00:00:04: RTL Stories, the podcast with Lisa Burke from RTL Group.

00:00:11: We have been saying that length bleeds complexity.

00:00:14: by far so longer the password harder to crack it.

00:00:18: we are also humans and there was a fishing campaign earlier.

00:00:25: I felt victim for this.

00:00:33: Hello everyone!

00:00:34: And welcome to RTL stories The Podcast.

00:00:37: I'm Lisa Berg, based here at RTL in Luxembourg.

00:00:40: And In this series we meet the people shaping RTL group around the world.

00:00:46: now imagine getting a call from your boss on the phone.

00:00:49: you recognize their voice and they ask You to take direct action outside of company channels.

00:00:57: but what if This isn't Your Boss At All?

00:00:59: Now with AI scams like these are becoming more convincing any of us to know which voices we can actually trust.

00:01:10: October is European Cybersecurity Month, and so it's a good moment to talk about how we can protect ourselves under our company.

00:01:19: My guest today is Jens Hickmann who is Divisional Information Security Officer at RTL Group.

00:01:26: He's worked in information security for nearly fifteen years across banking, consulting and now media too.

00:01:33: And so today we're going to talk about cyber-security why it matters and how can all play a part.

00:01:40: Welcome to the podcast Jens!

00:01:45: With your role at RTL Group For more than decade what does the Role of Divisional Information Security Officer actually look like?

00:01:55: Well, my team and I were working for the good of the whole RTL group.

00:02:00: Not just our single entity but also for the whole group.

00:02:03: We protect the RTL Group information assets.

00:02:06: together with my teams colleagues in business units and corporate centre we make sure that the information assets are available when they're needed to our teams and information assets.

00:02:18: that is basically all the data our teams need when doing their jobs.

00:02:23: We define, for example, IT and information security policies of the whole group.

00:02:28: I represent RJ Group towards internal and external stakeholders in terms of information security And actually i give our data a voice When it comes to discussions about how to secure systems or acquire or implement new system And I also consult our business units and corporate center departments in management, In terms of information security and IT governance.

00:02:50: So you're all professionals working on this field but the professionals are also humans?

00:02:56: Do ever make mistakes?

00:02:58: Indeed as you rightly say we were also humans.

00:03:01: there was a phishing campaign earlier.

00:03:06: fell victim for this.

00:03:07: I received an email and it looked like, It was from a former colleague who was working in the same company where I did internship And she said hey Jens!

00:03:15: i saw you also worked at this & This Company?

00:03:19: Did You already see The latest news on this matter?

00:03:22: Also had A personal touch.

00:03:24: of course I could relate to it because indeed Had an internship with this company.

00:03:28: So I clicked On the link To See what's going on or What is person was referring too.

00:03:35: I was kind of lucky.

00:03:35: It was from a phishing campaign that we initiated and i myself fell victim to it.

00:03:40: so luckily then you know, I didn't provide any sensitive information And they saw it.

00:03:46: and no it kind of grounded me and told me hey Jens You're also human understand Also our colleagues are humans.

00:03:55: be kind taking as an opportunity To learn From it build and grow our cyber security force.

00:04:03: And before RTL Group, you actually worked with financial institutions and other industries.

00:04:09: So what's different about protecting a media company?

00:04:12: What makes RTL group an interesting target for cyber criminals?

00:04:17: The differences are massive.

00:04:19: so in banking or the finance sector in general there is plenty of regulation.

00:04:24: everybody has an understanding why this additional control or that additional control In the media industry Our colleagues are used and actually paid for sharing information, distributing information.

00:04:36: And there's much less regulation where it is basically GDPR which we all know the one way or other Which yes they appreciate our work in that we secure our data but otherwise We always have to explain and convince our colleagues why?

00:04:52: There is a need for an additional control at which risk It is addressing and therefore helping our group to protect the assets that we have and which also present a value or help us do our business, make our revenues produce shows distribute news whatsoever.

00:05:10: And this is very different from bank or financial sector in general.

00:05:15: coming back to aspect of why are relevant target for attackers first and foremost they want money And it's their profession to trick other people and drain money out of companies or get data from these companies which then they can sell, for example on the dark web.

