AN ethical hacker who helps companies test their digital defences by breaking into their systems – sometimes by physically gaining access to businesses in disguise – was among those who attended the latest Channel Islands Cyber Security Conference.
Rob Shapland gave the keynote speech at the event, which was organised by the Channel Islands Information Security Forum and took place at the Radisson Blu Waterfront Hotel on Friday.
It brought together cyber security experts and other speakers to discuss the threats facing Jersey and how the Island can defend itself.
Explaining his role as an ethical hacker, Mr Shapland told the JEP that: “I test company security from an offensive perspective, so I use the same tools and techniques that real cyber criminals do.
“The difference is once I break into the network, I don’t then steal the information and sell it to other cybercriminals or do a ransomware attack. Instead, I help those companies defend against it.”
Mr Shapland’s services sometimes involve physically breaking in to places of work, something he has done using a variety of methods.
“So dressing up as a fake employee using maybe a badge design that I’ve discovered through LinkedIn research, or maybe I go in as the guy that fills up their printer paper or their coffee pots,” he continued.
“I’ve been delivered inside a large Amazon parcel before and wheeled into an office, cut out of the box and walked off.”
Each year, the Jersey Cyber Security Centre and Guernsey Cyber Security Centre receive and process notifications covering over five million potential cyber security events in the Channel Islands.
So far in October that has included 15,900 publicly exposed services, 499 known vulnerabilities, 329 suspected compromised systems, and 144 other potential threats.
Mr Shapland has worked with companies in Jersey on a number of occasions throughout his career, including one that saw him access a business by posing as a telecoms employee fixing something in the building.
He described the Island’s digital defences as “quite good overall”.
“Coming to conferences like this gives me a chance to present some of the things I’ve been doing in the UK and abroad, and get people’s reactions to whether they think they can defend against those techniques over here.”
Asked about the impact of artificial intelligence on the evolution of cyber attacks, Mr Shapland noted the advancement of deepfake technology – highlighting that this could be used with a number of techniques including calls and phishing emails.
“To have the ability to copy someone’s voice or create a video clone of them, and make them look like they’re saying ‘can you approve this invoice’ or whatever, it just makes those things a lot more powerful,” he said.
“You’re trying to pretend to be someone you’re not. If you can also look and sound like them, that makes the whole thing a lot simpler to do.”
