Jonatan Perez with VAR GROUP

SUMMARY KEYWORDS

Cybersecurity, Ethical hacking, AI, Hacking village, Vulnerabilities, Connectivity, Operations, Data protection, Network security, Penetration testing, Risk management, Digital safety, Technological trends, Information technology, Industrial security

00:00

Yes, you need to get your cybersecurity house in order. You need to attend the Barcelona Cybersecurity Congress that is November 3 through the fifth, and meet the best cybersecurity leaders in the world to help you along on your cybersecurity journey and who are protecting our future. Enter promo code BCCpodcast26 and get your discount. I will be there. I would like to see you there. Talk soon.

00:33

Welcome to the Industrial Talk podcast with Scott Mackenzie. Scott is a passionate industry professional dedicated to transferring cutting-edge, industry-focused innovations and trends while highlighting the men and women who keep the world moving. So put on your hard hat, grab your work boots, and let's go! All

00:51

right, once again, welcome to Industrial Talk. Thank you very much for joining the number one industrial-related podcast in the universe that celebrates you, industry professionals all around the world. You're bold. You're brave. You dare greatly. You juggle a lot of balls. You're coming up with solutions. You collaborate. You know, quite frankly, here it is. Take this to the bank. You're making the world a better place. Say it all the time. You are. And every time I have conversations across the board in industry, you would be amazed if you just listen to industrial talk. You'd be amazed at what is going on in industry, and just everything, everything is going on. If you want to know, in a hot seat, Jonatan Var Group is the organization, and this is with the Barcelona Cybersecurity Congress. This is their podcast, and we are absolutely on fire talking about everything that's cybersecurity. And if you think it's just a it whatever no IT OT. hacking strategies. They're good. They're good people, and that's what Jonatan. He's a good hacker. Anyway, it's fantastic, and we're going to be in Barcelona in a week. Can believe that? Let's get cracking. Yeah, so we've been having these conversations over and over. Just go out to Industrial Talk, and they're all out there, and we've covered everything, pretty much everything, and I'm sure we didn't. We've just still scratching the surface of of what's taking place in the world of cybersecurity. But the reality is, is that you're an organization, you're an operation. You are connected. You want to connect. You want to pull that data because you want to be more efficient. You have to be more efficient because it's a competitive world out there. Your quality needs to go up. All of this, everything converges to that point of saying, "Hey, I need to be connected. I need to see what's going on in my operations with that connectivity. You got you got a cybersecurity. You got to keep your eyeballs on that and making sure that your operation is absolutely protected. These are great conversations. So in this one, as you will see, is that it's they got this hacking village, and this hacking village is at the Barcelona Cybersecurity Congress. Now, and what you get to do is you get to say, "Hey, I'm going to go in here, and I'm going to. I have no idea what it looks like, but you can sit there and figure out, and hack, and learn, and grow, and have that desire to know more about what to do." Here is Jonatan, and and and what makes him so special is the one is he's a good guy, and as a good guy, he is he's working diligently to make sure that hey these vulnerabilities are identified and corrected quickly. It's an amazing profession, and it's nothing short of amazing, and and they're all going to be at the Barcelona Cybersecurity Congress, and then some. Then you get to wandering around, so it's still open. It is the BCC Podcast 26. If you want a discount, and you find you and you're saying, "Hey, I want to get to Barcelona," which does not stink. Great people, great town. Yeah, it's a, it's a, it's a great place. Put that discount in there, and boy and boy, you will be. And then just come and visit me. You'll see it because if you've ever seen me at other events, you'll see a bunch of lights. See if I look up, you see all the lights, you know, in my glasses. So they're there too. But anyway, you need it, and you need to have this conversation, and it needs to be about cybersecurity, and you need to be connected, and you need to be able to protect what is very important to you, and that is your operations, and it does. Change, keep at it. Don't don't ease up on that gas pedal. It's it's a must.