00:05:37: Unfortunately we have just seen earlier this year such an incident in our corporate center actually impacting the whole group

00:05:44: And we hear about cyber attacks and data leaks almost every day.

00:05:48: as you say, looking back at the start of your career.

00:05:51: The picture was quite different.

00:05:52: so what's changed?

00:05:54: About the threats companies are facing today?

00:05:57: first thing is time between.

00:06:01: vulnerability is identified an active exploitation tool.

00:06:07: We call it an exploit.

00:06:09: sometimes an exploit kit is massively increasing.

00:06:14: So in earlier times, it took days or weeks even longer sometimes to come up with a kit so companies had time to apply patches of fix the vulnerability.

00:06:25: nowadays especially in the context of AI this time is shrinking and shrinking.

00:06:32: This year we may still be happy to have few days lead-time before there's exploits available And for next year, we expect it may go down to hours if not minutes.

00:06:47: Cybersecurity often only makes the headlines and something goes wrong.

00:06:51: so can you give us an example of good cybersecurity?

00:06:55: What that looks like behind-the-scenes when everything is working as it should?

00:07:00: That's very well observed.

00:07:01: I'm happy your asking because You know, there's fast blame when something goes wrong and there is barely any applause.

00:07:09: When everything just go smooth as normal it all starts with a very well aware user community so that they can relate to cyber risks.

00:07:23: show good cyber hygiene behavior.

00:07:26: also company culture anticipating things going wrong and has a culture that is not based on blaming, finger pointing but rather learning growing.

00:07:37: so we take advantage of these misbehaviour or mistakes.

00:07:44: Turn it into something positive.

00:07:46: don't do the mistake again actually share with others.

00:07:51: So whole organization learn from it behaving better more secure afterwards.

00:07:58: Further, there is of course the IT teams anticipating that things can go wrong and cyber threats.

00:08:06: so they already when setting up IT systems take security considerations into account or even better involving our team not just me but also colleagues in business units to help them.

00:08:19: Ask them for support and guidance on these kind of matters, because the earlier they involve us.

00:08:24: The less intrusive at the cheaper our solutions can be Because fixing a system afterwards is much more complicated than expensive then setting it up in a secure way upfront.

00:08:34: Is there anything like perfect password?

00:08:36: I would say well There's not one perfect password but there are some good practice about having and dealing with passwords.

00:08:46: so first thing we have the saying that length beats complexity by far.

00:08:54: And so, the longer the password, the harder to crack it.

00:08:59: and The good thing is when you have a longer password then It's fair enough That you include dictionary words which makes it much easier to remember.

00:09:09: So if you then connect dictionary words with maybe your special character Then you have easily covered this limited level of complexity with a certain length, which is key for the security part.

00:09:23: And then you're also more likely to remember it.

00:09:25: so we don't note down somewhere where could be found and misused.

00:09:29: So that in full charge off your password?

00:09:32: Also what this key ends.

00:09:34: here We come back to the human part.

00:09:36: all of us Don't recycle your password only use it from one single purpose another purpose.

00:09:42: have an other password.

00:09:43: Well, now from passwords to deepfakes they're becoming increasingly prevalent.

00:09:48: We can now receive calls or even video messages that look and sound like people.

00:09:54: we know AI has changed so much the way in which cyber criminals can operate.

00:10:01: it's always about being on The defensive really you know, so how can we think about securing ourselves when it comes to cyber criminals and the way in which they're now using AI?

00:10:15: Well They use a I whatever.

00:10:18: It means because it helps them too make their attacks more sophisticated harder to attack for us And also two speed them up into Multiply them.

00:10:29: So this is really a poison for the industry or an accelerator, I think in earlier days of our career they were less technology based.

00:10:39: It was more on social engineering that somebody appeared at your welcome desk and claimed to be someone.

00:10:46: you are not.

00:10:53: but nowadays with technology train the models with existing pictures and imagery from the internet, social media whatnot.

00:11:02: And AI helps to make much better artificial identities and mimic your manager for example.

