Threat Actors — AKA Who are you?

So, I’m John Pragnell, the CTO of ExactTrak. In other words, I’m in charge of development: product development and development engineers amongst others. I also own a manufacturing company, and do a lot of other things — I like to keep busy.

Historical threat activity — AKA How did you become ExactTrak’s CTO?

So, I started off teaching maths and computing in the very early days of computing in schools. I got fed up with teaching and went back to university to do an MSC in Computing Systems, which was looking at hardware, software, operating systems and kernels — the whole gamut of electronics. And then I went out into industry and got into some very exciting projects, including joining the 802 committee in America which held plenary sessions to define ethernet, and then security, wifi and more. I also worked on what is now known as broadband. So it was quite an exciting time in data comms, which is where I’ve been all of my life. 

Norman Shaw came to me with this wacky idea for a tracker, and asked if I could build it. I did, and they promptly made me an executive director and founder of ExactTrak. And that’s how I got started with them. Even though I’ve not got a background in cybersecurity, security is an integral part of data comms.

Top Security Strengths — AKA What strengths do you bring to the table?

Lateral thinking. Sales might get in touch and say I’ve been talking to this customer about such and such. I have to think on my feet straight away to work out if we can do that. The key is being able to listen to what they’re asking for and knowing enough about engineering and laws of physics to come up with a solution, or the issues we might need to sort out. 

It’s all about being able to translate what sales say they want, what the customer really wants and what that means for our engineers. And then translating all of that into a pathway to real, commercial deliverables.

For me, my strength also comes from being a hardware and software person. It’s important to have that grounding in technical expertise, so that you can keep ahead of the engineers, and bring them all together for a common end. If I can give them the right tools, and the right directions, they’ll just put their heads down and get on. Essentially, I set the direction, and then drive our engineers down that path. Then of course, keeping them fed and watered with lots of coffee!

Threat Profile — What are the biggest cybersecurity challenges we’re facing?

The biggest threat we’ve got is that everything is now online. Everything is run from computers and comms. And because companies are focused on making this tech as easy as possible for users, there are potential gaps all over the place where people can break in and steal your information. 

At the end of the day, the biggest challenge for cybersecurity is not necessarily the tech, but the person using it. And that’s only going to get worse — until there’s some kind of massive crash which forces people to face up to this fundamental problem. We wait for hospitals or generating stations to go down before we acknowledge that there’s a real problem there. And then we stick a band-aid over it, and nothing really changes.

Initially there was little consideration for security by design, and so now people are just putting band-aids over security issues as they come across them. 

But we need to be taking a wide lens approach of ‘let’s fix critical issues so that we don’t need to use band-aids at all’. We need to be considering security by design: automated, built-in, at-source preventative security. Right from the start.

Defensive posture — AKA What are the top 3 ways employees can protect themselves against cyber threats?

Run a VPN, run a malware checker, and don’t click on links in emails! I think the email system has a lot to answer for when it comes to cyber attacks.