“Online, a Little Paranoia Is Healthy”

– Have you ever clicked on a phishing email?

– Yes. I’ve never gone any further—as we say in my profession, paranoia is healthy—but I have clicked. Far more often, though, I’ve been the one sending phishing emails as part of training exercises, because that’s how people learn. You send them out, and when someone takes the bait, you sign them up for a training course.

The weakest link in cybersecurity is the users,

because, joking aside, they’re very hard to update—you can’t just install a new version of the software on them. So the only option is some kind of training. That’s hard too, because it doesn’t give people skills that directly make money. “But do I really have to?” “Why right now?”

My own data, passwords included, has leaked.

Phishing is just one of the popular ways to get hold of usernames and passwords.

– So what are the most common methods today?

– Much more often, attackers count on the fact that we humans are lazy, and as a result we reuse passwords. Many people have a single password—sometimes even a good one, with lots of digits and symbols—and they use it everywhere.

Alas, not every place is equally well protected. It used to be internet forums; now it’s all sorts of online shops that make us register, and we use the same username and password. Very often such sites are hacked trivially and the data is siphoned off.

These accounts get collected, and there’s a very lively black market. Whoever gets hold of them first tries to break into your email, then moves on… Whether they hack your social media account and use it to spread malware or run scams, they’re looking for a way to monetize that access, to make some money…

Right now, if we look at the number of victims and above all the financial damage, second place online goes to ransomware attacks—when malicious software encrypts your files and then demands payment to restore access to the data. In other words, high-tech racketeering.

In first place, though, is an extremely low-tech attack, which is not really a cyberattack at all: gaining unauthorized access to business correspondence.

The cyber part is getting access to the email. After that the attackers study how and in what manner people communicate, and then, for example, they forge invoices—they send ones that look exactly like the real thing, the only difference being the bank account.

In Bulgaria too, almost every month there are companies that lose 40,000–50,000 euros this way, and if they don’t react fast enough, that money can’t be recovered. From the banking system’s point of view, it’s a perfectly normal transaction.

– How did you end up in cybersecurity?

– It was a conscious decision, made more than 20 years ago. Cybersecurity looked very different back then; it was an extra that system administrators did on the side. The first viruses were just starting to appear, and at some point I realized this was what interested me—the way of thinking in the field, even though there wasn’t really a sector yet.

At first I got interested in security applications on UNIX machines. In those days much of what had to do with cybersecurity was built on them. Gradually I specialized, and the sector began to grow fast. I teach network and information security, and I regularly enjoy showing the kids a chart of everything an information security specialist is supposed to know—every year new little boxes get added. Today it’s a very serious field with all kinds of branches: technical, legal, policy.

I focused specifically on information security management processes. Today they are tied very deeply to the management of any organization; for information security to be cost-effective, it has to be integrated. What I do is manage processes at the national, supranational and European levels.

– What are the biggest challenges at the national level? From the outside, it looks as though most of the processes concern companies…

– Actually, that’s not the case. Like every other aspect of life, this one depends on the state too. It’s very challenging, because regulation is the state’s responsibility.

Every single word in every piece of legislation costs money to some sector, to organizations, or to all of us.

That is anything but trivial. Such decisions must be made very carefully, so that we don’t overregulate something and harm a sector.

– Cybersecurity is often called the most thankless job in IT. Because you can never be sure you’ve covered all the risks…

– Absolutely. It is an extremely thankless job, because in practice there’s no return on investment. Cybersecurity is working when nothing has happened, and that’s exactly when people ask, “What are we paying you for?”

Too much money is always spent on it—right up to the moment when not enough has been spent.

One thing that drew me to it is that cybersecurity is not a goal. There’s no scenario in which we say, “That’s it, we’re cybersecure, we’re done.” It’s a process. There’s a cycle of constantly analyzing what’s going on and adapting to it.