00:11:08: so it's harder to detect because they even pick up on slang or tonation in speed of language.

00:11:15: They also get a video.

00:11:19: Still, you can see it's not fully sophisticated.

00:11:22: with a little training or a little caution.

00:11:24: You can identify this.

00:11:26: but imagine in the next few months I'm not even talking about years i'm afraid they will become better and better because also access to AI solutions to build these deepfakes becomes easier.

00:11:40: so here I think that this would be harder.

00:11:44: So let's imagine I do get a voice message that sounds exactly like somebody who may be managing me and asks me to urgently sign off on a bank transfer.

00:11:54: How could i tell if thats genuine?

00:11:57: You can first check is it the usual channel you are contacted, then also try to see okay... Is this really the language of my manager ?

00:12:05: And then he requests in the usual thing He or she is asking for me Is there a certain pressure put on me, kind of limited time you have to urgently act something like this?

00:12:19: And they also like to put... ...a certain confidentiality in it.

00:12:23: So hey I'm not available for call back.

00:12:26: just act on this Keeps us very confidential maybe even kind of flattering You.

00:12:31: Hey i just involve because I trust you and try to trick you into doing Something For example such as bank transfer which usually would Not do In the way are asked now Trust the established processes in your organization.

00:12:46: We have our tools and processes established across a group, usually attackers will ask you to bypass them or ignore it – don't do so!

00:12:55: In doubt always contact your manager because even if the message that we received says and explains for some more-less reasonable points not to call back trust your manager call them back on established channels, maybe you have the direct telephone number or a team's channel.

00:13:14: Use this and confirm with your manager that you're doing good thing because there is nothing so urgent especially here when it about bank transfer.

00:13:22: they will ask to bypass these processes overnight always rush

00:13:27: And at the same time, we're increasingly using AI tools in our daily work.

00:13:32: Where do you see the biggest risks and how can we use these tools responsibly without missing out on their benefits?

00:13:39: Nowadays it's really easy to subscribe with maybe a private credit card or something for such solutions Or even use free-for-use solutions Without being managed by the group.

00:13:52: So if then put confidential information or trade secrets, our strategy items in this you don't know where the data resides.

00:14:01: Where it's processed and if its maybe even used for training the model And The next user may be a competitor is asking something about strategy and get some insights In.

00:14:12: what Is Our Strategy?

00:14:13: For example.

00:14:14: So when we assess our AI solutions We test them at review.

00:14:23: we anticipate these things.

00:14:24: We make sure that our prompts, colleagues or the files for analysis are not used to train models.

00:14:33: so whatever is put in stays our property and it's no use of training the model.

00:14:40: this one point another one uses licensed versions on the internet.

00:14:47: you can find via the ai hub easy access Models that are available to you in your organization and there.

00:14:54: You can be sure, but you're using the right tools for your purpose.

00:14:59: if it goes beyond this feel free to reach out to your IT or security team To get an approval of a test approach For a new solution.

00:15:08: we will not leave you alone.

00:15:10: and then is the human side of cyber security week.

00:15:12: We tend to think about firewalls and passwords, all of this very sophisticated technology.

00:15:18: But really a lot comes down our choices, actions or human behaviour.

00:15:25: so can you talk us more?

00:15:27: I like seeing my colleagues as the first defence force.

00:15:30: we do a lot with technology to prevent attacks that are going wrong but at same time still have business And so, we also have to allow and manage certain processes.

00:15:44: We have to communicate them into exchange.

00:15:46: Here come our colleagues in the game.

00:15:48: They are ones that may be addressed by attackers For example with phishing emails.

00:15:53: Well, I think it doesn't hurt to repeat because i'm a strong believer of power of three and repetition.

00:16:02: You can hover over the email address with your mouse and see if what is then presented matches what you see in the e-mail address itself.

00:16:10: If that's not the case, it's all already a suspicion.

00:16:13: Then if it has unusual typos or icons set up place on unusual ways or do not properly load... That another source of suspicion!

00:16:22: Actually the typos are getting better especially with AI.

00:16:26: But still, if the email also includes a certain sense of urgency that is its fear curiosity or greed.