05:07

All right, let's get on with the conversation, Jonatan. That's J O N A T A N, Jonatan, and the VAR Group is the company, and and it was just a fabulous conversation. Enjoy, Jonatan. How are you doing? Do welcome to the Barcelona Cybersecurity Congress podcast, brought to you by Industrial Talk. How are you doing? And I know it's late there. I would be ready for bed, but you're young. You don't you don't have issues. Doing well?

05:40

No, no. Um, thanks, Scott. Thank you for having me here. Yeah, doing quite well. Yeah. Um, although it's 830, as you mentioned, we spotted get used to going to bed quite late. So yeah, yeah.

05:55

It's it's only here where where I'm old and I I start looking at the clock and at 9o'clock, I'm in bed reading, and then I'm asleep.

06:04

That's

06:04

that's that's my life. It's it's not the life of somebody from Spain. That's for Doug on here. Anyway, it's great to have you on. All right,

06:14

thank you.

06:15

Let's let's do a little background, Jonatan. We need to know who you are. I've got because I had to ask for it because I'm stupid, but I have your LinkedIn stat card out there. But give us a little background on who you are, and then let's get into the topic of conversation, which

06:35

is the

06:35

hackers village. Go ahead.

06:39

Okay. Yeah. So I'm I'm currently a delivery leader at Vat Group in in the offensive security side of things, and my background is I did my bachelor's in ethical hacking in Scotland, and then I started working in the cybersecurity space almost 10 years ago, and now I'm also working on my on my master's degree in AI and cybersecurity, which is amazing. I'm enjoying it a lot, and and yeah, I'm I'm been always been a breaker, like trying to understand how everything works. But now I get to break stuff and learn from it, which is incredible.

07:25

So I have to ask about AI. Now you're in the master's program specifically about AI. How? Just just explain to me how you are learning AI at a university, when it is super fast, it changes all the time. How is that university keeping up with your education? I don't know.

07:52

I wouldn't say that it's keeping up with it at university. At university, you will learn the basics to be able to understand what's going on, but most of the research and most of the keeping up to date, you have to do it on your own time. Like for example, a couple of months ago, I built a robot that you will see here, just the the shape of it, and it was just to give AI. I don't know if I can change my remove my filter.

08:23

Yeah,

08:25

yeah, yeah. But yeah, yeah. So I built this guy in order to be able to give AI a body to communicate with you, and and it worked out worked out really great. It needs to explore AI consciousness, and it can move it. You can see it has cameras in its eyes. It connects to model everything, and the only way to learn how everything works is to build it for yourself and to test it out and make sure that everything is is is working as it should.

09:02

Yeah, yeah. You you win, Jonatan. You win. That's the first time I've heard that conversation, and somebody actually putting it into that that that's incredible. See, all right, listeners, you can tell he's got mad skills, and he just sort of he's very quiet about it. You can tell he's quiet about it. All right, let's let's get into why is it important for Var Group to be a part of the Barcelona Cybersecurity Congress? We'll start there, and then we'll go into the Hackers Village because you're an ethical hacker. Let's let's start with why is it important that Var Group

09:41

is there? So as any. other conference that Park Group attends, is really important for us to to to share and to to share experiences, to share to share knowledge, and also to to keep up to date on on on the actual trends. It's it stay relevant. And to stay up to date. So by going there, we're also sharing an amazing story that Hela is going to present with Eric about how what to do with AI and what not to do with AI. And I'm sure that anyone attending will learn a lot from it. And as I said, so the important the importance of our group being there is just to be present and and network with our clients and with anyone who who stays close to us and and to share that knowledge.