Cybersecurity should be like the water and sewerage utilities. We should know it’s there, but it shouldn’t be in our face until the moment we need it.

Security is always a balance. The more secure something is, the harder it is to use.

And the other way around: the easier it is, the lower the security. We ask for more passwords, fingerprints, iris scans, someone will call to check whether it’s really you using the service. Every step that makes something more secure slows it down and adds inconvenience.

The more we integrate, the less cybersecurity is the job of a handful of specialists, the better for all of us. There’s an old joke in the software world: “What are you doing?” “Writing bugs.” It’s true—there’s no way a program can be completely free of bugs and vulnerabilities. Especially now, when software consists of such complex systems relying on a huge number of libraries, things get even more complicated. Suddenly, very abruptly, it gets scary.

– Doesn’t artificial intelligence flip the paradigm somehow? Is it the next step that could create a new kind of risk?

– Yes, but in both directions, because artificial intelligence is just another tool—it can be used by cybercriminals to attack and also for cyberdefense. One of the big problems in the industry is the shortage of people. It’s not just here, not just in Europe, but all over the world. We have a crying need for people working in cybersecurity; Europe is short by hundreds of thousands.

– But shouldn’t a field like artificial intelligence have some regulation before we know it well enough? It’s no accident that there’s so much talk about it…

– There is no such thing as fast regulation; it doesn’t exist. We can’t wake up tomorrow to a new regulation—it simply doesn’t work that way.

It was the same in the Wild West: something new begins, lawlessness sets in, some people see the opportunities and start making money.

And it’s exactly those people who say, “Wait, I need security.” Infrastructure arrives, laws are made, structures are built to impose order. The same thing is happening in cybersecurity.

The internet developed as far as it did because there was no regulation. And now it’s the very thing driving the world forward.

– Still, I don’t think it has ever happened before that 1,000 investors and scientists say, “Let’s stop developing something for six months while we come up with regulation.” Besides, that’s impossible—nobody can enforce such a moratorium.

– Why do you think it’s never happened? There were the same letters about cars and about airplanes. “Stop this thing, it’s dangerous, people can’t travel that fast, the wind will suck the air out of their lungs, they won’t be able to breathe, everyone will die.”

That’s the normal process by which we, as a civilization, accept a new technology.

It was like that with blockchain, with mobile devices, with the internet itself. The fact is that today

with zero investment, your message can reach more than half the people on the planet who are connected to the internet.

That changes our society, it changes everything, including our political systems. Right now most totalitarian regimes worry about the internet more than about anything else, and that’s exactly where they start imposing restrictions.

– In artificial intelligence and its latest leap with GPT, what are the biggest dangers looming from a cybersecurity point of view? People often stress that more of us will be able to organize a cyberattack.

– Have you ever received a “Nigerian scam” email? Certainly you have. A Nigerian millionaire will give someone a lot of money if you just transfer a modest sum… Have you noticed how badly those emails are written?

It isn’t hard at all to produce a better translation; the point is something else. The first two or three emails in such a scam are written very carefully. This is organized crime, and that step is in the hands of someone fairly low in the hierarchy, who just copies and pastes. The moment you reply to the second or third email, you’re handed over to someone higher up, who actually knows the language.

Why is that? There’s a study, a rather old one from 2010, showing that the text is deliberately, blatantly illiterate, because that way the more intelligent people, who would get suspicious, delete it automatically.

– Because the goal is to go after the more vulnerable.

– Exactly. With something like ChatGPT, which generates coherent and far more personalized text, criminals can target and deceive many more people. The “Nigerian scam” works in 0.001 percent of attempts;

if it reaches 0.1 percent, it gets scary. We’re talking about billions of people connected to the internet, and that tiny percentage is actually a huge number of people.

Unfortunately, criminals are among the first to adopt new technologies—that’s how they operate. They don’t need sign-off from six committees, they don’t need approval or funding. Things move fast there.

