Speed Data: Thinking From a Cyberattacker's Perspective With Dalal Alharthi

Welcome to Speed Data: Quick Conversations With Cybersecurity Leaders. Like speed dating, our goal is to capture the hearts of CISOs with intriguing, unique insight in a rapid format for security professionals pressed for time.

This week, Dr. Dalal Alharthi, Assistant Professor in the Cyber, Intelligence, and Information Operations Department at the University of Arizona, joins us to talk about the importance of organizations anticipating a breach and why you should see the world through the eyes of an attacker. The Saudi Arabia native uses her extensive background in industry and academia to help shape the minds of future tech leaders.

Cyber adversaries aren’t keen on handing over their playbook, and they aren’t going to tell you when they plan on attacking — or where. To stop a cybercriminal, you have to anticipate their next move, something Dr. Dalal Alharthi says will disrupt the attack early on.

“To build your defense strategy effectively, you need to think from a cyberattacker’s perspective,” said the Assistant Professor in the Cyber, Intelligence, and Information Operations Department at the University of Arizona. “That’s why in the field of cybersecurity, we teach cyber kill chain or MITRE attacks or some other frameworks that help us to understand the steps of cyberattacks.”

A worldly point of view

The Ph.D. and dual-master’s professional studied programming in Saudi Arabia before moving to the States in 2015, something she said allowed her to understand the global landscape of the cybersecurity field.

“One of the most notable differences is in Saudi Arabia, there is a strong emphasis on digital transformation through government initiatives, while in the United States, it’s a much larger, more diverse tech industry, with an emphasis on businesses and private-sector innovations,” she said.

These days, Dalal teaches her students what vulnerabilities to be aware of in security, including the most considerable risk: people.

Humans are the weakest link in the cybersecurity chain. That's why it's significant to have continuous education on an individual and organizational level.

“We say ‘key’ in cybersecurity stands for ‘keep educating yourself,’ so ongoing education is really important.”

The impact of AI

Another area Dalal cautions her students about is the risks that accompany artificial intelligence.

“AI has a significant impact on the field of cybersecurity, both positively and negatively; AI-powered cyberattacks can pose the biggest cyber threats in the near future,” she said. “They are very sophisticated and very hard to detect or defend against.”

One of the ways Dalal recommends combating threats is by anticipating breaches and making the decision on whether to pay a ransom during the preparation phase of the incident response runbook, rather than making that call after an attack has occurred.

Being proactive is really important — expecting that you might be targeted by a cyberattacker and then act accordingly and build your own incident response.

“That’s why most organizations have an incident response runbook of several incidents that might happen, like being targeted by ransomware. Being proactive is the key.”