10:37

I you know what's interesting for me is to again I'll I'll revert back to the speed at which things are changing. It's fast, and and I don't see how you in your profession cannot be connected and having conversations because it is changing so rapidly. And I agree with you 100%. You need to be at these events, and you need to be talking with other professionals because I've had, fortunately for me, many conversations on the Barcelona Cybersecurity Congress podcast, and we all covered some specific thing, and it's like, wow, it just it never ends. Just never ends. It's it's a rapidly changing environment. So that's my two cents. Okay. So what I have here, and and I've already shared it with you. I've got some talking points, and and because you're an ethical hacker, which is pretty cool, by the way. Just yeah, yeah, you know, it's just cool. Anyway, at at BCC, we're going to have a hacking village. Can you speak to what that what that

11:55

is? Yeah. So in in any SMCT conference, this usually a place for the hacking village for more than one, it doesn't need to be just one, and it's a safe, safe space where people can try some hacking skills, maybe soldering, maybe lock picking. There are also people who are hacking into satellites that send in some conferences, car hacking, you name it. Anything that has a system and some technology in it, you can probably put some pieces there for people to try it out, and also to to to learn new skills, because especially for people who are getting into the field and they don't have the experience or the the tools to be able to to try new things and to know what really they like because the cybersecurity space is is quite big until you know what you would like to do, you cannot just buy any tool and every tool and start trying things. So that's really for that reason is really important to to have these places for people to try it out, and also to connect with other people who are interested, whom are you interested to, and and and to ask as many questions as you can.

13:10

Why I don't understand. So you're being an ethical hacker. What is what's the purpose behind that? Why? And then we'll go into why the hacking village is important.

13:25

The purpose of being an ethical the the purpose of of being an ethical hacker is basically to to flag vulnerabilities before any more malicious can can act on them. So if the only way to to stop waste into into your application will be to to flag them and to make sure that you touch them before they get attacked by real world real attackers. So it's just and also that it also to to raise awareness and to help other teams detect better. For example, if if you have some cybersecurity team that is in charge of of defending, how you how do you make sure that those tools are working, that the tools are working, and the procedures are working? The only way to test it to to know is testing it.

14:21

See, that's a really interesting profession because you have to think like a bad person to try to get in to whatever network, and then be able to change your put your white hat on. And I'm a good guy now. There's a penetration point. You need to fix it and all of that good stuff. Is that just is that your role as with with with Var Group? I mean, is that that's

14:55

it? He's he's not just that. He's he's not just defending it. Against an attacker, it's also realizing that maybe a system can be used in in ways that you haven't designed it to be used. A recent example and a really interesting one is, for example, a really big fast food chain. I'm not pronouncing names had a chatbot in in the website, and you could ask it anything. It was supposed to be used just to ask about the menu, but some people figure out that you can use this subscription for free to make it great code. Imagine the the amount of of tokens and the the amount of money that the company will be wasting on on people sending their requests to this chatbot.

15:51

Yeah. So here, in the news, just it's in the news whether we like it or not. I haven't been keeping really, but I'm sure you have that AI is getting outside of its little parameters and penetrating other networks just because it's trying to get you know information. How do you, as an ethical hacker, deal with this new thing about AI, just trying to find it and and just doing what AI does. How how do you how do you how do you guard against that?

16:32

That's that's a really good question. So the thing is that with AI, you need to be really careful because now everything is everyone is using AI, and and it introduces it helps you, but it goes it also introduces new vulnerabilities, not just by being hacked by AI, but by other having vulnerabilities in your own AI in your own chatbot. Because you give access to a lot of information that maybe some people shouldn't have access to, and about how to protect about against AI hacking your companies. It's not that AI has superpowers; it still uses vulnerabilities that regular hackers would use. So you still have to protect as you will do as against a regular hacker, the only issue with AI is that it do is 10 times faster, 100 times faster. So before it would take a hacker from a new exploit being being detected to actually use it a certain amount of time, usually over a week. Now it's this amount of minutes or hours.

17:45

Oh yeah, yeah, and it sped things up. I would imagine you would know better than I would. If I was a hacker and I'm doing bad things, I would naturally go to the easiest area so that I won't waste time. I, I mean, if I'm trying to grind through something, I'm wasting time. So I would always go to the easiest penetration point that I could find because it's it's it's just a factor of time. Now with AI, that gives me that speeds things up, right?

