Broadband World Forum: What can you tell us about where BT is heading in terms of its security innovation?

Ben Azvine: We see innovation as a vital element of winning the arms race in security; it forms a significant proportion of our overall innovation budget, and last year 40% of all patent applications filed by BT were in the security area. That's because we see significant challenges and opportunities in this area, which have arisen as a result of technologies such as IoT, AI and quantum computing. I also think more widespread adoption of distributed ledger technology or Blockchain within security creates exciting opportunities for compliance and identity management in particular -- these are some of the areas that we're currently looking into at the BT Labs.

BBWF: Why do you think security has become so key to the broadband industry today?

BA: Broadband is at the heart of our personal and business lives. The new generation in the developed world have never lived without it and arguably can't. It is used for education, healthcare, entertainment and shopping. So, people expect it to be there all the time. Security is a critical element for making sure the network is available and trusted.

BBWF: Where do you think the future of security and next-generation networks lies?

BA: We must change the way we think about security for next-generation networks. Recent incidents have shown that it isn't enough to rely on prevention-based defenses alone to protect networks; we need multiple layers of defense, complementing prevention with detection and prediction strategies. So what we're building are advanced monitoring capabilities to complement firewall and intrusion prevention systems. Our monitoring capabilities utilize machine learning and visual analytics to highlight network anomalies before they become full-fledged cyber attacks. In addition, future networks will require some level of autonomy to react and respond to early signs of attacks. So future networks will have capabilities to prevent, detect and respond to cyber attacks semi-autonomously.

BBWF: With that in mind, what challenges do you see in the future, and how can businesses anticipate and prevent these?

BA: I see two types of challenges. On the one hand the old assumptions about "who is behind attacks" won't be valid in the future. The distinction between lone hackers, criminals and hacktivists/government will be blurred. The emergence of "malware-as-a-service" or "DDoS-as-a-service" shows a high level of organization and coordination amongst our adversaries, which means organizations must now prepare themselves for worst case scenarios.

The first step is to think 'security first'. Approaches such as security by design and zero trust networks are going to become business as usual. The second challenge is related to new technology. Quantum computing and AI can be very powerful weapons in the hands of the 'bad guys'. Equally they can be powerful technologies to defend against future attacks. Businesses need to prepare themselves to understand how these technologies will be weaponized and how they can be used within their defenses.

BBWF: In 1995 you joined BT to lead a research program to develop novel AI technology to support next-generation IT systems. How do technologies like artificial intelligence and machine learning influence this space?

BA: I see the influence of these technologies increasing. Within security, we'll have to consider both the positive and negative impact of them. On the negative side AI and machine learning are being used to generate fake identities, fake images and videos aimed at social engineering attacks or blackmail. Future malware could also have intelligence to adapt to avoid defenses or detection.

On the positive side, using ML network anomalies can be detected much quicker reducing the window of opportunity for attackers to find vulnerable entry points into the network. AI can also be used to automate response to attacks by learning from previous incidents.

BBWF: Finally, how do you think IT evolution will change as technology advances?

BA: I'd like to think, in the future, that IT systems will be developed more like safety critical components in the engineering industry. We need better architectures to be able to upgrade IT systems, we need much more emphasis on automated testing and verification to find vulnerabilities before IT systems go into operation, we need automated monitoring and self-optimization capabilities to detect any deviation from operating parameters and we need proactive maintenance to replace IT system before they break. IT systems will be an integral part of future networks with the introduction of SDN/NFV technologies, and hence we must change our approach to build IT systems and then add security later.