Interview with Francesca Bosco, UNICRI Project Officer and speaker at the Honeynet Workshop 2015

Francesca Bosco earned a law degree in International Law and joined UNICRI in 2006 as a member of the Emerging Crimes Unit. She is responsible for cybercrime prevention projects, and in conjunction with key strategic partners, has developed new methodologies and strategies for researching and countering computer related crimes.

Welcome to the Honeynet Workshop Francesca, can you share what was your motivation to enter Information Security field, and who inspired and helped you along the way?

I started almost by chance in the info sec industry since I was working on organized crime and specifically on trafficking in human beings and minor exploitation. At one point I had to manage a project on hackers profiling and I had to learn quickly and by doing, thanks to some “hackers” I still thank today. I have always loved technology and I sometimes feel like a “missed” engineer, but it was a hard challenge to study and acquire a tech background starting from a significantly different one. I am happy I managed to transform a difficulty in a strength, combining the infosec knowledge with real world scenarios and trying to use both my knowledge as jurist and as info sec professional to help curbing current and future threats. I met several people who always supported me and who welcomed me in various infosec immunities, even though, as “non-tech born”, it has been sometimes hard, since you need to demonstrate a bit more, but I enjoyed the call out. I also created an association, called Tech and Law Center, to better integrate technology-and infosec related issues-with the law and the society we live in.

How do keep yourself motivated in this line of work and how do you handle the competition & failures?

As I explained regarding my first steps in the info sec industry, I needed a strong motivation back then and I try to have it everyday and to put both rationale and passion in my work. This domain is very exciting as there are new discoveries every other day so the learning never ends. I had as well failures and difficult moments, but I try to learn from mistakes and to find different angles to see problems, often trying to think outside the box. This is also the beauty of an ever changing field of work.

You have an interesting perspective on this, for sure. Let’s talk about the Project, why in your opinion is Global Honeynet Project important and why should people support this cause?

I learnt about the Honeynet Project since the beginning of my career in the infosec world and the first thing that striked me was how passionate people were when talking about the project. I like the voluntary but at the same time highly qualified nature of the project and I totally embrace the aim for raising awareness of the existing threats on the Internet. I do support the security tool development, and I would encourage more research and development of user-friendly tool. We need infosec to go viral and the Honeynet Project might be one of the best players to call for it.

So, what is your talk about and why people should join the event?

I have two talks, one titled ““Criminality Reinvented: Assessing the Cybercrime Evolution”” where I look into the changing nature of cybercrime and the evolution of hackers and of the criminal landscape. Today, cyber threats are multiplying at light speed, with the development of dark markets, new forms of malware and additionally, organized crime groups, both in the traditional sense and those posing as loosely affiliated networks, have claimed their turf in cyberspace, facilitating the spread of Crime As a Service schemes. Which are really the criminal groups we are facing in cyberspace and how we need to properly react? In the other talk, within the Security Divas track-which I am very proud of- is titled ““Who hacked my drone?” Cybersecurity and Digital Forensics in Robotics”". Lately I have been focusing my research on the various possible misuse of technology for criminal purposes. The expansion of robotics, from their adoption in the defense and medical industries to agriculture and commerce, among other sectors, raises many questions with respect to incident response in the event of a deliberate or accidental malfunction. This presentation-which is in an early stage since I am still researching and it’s a sort of new field, not so well explored up to now- assesses the role of cybersecurity and digital forensics in robotics. I am also really looking forward to have sound discussions with the public on these topics.

In your opinion, what Security issues are being exploited and how to counter them?

A service-based criminal industry is developing, in which specialists in the virtual underground economy develop products and services for use by other criminals. We need to change our usual approach in fighting and investigating threats that combine more and more human and technological aspects. As well as understanding the miscreants are usually very creative in the exploitation of means for profit and we should do the same when it comes to the answers we should give, understand possible future scenarios where the technology that will make our life better can also be exploited by criminals.

And how does your talk impact today’s security scenario?

I chose two topics which are evolving and where there is a need of cooperation from different domains. I do like cooperative efforts and putting together diversified expertise to tackle problems which cannot be solved anymore with a commercial and exclusive approach. On one hand it is important to understand attackers, not only from a technical point of view, but also considering the context and their criminal schemes. The human factor is said to be weakest link in the security chain, but this is true also for the attackers. On the other hand, robotics is one of hot topics of the moment, where very much attention has been dedicated to the innovation and ethical side, but not enough to the possible cybersecurity issues involved.

What are the gaps in today’s security methods?

The paradigm we originally had for information security is based on a world that doesn’t exist any more. We need to change this paradigm and to take the challenges that this new world is posing. What I would really like to see it is the creation of a culture of infosec (and I do believe the Honeynet Project workshop is one of the best venue to talk about it): we have been used to a commercial driven nature of info sec but this is not helping in creating understanding and knowledge about infosec. It is a matter of approach and behavior, together with technology measures, but you need to teach people a new mindset and that’s the hardest but the most interesting challenge we are facing in the info sec today.

What are your suggestions for upcoming professionals?

There is a recurring narrative today about the lack of cybersecurity experts. There should be more initiatives to attract and professionally involve young people, there should be more cooperation since the very beginning between training sector (e.g. academia) and the private/public sector as possibly employers. Infosec is still a reasonably young “profession,” and many of the skills are learned on the job which often means it is hard to break into the industry with enough of a well-rounded background. For the professionals approaching this field, one of the main pitfalls is the feeling of being ʺexpertʺ in a certain domain: as said, it’s an ever changing landscape and serious professionals should always have the will to learn and be humble enough to recognize limits, in order to work to overcome them.