Sustainability: Building a Safer, Greener Cyber World – Leszek Tasiemski, WithSecure

This is Techstrong tv. Welcome to Techstrong tv. I'm Bonnie Schneider, and today we're venturing into the world of cybersecurity and sustainability.

Joining us now is EC Tess Menky, the Vice President of Product Management with Secure and Eck brings a wealth experience to the company's commitment to ethical, equitable, and environmentally responsible practices. Let's dive into with secure's innovative with sustainability program and its role in creating a safer, greener digital world. All right, leisure, thank you so much for joining us.

Happy to be here. Thank you for the invitation. Can you share more about your background and the inspiration behind the, uh, with sustainability program with secure?

Well, my background is, uh, security. So I spent several years doing penetration testing, security assessments, forensic work, and also simulating attacks, um, for our customers. So I, I know kind of a lot of the techniques used by the bad guys out there, uh, which helps us to, to understand what is the, refer to the society and what should we do to, um, to increase the, the production.

Uh, but that's, of course, we're only one of the, of the items of, uh, sustainability that, that we're talking here about. Okay. So how does the, uh, sustainability program embed transparency and environmental responsibility in to its cybersecurity solutions?

Yeah, so, so it's, uh, if you think about this, like sustainability doesn't have that much in common with, with cybersecurity. Uh, but we are a technology company, so we figured out that, well, one of the things we can do, um, is to use our knowledge and use our expertise in cybersecurity to, um, to help the society with, uh, with spreading the information with, uh, um, teaching people. We run educational programs for the schools, for instance, so teaching kids and teachers how to be more safe online and things like that.

But since I'm very involved in technology, uh, the part of the project that I'm spending most of my time and attention is energy efficiency of our products. Uh, we're a software company, so we build software, we process tons of data, you know, we crunch it, we try to find all the, all the malicious activities, and of course that needs a lot of energy, uh, both on the backend side. So in all the clouds that we do, the, the processing and kind of the heavy, heavy lifting of, um, of the analytics, but also on the endpoint side.

So all the computers and the machines that we are protecting. And while the energy efficiency of the backend side, uh, is usually well taken care of by most of the tech companies, because that's directly, uh, related to the cost of those backends, uh, if you look at the endpoint side, that energy is, well, you can say it's for free because it's our customers, uh, paying for the electricity. It's, it's on their own expense.

So quite often this is an after for like, should we take care of the energy efficiency of the agent code? So agent is the piece of software that runs, um, on our customer's machines. So that's something that we decided to focus on as part of our sustainability related to the, to the technology.

So that's what our green coding project is about. That's great. Uh, well, obviously sustainability is a global channel challenge, especially the search for solutions in the IT world.

What do you think are the biggest obstacles the cybersecurity sector faces in reducing carbon emissions? Uh, to be completely honest with you, I think it's lack of demand from the customers. So what I would like us to be, and by us I mean the whole, the whole industry of cybersecurity is that we start competing with other vendors whose solution is not only the, the best protection, but also the most energy efficient.

Right now, it's not possible because we don't have any independent standards. So imagine if you go to, to a shop and want to buy a new fridge, each and every fridge will have energy label on it. Your car will have energy label, your house might have energy label.

But if you're buying software operating systems or, or production software from vendors like us, there is no independent benchmark of which software, how, how much it is energy efficient, like compared to the fridge, where you can very clearly tell which model is better than the other one. It comes to energy efficiency. So we need independent standards and we need demand from the customers, uh, to get more energy efficient software.

That makes, if I can one, yeah, please. I think we, we need to also make it visible and educate our customers a bit that you can achieve exactly the same functionality and the same level of protection, uh, with different ways of coding the software. And depending on that, the same functionality can be achieved with less or more energy.

So it converts into some operations on, on their processor, on, on some network operations. Let's not get into the details, but, uh, in essence, you can get the same functionality, the same level of protection using less or more energy, depending on how the product was written. Makes sense.

