BrandVoice
September 11, 2001. A series of terror attacks shocks the United States and the entire world. The civilian cyber world was in its infancy then, and cyber attacks were less prominent in the headlines, but it seems that both then and now something similar was happening: we underestimate the human advantage over machines. Even in 2022, and even in “individual” attacks, in which one attacker decides to carry out an attack, it is very hard to obtain any prior warning — a significant weak point for intelligence agencies.
But the intelligence agencies aren’t the only ones with a problem. Cybersecurity professionals in civilian organizations also have to face hackers working independently and randomly, just like individual terrorists who wake up one morning and decide to carry out an attack.
Doron Amir (46), an Israeli tech entrepreneur in the field of software, cyber and information security made note of this weakness and decided to take action. “Bad things happen when good people are silent,” says Amir, quoting Albert Einstein. In a comprehensive interview, Amir shares his belief that it fell on him to revolutionize the field.
“Cybersecurity is a war,” he explains. According to Amir, experts’ cyber abilities today are almost limitless and he wants to discuss one such capability in particular. According to him, intelligence organizations, including the Mossad, the Shin Bet, the FBI, and the CIA, operate HUMINT departments in some of their intelligence activities. “With the proper deployment of a small number of people we can substantially contribute to the country’s security. At the same time, it is possible to activate a large work force that will actively contribute to a safer place in Israel and abroad.
“With extensive, in-depth professional experience in the technology world, I think that in the field of cyber security, people still have an advantage over machines. Artificial Intelligence (AI) is not a magical solution, and it has no intuition. My emphasis is on people, who are not to be taken for granted; these days, academics and industry are focused on technology, with an emphasis on data analysis, machine learning, quantum computers and other scientific disciplines — but less on people. The person in the company is a potential security breach. Is it possible to manipulate him and obtain the permissions of a secure company? And if the same person is aware of the manipulations — will it prevent him from falling into a seemingly innocent socially engineered procedure?”
“In cyber security it must be understood that a person is the most vulnerable or destructive component, both in the context of a private company or a government organization. Cyber security has multiple levels of creativity that include the essential use of emotional intelligence, psychology, sophisticated methods of manipulation, emotion-based decisions and intuitive processes on the randomness spectrum”
Amir founded and manages CyTaka — the World Cyber Championship for Programmers. He promotes global activity to build bridges between different peoples, with an emphasis on education and tech employment in different sectors and countries around the world. After the end of the fundraising round from private investors, the value of the company stands at a billion dollars — thus entering the list of Israeli cybersecurity unicorns.
One of the challenges that Amir identified was the shortage of cyber security personnel. The world of cyber security has been suffering a lack of experts in the field for some time now. A report from Fortinet regarding the skill gaps in cyber security for 2022, found that skills gaps in cyber defense, alongside the increasingly acute shortage of professional personnel in the field, are responsible for 80% of cyber security incidents in the world. Amir mentions that in the past he wrote and implemented software and cyber security training programs in academics and various organizations including for populations with no prior background. “I took Haredim [ultra-Orthodox] from national service who do not enlist [to the military], and I built them a profession. Instead of complaining, I see how I can solve the problem.
“In Israel, the military affects the lives of every citizen, more than any other agency, including academics and other good institutions,” Amir explains. “I must say that I also took inspiration for our venture from a quiet, introverted unit that is far from the spotlights of the glittering 8200 Unit or the equally glamorous ‘Sayeret Matkal’ Unit. Unit 504 is a special unit for operating agents — designed for human intelligence.
“Like in Unit 504, in cyber security it must be understood that a person is the most vulnerable or destructive component, both in the context of a private company or a government organization. Man, not the machine, is a point of weakness and strength at the same time. I say this because cybersecurity has multiple levels of creativity that include the essential use of emotional intelligence, psychology, sophisticated methods of manipulation, emotion-based decisions and intuitive processes on the randomness spectrum.”
Technological changes
“Many people think that the cyber world is based solely on engineering, mathematics, technical skill, and infinite lines of code,” says Amir. “Which we have, in abundance, but there is another level which is no less essential – that of technological changes which make cyber security much more dominant.”
