THE time between a weakness being found in a computer system and attackers exploiting it has shrunk from years to minutes – and artificial intelligence is accelerating the threat.
For Matt Palmer, director of the Jersey and Guernsey Cyber Security Centres, that speed is forcing a rethink of how organisations protect themselves.
“It is a constant battle to maintain visibility of the threats that are coming at us, the vulnerabilities that we have and the actions that we need to take to resolve them,” he said.
Mr Palmer, whose background includes serving as chief information security officer for a number of global financial services companies, leads the teams helping both islands respond to a rapidly changing digital landscape.
Each year, the centres receive and process notifications covering more than five million potential cyber-security events across the Channel Islands.
So far in October, those notifications have included 15,900 publicly exposed services, 499 known vulnerabilities, 329 suspected compromised systems and 144 other potential threats.
The incidents encountered each day can be “incredibly varied”, Mr Palmer said, with attacks aimed at stealing information among the more recent trends.
“There’s lots of different things that we see because we’re small jurisdictions. What we tend to see is variation from day to day rather than consistent volumes.”
Increasingly, however, it is the pace at which threats develop that presents the challenge.
“AI is incredibly powerful,” he said. “It can be used for great good or for great harm, so we need to make sure that we protect ourselves from it.
“In the long run, the only way to protect ourselves from AI is by using AI, but those defensive tools are not really available yet.”
A vulnerability is a weakness in an application, hardware or software that could allow someone to gain access to a network or otherwise exploit a system. Finding that weakness does not necessarily mean anyone has worked out how to use it.
Once it is identified, however, attackers and defenders begin trying to understand how it could be exploited – either to launch an attack or prevent one.
Traditionally, Mr Palmer explained, the gap between discovery and exploitation had been in the region of two years. AI has helped compress that window dramatically.
“Over the last few years, that has gone down from years, to months, to weeks, to days and now to minutes,” he said.
“That’s a huge problem, because of course organisations do patch their systems, but they tend to have structured and managed processes to do so.”
Those updates might happen monthly or every couple of months, he explained, while obsolete technology can be particularly difficult for larger organisations to replace. Some systems cannot be patched at all.
“In that context, the ability for somebody to identify a vulnerability, exploit it and use it to attack you within a matter of minutes can be terrifying,” he said. “So we really need to rethink how we go about this type of defence.”
The pressure was illustrated earlier this week when a vulnerability in a programming language called PHP – discovered using AI – prompted organisations around the world to take websites down temporarily so they could address it before attackers struck.
For IT teams, Mr Palmer said, this demands a change in approach. Updating a system can itself cause problems, so organisations have often chosen to test changes rigorously before introducing them.
“Today, that dynamic has changed. It is better to test quickly. It’s better to patch quickly and take a risk of downtime – and that’s fairly fundamental change for IT teams and IT suppliers to get to grips with.”
Despite those immediate concerns, he believes AI could eventually become “more of a help than it is a hindrance”.
“Tools develop. I think that will actually give us new capabilities in order to defend from cyber attacks. It’ll give organisations new capabilities and, in the long run, it’s likely actually to make the world safer.
“In the short term, however, it’s a very real problem. Over the next few years in particular, the speed at which criminals can act is much, much faster than the speed at which responsible organisations can act.”
Helping the Channel Islands meet those challenges is the task of two centres operating as a single team.
Initially established as the Cyber Emergency Response Team in 2021, the Jersey Cyber Security Centre is responsible for preventing, protecting and defending the Island against cyber attacks. Its Guernsey counterpart launched earlier this year.
“Our processes and systems are the same and what we do is we try to ensure that we are supporting people locally. So if you are in Guernsey, we will support you from Guernsey, and if you are in Jersey, we will support you from Jersey.”
Sharing tools and processes strengthens the service’s resilience while reducing costs for taxpayers, Mr Palmer said.
That emphasis on resilience also underpins the Island’s new Cyber Security (Jersey) Law. Economic Development Minister Gerald Voisin signed its commencement order in July, and the legislation is taking effect in stages.
It introduces requirements for operators of essential services covering their digital defences and the reporting of cyber incidents.
“If you have cyber attacks that impact electricity or water supplies, these are not just theoretical,” Mr Palmer said.
“In exactly the same way that we build health and safety and so on into things, we need to build cyber security in by default. So that actually, when issues arise, we have the ability to defend and protect against them.”
Another part of that work is the Jersey Cyber Shield, through which organisations can register with the centre to receive information when it becomes aware of a vulnerability or compromise.
Speaking at the Channel Islands Cyber Security Conference at the Radisson Blu Waterfront Hotel earlier this month, Mr Palmer outlined plans to expand the scheme.
“Next year, this will become the Channel Islands Cyber Shield as we roll it out to the Bailiwick of Guernsey,” he said.
“We also plan to deliver a portal so we can share this information in real time rather than waiting for an analyst notification.”