00:16:33: It's also likely it should give us sign off suspicion and Also If they call an action from you like opening an attachment click on the link to authenticate somewhere And also remember must not only be in email could also be a QR code Or text message whatever.

00:16:52: before clicking always hover over the link and verify it.

00:16:56: All this together, I would like to summary with the word sync before you

00:17:00: click.".

00:17:01: Think Before You Click?

00:17:02: Yeah!

00:17:02: And most of us are very busy dealing with emails and messages in deadlines.

00:17:07: so its quite easy make one these small mistakes that can have surprisingly large consequences.

00:17:15: So let's say i clicked on a suspicious link.

00:17:17: then i realized probably shouldn't done what should do next.

00:17:22: Don't be ashamed about it.

00:17:24: We are all humans and mistakes happen, so first thing let your IT teams or information security team know because they can help you out to contain whatever has happened and prevent further damage from the company.

00:17:41: So that I think is a golden rule we should follow And for sure there will not be the blame game.

00:17:48: It's all about protecting the group.

00:17:51: So, not to feel ashamed about speaking up and the importance of speaking up.

00:17:55: And also the importance or reporting it?

00:17:58: Yeah indeed because this will help our systems to learn and become better.

00:18:03: And therefore specifically for emails in Outlook you have the report message button.

00:18:09: there is a spam.

00:18:10: There's also the phishing button where we should report any phishing attempt that you receive Because that really trains our system.

00:18:19: the same email may be being delivered to other colleagues or that for future iterations, it's already flagged as a fishing e-mail and will not be delivered.

00:18:28: So this really helps us prevent risk from the

00:18:31: company.".

00:18:32: And then if we look ahead at how quickly technology is evolving... Is there anything that worries you about the future of cybersecurity?

00:18:41: Can AI even become part of the

00:18:43: solution?".

00:18:45: too worried about cybersecurity, because I believe in all the expertise and smart people that we have.

00:18:51: And they're also in industry with our partners.

00:18:54: so i'm not to worry about this in general but This is a point where you will see how to manage it.

00:19:01: then directly mentioned How can we leverage AI?

00:19:06: To help us protect To be transparent, we're still in the earlier stages of thinking and identifying about how we do.

00:19:14: I'm very sure that we will do it not just leveraging for being more efficient or a bit faster but also really to help us to be smarter and prevent or detect certain things early on And better with using AI.

00:19:30: But this is still at an earlier stage and not yet fully sophisticated.

00:19:34: We see also there's a lot of business opportunities in AI and specifically in AgenTik.

00:19:40: So I do not want to see it.

00:19:42: just as risk, we are not an end-in ourselves is the security function... ...we want to help our teams to securely use it And together we will succeed with this.

00:19:56: It's different approach because we're not alone In cybersecurity.

00:20:01: dealing with Agen Tiki Here.

00:20:04: it goes beyond our capacities, but we are teaming up with the legal teams for example and other IT teams.

00:20:10: And also security awareness including our user community in the defense force Also with awareness of the context of a genetic AI.

00:20:21: So here I'm confident that you will manage this challenge over time.

00:20:24: And if there's one cybersecurity hazard, you would like everybody listening to adopt today.

00:20:30: What will that be?

00:20:31: As I mentioned earlier it would be sync before your click because phishing is still a risk for the group.

00:20:38: Well, that's very simple to follow.

00:20:39: So think before you click and also have long passwords.

00:20:42: That seems to be something most of us could manage as well.

00:20:45: Jens thankyou so much for your time today.

00:20:48: Thank you.

00:20:48: the work which is invisible good work And securing everything within RTL Group And teaching many outside of RTL group what we should do.

00:21:01: Well, a lot of our information which is so valuable because everything that we have was really online these days.

00:21:08: It's wonderful to have you with us and for everybody listening.

00:21:11: Everybody watching do send your views.

00:21:13: Of course there are multiple ways in which can contact safely and one more thing that I learned from you today Jens is, if we do fall victim there's no shame in it.

00:21:23: It happens to the very best of people even those who work within the industry And do report because by reporting things can improve.

00:21:31: Thank You so much Jens.