According to Amir, blockchain technology can produce autonomous algorithms and smart contracts, but the fundamental change in technology is the in the means of gathering information and in computing power. “These days there is disproportionately more computing power, which is also available to the public, not like in the past when it was primarily available to government bodies, the military, the academy and research. In other words: you can run more things at once and get more results quickly.
“It’s a mistake to think that there is new science, and to sell artificial intelligence courses with innovative names like ‘Data Science,’ ‘Machine Learning,’ and ‘Data Mining’ where apart from the title, the essential content remains the same. That is, the methods of calculation and principles of mathematics – the fundamentals which enable the production of information and various products – has remained coherent. On the other hand, computing power and the means of gathering information (IoT) are new elements in the past decade that have changed the paradigm of the security worlds.”
Amir explains that there is a collapse in the previous defense methodologies, and a fast-paced security race is underway. If in the past, a systems manager of the organization would have trusted the software provider of a private company and would update an antivirus program every so often — the present day is fundamentally different, and a new job title has been born – CISO – Chief Information Security officer.
With this insight, CyTaka is recruiting hackers for professional action, and is developing defense products for cloud and banking technologies.
“The transition process of the cloud is sensitive in terms of exposure to security breaches, and since its ongoing maintenance demands skilled professional knowledge and intensive updating, what was secure yesterday will no longer be secure tomorrow,” says Amir.
“Through the CyTaka Cube, which is still in development, we are producing real-time cloud security. That means that every security breach to which we are exposed goes to a unique protective shell which addresses that specific security breach, meaning, we are updating from the field and not just from the knowledge that exists in the industry today.”
Amir explains that the banking world is going through fundamental changes, and the modern bank is moving increasingly online — including the race to establish entirely virtual banks. “There is no doubt that the degree of reliability and dealing with cyber security threats to customers too – that is the most important challenge. A virtual bank must take into account new and creative cyber threats. Not phishing, but rather, orders of magnitude that require the banks to have reserves of cyber security personnel in addition to the technologies that exist in the field. That’s why we also offer training and coaching solutions for cyber security with a focus on banking, even though there are players which produce robust technology in the sector – including Amazon, Microsoft, Google, Oracle and others – there are two more significant elements in question: who provides full insurance for cyber security damages at a banking level, and who protects the end user with his smartphone, which includes applications with different configurations?” he says. “It’s hard to believe that cyber security will be managed in a ‘minimum care’ format – meaning that the big companies will look after security, and the user will be absolved of responsibility, as it should be.”
“Perfect Synergy”
Amir has harnessed the combination of understanding technology and human capital to train the next generation of cyber security professionals. “The challenge was to gather a mass of people and make them into hackers, but there is no such mass in the world of security world. Relatively few people really know cyber and information security. So, I decided to change direction and realize, for the first time, the possibility of upgrading software personnel. I built a mechanism that identifies software personnel and gives them an information and cyber security profile.
“To this day, when a programmer applies for a security position, they will ask if s/he came out of 8200 or if s/he did hacking. I built them a ranking, which is meant both for them and for anyone who might recruit them for work.
“I give the employer a precise profile of what exactly the candidate knows how to do, including handling fast work environments, creativity and of course – their level of knowledge and ranking relative to others. It’s a perceptual shift in the sorting of personnel, demand and recruiting of cybersecurity professionals. If until now, they went to all the large cybersecurity companies which are struggling to recruit cyber professionals — now we’ve created a solution for them – and it’s a real revolution. I didn’t set out to start a billion dollar company. I didn’t even dream of it. I came to make a change.
“I designed two huge verticals: one for software professionals and one for cyber professionals. Cyber professionals showed up because I created competitions in solving cyber challenges that came with prizes. They wanted to compete, improve their skills and excellence, and above all — to enjoy challenges that match the level cyber security required (and to win prizes along the way).The software people look at the cyber people and want to be like them, and most of the software people were first exposed to real cyber security, and get started through the common interface of code and tricks. We definitely found the perfect synergy.”