18:20

Yeah, and it's also democratizing the access to these to these things and these kind of attacks. Before we had the concept of script script kiddie, that would be someone who just downloads a tool and and runs it and hacks something or makes some damage. Now, it can create code for you. It can hack into something for you, you just need to point it to the thing, and and that's really anyone with a regular computer can do that nowadays.

18:51

Yeah. Okay. Let's let's shift gears a little bit real quick, and I agree with you 100. Now we're back to we're back to the hacking Village, and will the conversation also evolve and revolve around AI and that? How does how does one set up a hacking village that a meaningful hacking village, right? That gives you some experience. How do you do that?

19:24

So it really depends on on the on the conference and and what you want to have. I've been to many many conferences and and Bar Group goes to many many conferences, and you have conference that have just some soldering table where you can learn how to solder your own your own circuits and maybe test them because they have these little patches that you put around your neck and you can hack into them. There are some other places who that have CTS that capture the flag events where you have to. Hack into something in order to gain points, and whoever wins the competition gets some prizes. But I've seen train hacking train hacking villages where they will have just train models, and the the systems, the OT systems that will usually run real trains, and you will be able to mess with them in a safe environment. Just imagine doing that with real trains; it's a no-go. But with mobile trains, everything is good. Same with cars. So yeah, it's it's the way you set it up is just trying to get a little bit of everything to give everyone a taste of what some basic hacking or even lock picking for physical physical hacking, so everyone can can experience some of it. And for people who are new in the field, maybe guide them towards what they really like. Because at the beginning you don't know what you like.

21:03

This is a this is off the charts here. This is sort of going off on a tangent. Has there been in your career an increased focus on hacking? Like I'm I'm a new person, and I'm thinking of hacking, and I go to these events so that I can. Has there been an increase in interest in being able to hone that skill?

21:33

So yeah, definitely. Since I've since started I've started in in in hacking, and has always been an increase, mainly because now everything has some technology in inside of it. Also, we have had some pretty serious incidents in the last 10 years, and and also now, for example, the other day with with PHP, everyone was running, trying to patch everything. So companies are seeing the importance of cybersecurity, and they are increasing their cybersecurity teams in order to prepare for possible attacks and and to stay safe. So that's why more and more people are getting in in in the field, and and more people are being interested in in in joining cybersecurity firm or to to yeah to start in cybersecurity.

22:32

So another question I have around that hacking is how do you take these opportunities? What if somebody in that hacking group have enough, you know, questionable motives? How do you know that? If if I'm in the hacking village, maybe I'm trying to do something that I shouldn't. Does that make sense? Like my motives are not wanting to help. You mean?

23:08

Uh huh.

23:10

Go ahead.

23:11

So you mean like people that will go to these conferences and maybe try to hack all the other people attending the conference?

23:19

Trying to learn some bad. Yeah. Trying to get more information to do bad things, not good things.

23:27

So, if if you want to learn about hacking, everything is on the internet nowadays, and and you wouldn't attend a conference to to learn how to do bad things. And even if you were to do such things, the hacking community attending those conferences. I usually really they really pay attention to some if something really doesn't doesn't look well. Is something going on? And I don't know. I think that we mostly keep it safe. You always have some someone, as I mentioned before, that we try to bring bring everything for everyone. But it's usually you are surrounded by experts in the field, so it would be quite easy to flag and and stop that as soon as good.

24:22

See that's it. Now I feel better because I was just like, what if they get by? And but no, you're absolutely right. You have the skilled individuals that can identify. Is there a role specifically in the world of hacking, not from not from a a hacker's perspective, but from a protection perspective, where AI can help make that better, make it you know protect more. If I have an AI. Solution in my cyber strategy.