– They have to stay ahead of you too…

– Not only. They have to stay ahead of the other criminals as well. That’s why they’re the first to adopt new technologies. But

there is already talk of artificial intelligence doing part of the information security specialist’s job.

It collects all the data, analyzes it, recognizes the risks, and in 95 percent of cases it can respond appropriately and protect us! In this way it replaces a huge number of people who… were never there to begin with. So you see,

AI doesn’t take jobs away—on the contrary, it fills jobs that we can’t fill.

But let me turn the question around. Artificial intelligence can be manipulated in many ways. For instance, these models are trained on some input data. If you manipulate that data, you can produce behavior that deviates from what the model was designed for.

Say you make self-driving cars. If you have access to the data your competitors train their models on, you could make their AI drive worse, even kill someone, which would drive them out of the market.

So AI as a technology also needs cybersecurity, but on a fundamentally new level. That’s something we haven’t faced until now.

– And we still have to learn. Maybe the battle between cops and robbers is eternal—what do you think?

– So far, yes. AI has the potential to reach a singularity here, so that at some point we say, “This is the perfect AI that protects us, and from now on we don’t have to deal with it.” I’m skeptical, because, as Harry Houdini said, “No lock made by man can keep out man.” At least for the past 30 years the chase has gone on, and I suppose it won’t change—that’s our paradigm.

Maybe in a hundred years or so, when these technologies—the internet, artificial intelligence—have sunk as deeply into our society as cars have today, it won’t be such a battle anymore; we’ll have reached some limits of knowledge.

Right now the huge problem comes from vastly different levels of digital culture. We have systems at different levels, we have no standardization, we have no regulation. It’s only just starting to appear.

The first regulation to talk about data in the modern sense at all was GDPR, in 2016. Not even 10 years have passed since! From a legal point of view, where people study precedents from 50 or 100 years ago, that’s the blink of an eye.

– Bulgarians were once famous as very good hackers; some of the most “successful” viruses were written by Bulgarians. Have we lost that “fame,” and why?

– Because we found jobs. Back then we had a relatively well-developed IT industry; we manufactured computers. During the transition after communism, many of those people were out of work and somehow started putting those skills to use. There was no way for them to make money, so they used them to gain some kind of fame.

Then the economy developed, those people became valuable, and today we have a huge labor shortage. In other words,

for all the would-be writers of malicious code, it’s much easier and more profitable to hold a normal job.

– I’ve read people in the industry saying we have the potential to become a regional leader in cybersecurity. Do you agree?

– We have potential, because in many cases we carry no baggage. For example, we have one of the best gender balances: more than 30 percent of the people in the IT industry are women. But that isn’t an achievement we set as a goal and then met. It came about thanks to Bulgarian culture, where everyone works. Our society is built that way: we have kindergartens, with all their flaws, and long maternity leave.

Sometimes starting late in a field lets you leap ahead.

In computer science, one of the things that keeps us from progressing quickly is that we have to stay compatible with earlier solutions. We drag along things from so long ago, simply because bits of code are still in use.

Yes, we have the potential to grow, if we structure training programs and aim them at children. Cybersecurity specialists will clearly be in high demand, at least for the next 10 to 20 years. Half the children starting school now will work in professions that don’t exist yet. Were there influencers 10 years ago?

– There wasn’t even DevOps.

– Nor DevSecOps—the approach hadn’t been invented yet. Yes, it’s entirely possible for us to become a regional cybersecurity hub, but it won’t happen by itself. I’m far from thinking that we as a nation are special, smarter than everyone else—there’s no such thing. That’s small-country syndrome; we’re the same as people in neighboring countries, and in faraway ones too.

But in some cases we may have an advantage, because we don’t carry the baggage of Western countries, where these structures are already built and traditions exist.

From that point of view,

maybe we are a startup country—we’re only now creating many fields, so we can react much faster and be more adaptable.

Only time will tell…