On Wednesday 4 November I attended the first day of the 6th CIBER.gal Meeting (VI Encontro CIBER.gal), Galicia's cybersecurity event organised by CIBER.gal and AMTEGA, with CPEIG as co-organiser, at the Edificio Fontán in the Cidade da Cultura. I went on behalf of ACBSEC and Usoarit, with my partners Anxo Pereira and Melissa Toledo. These are the ideas I take away.
Prioritising critical industries
There was a lot of talk about the water sector, and rightly so. But the last few weeks have given us two closer examples.
On 28 October there was the train collision at Urda, in Toledo. Early reports point to a communication failure between computers in the line's safety system. There is no indication that it was a cyberattack (the link is in Spanish) and the investigation is still open. Even so, when a computer system that people's safety depends on fails in critical infrastructure, that is also cybersecurity: availability, resilience and the ability to respond when something goes beyond what was planned for.
The other example is the French supermarkets. Since 11 October, several attacks have hit connected refrigeration controllers (the link is in French): according to the French government, around 700 supermarkets, with a second wave in early November in other European countries. Attribution has not been confirmed. No data was stolen here: the cold was cut off.
Deciding what to protect first means looking at what sustains daily life, and that includes water, transport and the cold chain.
Governance and legislation
Several talks treated strategy and laws as if they were the same thing. The law (NIS2, the AI Act) sets the minimum required and who you answer to. The governance of cybersecurity is decided by each organisation: which assets matter, what risk it accepts, what resources it commits and who is accountable. It is possible to comply on paper without real security governance. For a starting point on NIS2, there is this guide.
AI is not something you block
AI is the present. It makes no sense to consider "not using it" or "blocking it"; what matters is deciding how it is used and with which controls.
Over coffee, a concrete problem came up: when CVs are screened with AI, there is a higher risk that candidates will fake their entire CV to get past that first filter. It was a coffee-break conversation, not measured data, but it fits what we cover in the guide to AI in recruitment.
From ACBSEC
Judging by the projects we have on the table right now, AI and its alignment with regulation is on everyone's lips. Everybody wants to use it well and few know how. That is the ground covered by AI cybersecurity consulting.
From Usoarit
There is a general concern about how AI will affect HR teams and their relationship with workers. The social component is key. To me, it makes no sense that we don't think of AI as one more worker that people need to know how to interact with.
Toni
This is a courtesy translation of the Spanish original. I help companies fit AI into their compliance obligations, from the AI policy to the real relationship between ISO/IEC 42001 and the EU AI Act. If that's where you are, let's talk.