For the competitions held by Amir in Israel and around the world, he invites former senior officials from the security establishment, such as ex-heads of the Mossad, Danny Yatom and Yossi Cohen, the former IDF Chief of Staff Gadi Eizenkot, the former head of the National Cyber Directorate Igal Unna and others. In the “Cyber-Negev” competition, held by the company in April 2022 in Sde Boker and its offices in Herzliya simultaneously, Eizenkot awarded the winner for cyber excellence in honor the former head of the Mossad Meir Dagan on behalf of the organization in his memory. The Cyber World Championship in 2023 will be held under the banner of the ‘Abraham Accords’ to encourage peace processes in the Middle East and to grant the biggest prize yet to be awarded at any of the competitions.
For the Israeli Cyber Championship, which was held at Tel Aviv’s Hilton hotel, some 5,000 software, information and cyber security personnel registered and competed for 50 titles. “We gave out prestigious prizes that motivated the crowd to come and compete for the first prize of $50,000 (Guy Moria) and the second prize of $15,000 (Tzach Pahima, Gil Portnoy).”
The competition lasted for six straight hours, until the wee hours of morning, and during the break, the former Mossad head, Yossi Cohen, was honored and came up on stage to speak about the great importance of the field of cyber security and greet the attendees. Prizes were also won by the Red Team, selected hackers and cyber security researchers from the industry, which were invited to a competitive cyber security meeting and fun day in Dubai in August, including flights and full hospitality. The participants were the first to try the CyTaka Hack product which allows competitors to train and improve their cybersecurity skills through the application and the internet.
What is the goal of the competitions?
“The goal is to create methodologies of protection through setting challenges for real hackers. Instead of sitting in a laboratory and start thinking up sophisticated algorithms to protect the system, what happens if we challenge and uniquely document a cyber attack?
“I set up the challenges that we built – you attack. I build defense. Our competitors are attackers, but also defenders. I had dozens of the world’s top cyber professionals come and negotiate cyber security challenges on different subjects such as a digital wallet or an electric car’s sensor system. I sell protection that does not exist in real time. Someone buying an antivirus product won’t find out what I discovered through one hacker. He will find it out in three more months if another hacker breaks into his system, then he will build an antivirus program against that security breach. It’s preventative treatment. That’s our business model.
“The cyber security community in Israel is supportive and very helpful in advancing activity, including the former head of the National Cyber Directorate, Igal Unna, who helped the project take off on the international and strategic platform, and sees the matter of upgrading software professionals in information and cyber security a good, interesting model. At the CyberSec Europe 2022 event which took place in March in Italy, Unna noted CyTaka’s global activities which uses incentives to attract young people not only to program but to focus on cyber security methodology.
“The interest is in getting another boost from people who know the field, such as the former head of the Mossad, Danny Yatom, who was present at the Cyber event in December of last year “The Best in Cyber’. Yatom emphasized encouraging and locating special men and women to the field of cyber security, and offered words of encouragement for the young generation present at the competition.”
Do you continue working with the competition winners?
“We have such people outsourced or as employees, at salaries as high as $30 thousand a month. Over 50% of the company’s employees were carefully chosen from the competitions’ top performers. In addition, in all of the competitions, some of the prizes are also job offers. The person who wins a million dollars in the competition in Dubai will become our consultant. We give high salaries because we want to keep these minds in Israel. Lots of Israelis moved to Seattle and took their whole family with them. I have friends that are salt of the earth Israelis, and it’s a real shame that the country is losing them. I don’t want good minds to leave Israel. I can retain the best people in cyber security – if you are a genius, I will pay you a staying-in-Israel fee. Yes, it would be better if it was out of love of Israel, but the reality today is you have to pay.”
Apart from the live competitions, the company holds weekly competitions through its application, through which members of the community acquire more and more skills in cyber and information security. “Israel is the most genius R&D department I could wish for myself. It’s not just the Jewish mind, but the reality in which we live. Just like tremendous pressure produces diamonds — Israel’s enemies create brilliant and creative cyber security people,” says Amir.
What is your greatest accomplishment in this venture?
“Nobody ever treated programmers as having the potential to become information and cyber security professionals before. And it is not possible that programmers, who are the ones that write the programs, the applications, the systems – are unaware of the cyber and security field. In order for the next generation of programmers to produce more secure programs, we must change the paradigm that separates software and cyber security personnel. Furthermore, the programmer who wants a higher salary, and to advance his career, must enter the field of cyber security, but in order to prove cyber skills you have to do it correctly and get an accurate ranking for the new abilities that the programmer has acquired. The greatest achievement that the programmers will bring with them is ‘positive security’.
