk about a less visible but indispensable element of the innovation on show.
“We scan roughly 400 billion emails and process 185 billion DNS queries a day, which is about five percent of the whole internet,” Rittenhouse tells us, a statistic met by a split-second pause while we try to compute the sheer scale of this operation.
Rittenhouse is Senior Vice President for Cisco’s Security Business Group. A tech enthusiast his whole life, the conversation quickly turns to how he successfully merged academic disciplines and navigated his way down the security path.
“I was one of those kids who almost blew themselves up by experimenting,” he recalls. “Early in my life I always wondered how things worked, so I went down the physics avenue to start with.
“The subject forces you to simplify whereas engineering is all about managing complexity, so if you have both and are able to take the complexity and simplify, I think you should have a good idea of what’s going on.”
Hence Rittenhouse took a formal technical path too – a PhD in electrical engineering and computer science from MIT before going to Bell Labs where he spent 20 years and ended up as President.
“A little over five years ago I moved to Cisco to help with their cloud efforts, and of course security is a big issue when dealing with the cloud, so this is what led me into this space,” he adds.
Cyberattacks frequently make headlines. Last year’s hack on the UK’s National Health Service and accusations of Russian attacks contributing to President Trump’s election as US President are two high-profile examples, while the overall number of attacks are rising.
“There are two dimensions to this problem,” says Rittenhouse.
“Enterprise itself is becoming more complex. It used to be a case where I would sit there with my data centre with the enterprise behind it – most of my applications were from my laptop to my data centre and I would only go out to the internet to surf the web. The perimeters were clearly defined.
“Now we have the cloud and all the applications we need. There are branches and mobile users as well, creating a dynamic system with data and applications on one side and users on the other. This adds a lot of complexity and complexity equals vulnerability from a security perspective.”
To put Rittenhouse’s observations into context, Gartner predicts the 2019 public cloud services market to reach $206 billion, a massive 17.3 percent increase on last year. By 2022, more than $1.3 trillion of IT spend will be directly or indirectly affected by the shift to cloud.
In short, this is opening up a huge space for hackers to target.
“In the same sense, the sophistication of attacks has increased remarkably in the same timescale,” continues Rittenhouse. “Now we see nation state, weapons grade software in the system whereas before this was done by more improvised hacked pieces of code.
“This combines to make a two-dimensional effect that is pulling in different directions – the quality of the attack and the attack surface are both increasing and this has, frankly, caused Cisco to reconsider its approach to security and the products we offer.”
From emails and cloud to firewalls and proxies, Cisco covers every dimension of a network enterprise and offers the broadest portfolio of products in the industry.
Add to this deep level of threat detection a set of sophisticated machine learning tools and algorithms, and the company is able to identify and stamp out many potential hacks before they spread.
“If I see something strange on your endpoint, within minutes I can see if it’s a new file we’ve not seen before, detonate it if malicious and make sure all equivalent files are detonated when picked up,” Rittenhouse adds. “That is the loop.”
However, the added complexity of cloud is where Cisco has had to adapt, and it has done so by approaching the issue from a trust perspective and establishing new boundaries.
Rittenhouse points to identity as an example. “You are known, you are in the system and have the rights to these applications,” he says, “and I can prove it is you and your device, so the boundary of trust is there with your network and what you are doing.
“As soon as you break one of these trust barriers, we can put you in a different category and downgrade accessibility until that trust is re-established. It is a continuous cycle and has helped simplify things for customers.”
But what about autonomous devices that communicate with networks through the internet of things?
The GSMA, chief organiser of MWC, released research last year predicting that the global IoT market will generate $1.1 trillion in revenue by 2025. This equates to more than 25 billion cellular and non-cellular IoT connections, a monumental rise considering there were 6.3 billion connections just two years previously.
Rittenhouse quickly acknowledges the impact this is having on Cisco, again prompting the company to adapt and evolve its security solutions.
“This not only expands the attack surface, but also the scope as you can also be on the end of physical damage,” he says. “We have spent a lot of time on this covering the full spectrum, for instance with very small appliances that can connect via IoT, like a lightbulb, to elevators in shopping malls.
“We look at the posture of these devices and segment them automatically – this is because we have the visibility to detect irregular activity so can see if a printer is talking to networks it shouldn’t be talking to. Likewise, in a manufacturing plant, we can see what bigger machines are doing.”
While on the topic of IoT, it was inevitable that 5G would enter the conversation (we had done well to avoid it for 15 minutes).
The undoubted headline act of Mobile World Congress, 5G took centre stage with trials and demos of all manner of use cases, including live broadcasting and even remote control of industrial trucks stationed 2,000 kilometres away in Gothenburg.
With undoubted potential to support advanced IoT deployments, Rittenhouse also explains how 5G can assist Cisco in the security realm.
“It actually allows us to do quite a bit from a security perspective,” he enthuses.
“5G enables the service providers to serve customers in a way they haven’t done so before. Now we can do network slicing and segmentation and add security services, so 5G allows these providers to treat the enterprise in a very different way.
“That means all of the security we had in play in the enterprise sphere gets repeated, which is a good thing and our customers really like this, whether they get it through us directly or our service partners.
“That trust layer I was talking about can now also go all the way down to the device – we can have trusted infrastructure as well as trusted users.”
Cisco’s customers range from SMBs all the way up to multinational, billion-dollar organisations, an extremely diverse client base covering a tremendous array of security challenges.
For smaller companies, the impact of an attack can be permanently damaging.
Cisco’s own research (2018 Security Capabilities Benchmark Study) finds that 54 percent of all cyberattacks result in financial damages of more than $500,000 through the likes of lost revenue, customers, opportunities, and out-of-pocket costs.
Take into account that 53 percent of midmarket companies have experienced a breach, and the threat is both real and vast.
But, does this mean smaller enterprises should approach the issue differently? Our conversation with Rittenhouse concludes with an important consideration.
“I wouldn’t segment it out as small against large, as uniformly across all of them you can ask what your threat risk is versus your ability to respond.
“Smaller companies don’t have a large IT setup, large companies do, but large companies are a bigger target. What we’ve done is use automation and simplification as a huge focus. For smaller companies, we’ve added security layers to our SMB platforms so you can get it automated in with no fuss. Our partners can also come in and offer services.
“Security is available and accessible to smaller customers, it is simply a case of how you wish to consume it. Do you do it yourself or outsource it, that is the biggest question at the moment.”
ABOUT GEE RITTENHOUSE
Gee Rittenhouse is Senior Vice President for Cisco’s Security Business Group, responsible for next-gen firewall, cloud, advanced threat, network and end point security products.
A graduate from the University of California in Physics and holder of a PhD from the Massachusetts Institute of Technology, he spent much of his career at Bell Labs, during which time he chaired global non-profit research group Green Touch, a body dedicated to increasing energy efficiency of communications networks.