25:04

Okay, I know this is going to sound weird, but I will do the the example of AI as having a thermix in your house. Do you know thermomix? This this kitchen robot. So imagine AI as as something like like this kitchen robot. You still need to know the recipe. You still need to know the ingredients that you have to put in it. It doesn't just cook by itself. It it still does most of the work, but still have to know what you're doing, and it is it cannot be used to to do anything, any dish. You can only use it for certain dishes, and it won't replace chefs. So it's not that you get one and you can get rid of of chefs in restaurants. If you wanna have a proper meal, like I don't know Michelin star dish, you will still have to go to a restaurant to get one of them. It's not that if you just eat from it, it will look like your mom's dish or or something that you will enjoy. It still does it, but it's not the same. And if you want something special? You will go to a restaurant. Same with AI. It will save you time, but you still need to know how to use it and and and how to how to put in what you want to get in order to get what you need to get out of it.

26:38

Okay, I like that explanation. Very good. I feel good about that too. Thank you. That's a good one. All right. When when you we're gonna again sort of shift a little gears here. We've talked about hacking. We've talked about the importance of hacking. We talked about why we've got you know the the Hackers Village, all of that good stuff at the Barcelona Cybersecurity Congress, from a client's perspective, Jonatan, help. What are we getting wrong, especially today? If I'm a, if I'm a your client, I mean, what am I getting wrong?

27:19

Um. So some people are having some issues with thinking that if if you stay up to date, like if your software is in the in the latest version, you're safe. But it's not just about versions; it's also about configuration and how you use it. Because if if you don't use the the tools that you have to use in the right ways. You still have an issue, and and we're seeing that in in some cases, like people having the right tools, having it in the right versions, but not configured properly. This is

27:55

how I

27:55

go ahead, go ahead, go ahead, John.

27:58

I was just going to give another example, and and it's also thinking that security is just a one thing, a one-time thing. So I got a pen test, then I'm I'm safe. I passed and and that's it. It's security is an ongoing thing. It never stops. So you need to stay up to date and do so your printers regularly. Otherwise, what the picture of just today's picture is not today's state of your system.

28:29

So this is what I always sort of lean on. I'm going to find somebody or some organization that will help me to stay current, that will help me remove maybe the anxiety of not properly protecting my business from whatever. So I think in the world of cybersecurity, conversations like this and others is vital, and to be able to have that network of individuals like yourself, and and of course the VR group keeping current with the market. I I don't see how me, as a manufacturer, with all my other manufacturing stuff that I have to do, can keep current. So I'm already at a disadvantage. So I always think, yeah, Jonatan, that's that's who I need to talk to. Do you do you agree with that? And how does the Var Group fit with that?

29:34

Yeah. So in Var Group, what we try to do is to to help companies in their journey into cybersecurity, so it's not just that you give us everything that you that you do, and we do our thing and we live. No, it's it's it's a journey, and and we do that together. So if we have if you have an application or a system that you would like to. Pen test. We will sit together with you. We will make sure that you need what it is that you need, because sometimes people will come thinking, "Oh, this is the only thing that I need because this is what is supposed." But then they realize that there was something else also that we see on on this first first meeting, and and from there we will schedule the exercise, and we will stay in contact with the client, telling them updating about what we found. And it's not just I found this issue and you need to help. It is your problem. No, we guide them on how to fix those issues, and and also sometimes it also ends up being from the red team exercise. It also ends up being part of a blue team exercise because we collaborate with the blue team, so they can learn how to if if they didn't have the chance on to identify the issue, on how to identify if it happens again, and and strength strength those those barriers, so so they become more resilient. And not only that, if they have any vulnerability, we sit together. We tell them how how to fix it or how to mitigate it if it has no no fixing, and and also once they've done all of that, we will test everything again to make sure that the patch is working and and that this issue has been closed and they can sleep sleep well going and everything has been fixed.

