The cradle of cyberwar: She’ll be right is not a resilience strategy

Australia and New Zealand have got much more impressive at cyber in recent years, we have strong cyber strategies and legislation, so many cyber frameworks, well-funded agencies (some with eyes even) and there seem to be a lot of cyber professionals everywhere now. There might even be a healthy trans-Tasman rivalry about who does cyber better if the Australians ever looked.

The Gulf Arab countries like UAE, Qatar, Bahrain and Saudi had even more, they had shiny new cities, custom-made islands, EU football teams, huge deals for AI data centres... Getting involved in a regional war was not on the agenda.

Well before this year's Gulf War, all these countries had repeated impacts from a cyber conflict that we barely noticed, but that our region can learn a lot from. We shouldn't panic about an imminent cybergeddon, but we might need to set aside some of our national stereotypes and do some preparation.

The Cradle of Cyberwar places an Aussie CISO and a Kiwi CISO across from not one but two global IT/OT cyber visionaries who did not read about these events in a threat report. They lived them. The conversation is funny in moments, sobering in others, and necessary throughout.

Why this session, why now, and why here?

Australia and New Zealand are not the Middle East, but modern infrastructure barely notices geography. Power grids, water utilities, undersea cables, telecommunications networks, managed service providers, cloud providers, and even the different regional offices of your own organisation can have interconnectedness, complexity and dependencies where a cyber incident can be crippling.

The glow of regional cyber maturity is real. But is anyone asking loudly enough whether it would survive actual contact with an adversary who wasn't in the exercise scenario? Regional cyber confidence is high. Regional cyber resilience is unproven. Are those even the same thing?