Um, can you elaborate on how your company's sustainability program helps to minimize energy consumption while maximizing security outcomes? Sometimes there's challenges in getting both of those goals accomplished. Uh, yes.

So what we started with, uh, of course, it's hard to improve on something that you don't measure. So, uh, what we started doing is that we have built, uh, a test framework so that starting from the first January of this year, every new release, so every new version of our agent software, so the software that gets installed by our customers on their machines, uh, gets benchmarked. So we have a battery of tests that, uh, allows us to benchmark that for energy efficiency.

So we, we know exactly how much energy is being used by, by our software from version to version, so that way we can establish a baseline so we know, uh, whether we are improving or not. Now, what we are doing, so now we are in phase two, we are looking at the code, we are looking at the baseline, and we are thinking, okay, how much we can actually optimize how much we can save. And then the next step, of course, would be to make a, a pledge.

So, and I'm not ready right now to give you exact number because we are still researching that, but once we are confident, what is the, uh, possible gains we can make a pledge, okay, what's our ambition target? How much we want to lower that energy usage? And we can achieve that by, in, in several ways.

One is of course, optimizing the code and seeing if we have some redundant instructions. If we can, uh, swap the framework, for instance, or programming language, uh, if we can use a better, um, algorithm for something there. There's several ways of doing that.

But what we are also thinking of doing is to visualize effects of some of the settings. 'cause of course, our software is not just on off, you have plenty of settings there, which are called the, the set of settings is called a profile. So depending on what the user is setting up in the profile, uh, the resulting energy consumption on the endpoint can be either big or low.

So we want to make that visible to the user so that, uh, in parallel from us optimizing the code as it is. Also the user can tweak between more energy efficiency and more security, which would feel best, the requirements about the security, but at the same time, they can optimize for energy. So we kind of want to make it, uh, accessible to the user to know what's the energy impact of the, of the set of settings that they define.

That makes sense. Um, ensuring an equitable workplace is another vital concern for most organizations. So how does your organization address this?

Well, we are, um, first of all, we, we, our headquarters is in Finland, so we are the European Nordic company. So it's always, um, and for, for me as a policy citizen, when, when I joined the company, uh, to me it was immediately noticeable that, uh, it feels that everybody is equal in the company regardless of the nationality, gender, um, believe, um, faith or, or whatever would be the, uh, would be the, um, the dimension. Uh, but in more concrete terms, uh, what we do, we allow for everyone to, um, how to say so that it doesn't sound, doesn't sound, doesn't sound obvious, uh, but like the work-life balance, uh, is, is treated seriously.

Like I, I have some comparison from, from other companies, uh, which allows people to better balance. So for instance, if, if somebody, uh, has a child, it's, it's quite common for, for, for people and, and equally, um, women and men to, to take paternity or, or maternity leave. And it's not a problem with that.

We, we, we, we don't, it, it's, it's not something that would then be negatively reflected in, in somebody's career, for instance. So we're trying to be very pragmatic in that. So kind of not, not more on a slogan level, but in pragmatic, okay.

How, how, how can we make the best possible environment at SSE Secure so that everybody can, um, can thrive both privately and professionally in this environment? Of course, one thing that it's, it's, it's, uh, problematic for us. Like we still have a, a big gap when, when you look at the number of, um, of employees between, uh, between men and women, uh, it's partially, um, the, the thing that like the, there's simply not that, not that many women in the industry, so they're not applying for the position.

So it's not that that we discriminate, but simply we don't, we don't have them in the pipeline when recruiting, but we're trying to proactively reach out also to, um, uh, to the organizations that, that for, for instance, are, um, that, that are, uh, working with machine. So, so we, we have some, some, some NGOs that are working with machine learning, which are, which are, uh, only containing women, um, members. So we're trying to work with such organizations to see if we can collaborate, and then if we can get some, uh, if we can get, um, get some candidates from, from there, for instance.

Uh, can you give some examples of ethical partnerships that you've, you've had bef with your company, uh, that reduces environmental impact? Any, um, partnerships that come to mind? Uh, well, we have, uh, we are part of the, uh, coalition against Stoker work.