31:43

Yeah, I like that absolutely a lot. Yeah, don't leave me hanging. Don't leave me without a an individual or a company to be able to sort of interact with. Well, Jonatan, you were great. I I enjoyed this conversation. And again, you might not be in Barcelona, but I'm going to be in Barcelona, and I wish you were in Barcelona so we can have a have a beer. But if not, well,

32:08

let's see. Hopefully,

32:11

yeah. Who who do I need to talk to, Jonatan? Because I'll give me that. Well, if somebody says, "Hey, I need to get a hold of Jonatan and or Bar Group or both." Is the best way to do that on LinkedIn or help us understand how to get a hold of Jonatan?

32:35

So we have a website which is Bar group.com. Yeah. Okay. And and it's and and so we're part of the multinational team. So it's not just here in Spain. We have team in Italy and in in Germany and and in many other places around the world. So going there, you can you can see the services that we can provide. It's not just cyber security; we have also some other services. But you can find us there, and also on LinkedIn. We're present in LinkedIn, so you can also find us there and even myself. If anyone has any question, just don't educate. Just send me a message. Don't be happy to to answer the question.

33:23

Yeah, that's good. That's good stuff. Yeah. So, Jonatan, you were absolutely wonderful. Thank you very much for staying up late. But it's not late for you in Spain. You guys stay up late anyway. It'd be late for me, but nonetheless, thank you very much for being on the Barcelona Cybersecurity Congress podcast with Industrial Talk listeners. We're going to have all the contact information for Jonatan and all the contact information for the Bar Group out on Industrial Talk. So reach out. You need individuals like him, need companies like Bar Group to be in your corner and help you along on the journey, your cybersecurity journey. So we're going to wrap it up on the other side. Stay tuned. We will be right back.

34:04

You're listening to the Industrial Talk Podcast Network.

34:09

All right. Before we get into the conversation, I want you to be aware of a conference that you need to put on your calendar, and you have time. It is the Barcelona Cybersecurity Congress. It is necessary. You need to up your cybersecurity game. You're connected. You need to make sure that you're protected right here. This event, Barcelona Cybersecurity Congress. It is november 3 through the. You have time. November 3 through the fifth this year in Barcelona, and I'm telling you right now, the team at Farah who put this particular Congress on, the best. You will not be disappointed. And you know what else you get to do? You get to network with some of the best cybersecurity professionals from around the world. You need. To do this, you need to put this one on your calendar. All of the contact, all of the information is out on Industrial Talk. I'm going to be there. I'm going to be broadcasting. I'm going to be talking cybersecurity with the best in the world. So be there. Put this one on your calendar. That is november 3 through the fifth. I'll see you there, Jonatan Bar Guru. Good conversation. I was just intrigued by, you know, a good guy hacker. That's that's important stuff. That really is, and it goes along with all of the other conversations we were having with the Barcelona Cybersecurity Congress podcast. This whole series, there's going to be a ton more. So as we buzz on into Barcelona, we're going to be talking to all of them, all of them. If I'm not talking, I'm wasting time. So I want to be able to talk, talk more and more and more and more and more. But Jonatan, great conversation. You need to reach out to him. You need to at least have a conversation about cybersecurity. That's for Doug, aren't you? You need to protect your operations. You need to protect your organization. You need to be all connected. We need for you to be more efficient connected. We need to be able to say, "Hey, collect that data off of those assets." Protection, cybersecurity, it's all there. It is a conversation you need to have. And you know what they're they're really getting around to, which is really an interesting thing. Everybody doesn't like to talk about cybersecurity from an operations perspective because it always smacks of hey, I'm not going to get my work done. Not anymore. You know that that profession understands the necessity to keep that operations running efficiently, and they'll be able to do it, and you're just going to be protected. It's just it's it's the right thing to do. Reach out, Bar Group, Jonatan. Everything is out on Industrial Talk. Reach out to them. All right, be bold, be brave, dare greatly. We need you to succeed, and a part of that success, cybersecurity. Protect that asset, protect that operations. Pat, and you would be changing the world. We're going to have another great conversation shortly. So, as always, stay tuned.