“The number of cyber and information security experts is actually used as a new kind of GDP, that is, if there are excellent cybersecurity people and the country is increasingly protected technologically — that means that the system is working properly and efficiently, which affects the quality of the education, academic research, the economy, banking, medicine, security and technological progress.
“The number of cyber and information security experts is actually used as a new kind of GDP, that is, if there are excellent cybersecurity people and the country is increasingly protected technologically — that means that the system is working properly and efficiently, which affects the quality of the education, academic research, the economy, banking, medicine, security and technological progress”
“The fewer a country’s accomplishments in the field of cyber and information security – the less freedom and security there is to use technology, making it a ‘third world country’: there’s no cybersecurity – there’s no tech industry, and if there’s no tech – there’s no progress. A country that gets gold medals in the Olympics understands that it represents their investment in excellence, including infrastructure and guidance which make it possible for the athlete to excel. Likewise CyTaka, the World Championship in Cyber Security, represents the achievements in the cyber security field among representatives of the countries competing for the title of Cyber World Champion.
“The number of software people, cyber and information security that we have here have long since passed the 100 thousand mark. The aspiration is to get to a million software and cyber security people working together. There is no country with a million programmers and cyber professionals, and if it does not happen through me – it will come from illegitimate sources, and then it will be too late. We are at a critical moment in time in the balance against negative security. I bring cyber security to the people with all of the championships, and every event, large or small, advances the horizon of positive security. In April we held the Cyber-Negev and created field conditions similar to a cyber attack from the outside; we split the teams into Red and Blue. The Red team were hackers whose role was to attack the cyber experts, the Blue team was made to defend. They created an outline that simulates two countries: one is actively attacking and the other is actively defending, and in order to add the element of surprise, we also added an anonymous attack force, just like in reality when a group of independent hackers joins together in an attack with nationalist or other motives.
“In the Cyber-Negev competition we raised standards in terms of complexity and challenge, but the prizes were also more prestigious, such as the award for excellence named for the former head of the Mossad, Meir Dagan, in cooperation with the organization in his memory. The awards for excellence were presented to the winners by Colonel (res.) Gadi Eizenkot who spoke on stage and congratulated the activity.”
Love of homeland
“We get interest from abroad. Many Israelis and those with ties to Israel see the activity and want to advance positive security together with us. Every Israeli that we manage to bring back to Israel is, as I see it, part of the reverse brain drain, it’s even Zionist, a love of the homeland,” explains Amir.
Throughout the month of December, the Chief of Staff, Lt. Colonel Aviv Kochavi spoke to the graduates of the military aviation course, and referenced a prominent billboard which read, “The Best in Cyber.” Doron Amir was responsible for the sign, which he put up when Chief of Staff Kochavi claimed that ‘the best’ were the combat soldiers. Doron, who was himself a combat soldier before becoming a cyber professional, felt that the message came across in a misleading way, tending toward division rather than unity.
So Amir acts to unite combat and cyber personnel in order to advance Israeli tech. “Other projects that I make sure to advance include the integration of combat soldiers in tech with similar conditions to those coming out of tech units. Infantry, armored corps, border police and others can integrate in management and organizational roles.
“We are one united, flourishing country. There is room for improvement and reform but most of all we must come together. There is no tech-vs.-cyber. There are people and there is space and positions for all, we just have to be more creative with more leadership and results in the field.”
But not everything is positive. Amir explains that despite the good will, the world continues to behave in a worrying way. “The Ukraine-Russia war is creating further testimony and reminder of the cruelty and evil of wars. We called for an end to the war, and were hit with cyber attacks and Fake News from the Russian side in order to directly hurt the initiative because they thought that what we were doing was creating an army of hackers and less a sportive initiative that promotes excellence.
“Despite the wish to be global – and I already know that there is no such thing as perfect and not everyone has to agree – I need to choose the side that advances humanity towards a better world.”
BrandVoice is Forbes’s Marketing content brand