Uh, so that's, that's one of them. Um, quite often we work on the local level with, uh, with NGOs that, um, that work, uh, that, that work in, in various areas. Uh, I can speak from a, from, from a local, uh, perspective.

Uh, in Poland, we work with an N G O organization, uh, that works with, um, domestic violence victims. Um, so, so there, what we do, uh, we handle the technical part. So quite often if there is a violence in, um, in domestic violence, there is this cyber component to outsource.

Some people get to get bullied online. They, they get, um, they get spied on by their spouses. So that's where we, uh, we get involved and try to, um, well analyze the situation and then resolve the problem.

Quite often it ends up in some forensic investigation that then gets to the court. So that's, that's what we do locally. Uh, given the increased threats of extreme weather due to climate change, how does your organization address the potential impact on cybersecurity?

Uh, for example, if we have, you know, more of these disasters happening, how do you ensure resilience against these challenges? Um, I think it's, it's, it's a, it's from our perspective, uh, the climate induced, um, extreme situations are not that different from all other extreme situations. So now, um, since the pandemic started, it's basically, especially for us living in Europe, it's just a strain of, uh, of, of, um, uh, strong, unpredictable events.

Like, you know, first the pandemics, uh, then the war in Ukraine started. So, uh, so I'm in Poland, so we are actually neighboring, um, the country that is at war right now. So it's basically, uh, made us a, as a company to, uh, to take the stance that now the, the crisis is the new normal.

And it's not only about the, the climate induced crisis, but, but in general, like we are living in way less stable and predictable environment that we used to live in five years ago, for instance. So now what we are doing, we are trying to, first of all, we as a company to be resilient. So, um, we, we try to be agile in terms of how we do processing of the data, where we process the data, how often we can, or how quickly we can recover from, from any disasters.

And also we are assuming the same for our customers. So we are moving towards less the, um, kind of the old style headquarters and the headquarters it, uh, model of protection to more distributed. So nowadays companies like it, it was boosted by the pandemics, uh, are working hybrid mode.

So there is not, not, not such a thing as the company well guarded it anymore. So most of the people are working, uh, at least part time from home in the tech industry. Uh, so we are adjusting our solutions and technologies to cover for that hybrid mode and not rely that much on the headquarter IT model anymore.

Okay. Well, for our final question, um, can you give us your vision of the future in terms of sustainability and cybersecurity? Uh, where do you see, um, this industry going and how it's going to be, um, a, a mover in, in just becoming more sustainable in the world of tech?

Well, I, I think we, I would speak broader, not just for cybersecurity, but the tech industry overall, we need to realize that we are contributing to the problem massively. So there are some research, of course, it's extremely hard to calculate precisely, but there are some estimations that, uh, all the I c T industry is actually consuming or generating more c o two, uh, than the aviation industry. So we are contributing to the problem.

Uh, I think we need to think about the end to end, uh, energy efficiency, so not just looking at the backends that generate our costs. So that's where we traditionally focus on optimizing, because at the same time, we optimize our own costs, but the whole chain, so transferring the data and what gets processed, uh, in our end, in the endpoint machines of our customers, I think the big elephant in the room, uh, is machine learning. So now we see a boom and a big hype of generative ai.

Uh, but there is very little talk about how much energy generative AI needs to get trained and then to get used, uh, at least with the current state of the technology, achieving the same thing with AI and generative AI is way less energy efficient compared to the traditional way. So, um, with all the hype and excitement and, and we are part of that excitement, we need to remember that with the current state of the technology, using generative AI to achieve the same task, uh, consumes a lot more energy. So I think we, as tech industry, we need to also address the, uh, the energy hungry AI movement.

That's a, that's a great point and it is something that a lot of people are discussing. Thank you, Liz Tess Minsky, uh, vice President of Product Management with Secure. Uh, we really appreciate you joining us on Techstrong tv.

It was great to have your insights. Thank you very much. Great.

Well stay with us. We have a lot more coming up on Techstrong tv.