The 3rd Cybersecurity Congress in Málaga, organized by the Digital Agency of Andalusia through its Cybersecurity Center (CIAN), featured an insightful panel discussion on cyberdefense strategies. The discussion was moderated by María Pérez, Director General of Digital Strategy at the Digital Agency of Andalusia, and heard from Francisco Palomo, Colonel of the  Joint Cyberspace Command and Director of the Military Cyber Operations School (EMCO); Mariano Benito, CISO of GMV’s Secure e-Solutions; and Ángel López,  Coordinator of the Cybersecurity Group within the Spanish Association of Defense, Security, Aeronautics, and Space Technologies (TEDAE).

The discussion began by noting the growing presence of ICT services in people’s lives. This increased use brings with it a range of new threats and risks, including cybercrime and possible conflict in cyberspace between nations. Cyberthreats must therefore be understood and addressed so that nations have sufficient cyber defensive and, if they choose, offensive capabilities. As Colonel Alberto Palomo of the Joint Cyberspace Command noted, Spain has decided not to develop these capabilities yet, despite the militarization and geopoliticization of cyberspace. And it is aware that conflicts can take place in the physical world as well as in cyberspace.

In this respect, Colonel Palomo’s remarks on the Russia-Ukraine war were particularly interesting: he pointed out that Ukraine had been aware of the possibility of an open conflict with Russia since 2014, and had been digitally preparing for it for eight years. So when the risk finally became reality, it was able to keep its communications active at all times and maximize technology’s capabilities to make its war operations more efficient. 

As for the application of disruptive technologies in defense (where there is still much to be explored in Spain), the message was that we must be bold and not fear failure, because if we don’t do it, others will.  

Mariano Benito reiterated Colonel Palomo’s point, noting that GMV is “working with innovative technologies, with use cases in quantum technologies and AI, which can be of great help in the defense sector.” Public-private partnerships make it easier for the private sector to innovate and for developments to be tested by the Ministry of Defense, because “when we enter the battlefield, that is when we validate these technologies.” Benito used his time to highlight another of GMV’s developments as a further example of its commitment to innovation: the self-sovereign digital identity, a program within the Luis Valle research, development, and innovation project supported by the Spanish National Cybersecurity Institute (INCIBE). 

In this commitment to innovation, the GMV expert explained that SMEs have many opportunities to take risks and offer interesting value propositions, working through suppliers with greater access to this market who meet the conditions for defense accreditation. As an example, he cited GMV, “which started out as an SME and 40 years later has become a conglomerate.” 

The talent challenge: creating versus retaining 

The challenge of creating, attracting, and retaining cybersecurity talent for both the armed forces and the private sector was also discussed. In the digital landscape, where remote working is a factor in the offshoring of human resources, there are both opportunities and drawbacks. In this regard, Mariano Benito pointed out that market conditions in Spain make it impossible to offer workers trained in Spain a salary that is competitive with what is offered in other countries, leading to a talent outflow that is detrimental to the country across all sectors. Speaking on behalf of TEDAE , Ángel López highlighted the competitive advantage of being able to offer services to other countries from Spain, which has the lowest salaries for highly qualified professionals.  

The Ministry of Defense took a creative approach by opening the Military Cyber Operations School a year ago. As Palomo noted, while they cannot compete in the labor market using salaries as a bargaining chip, they have harnessed internal talent to “create talent” through training. He explained that they have been very successful in qualifying soldiers and sailors with intermediate vocational training through 750-hour courses. In September, “we will start training non-commissioned officers and in January we will start training officers.” He said: “Because the professionals we have lost are at the highest level, we are trying to reach a point were the losses do not affect our human resources.” The aim is to “make our training profitable; if they go to the private sector after seven years, it doesn’t matter because we’re all working towards the same goal.” 

To conclude the discussion, the panelists agreed on the need for public-private collaboration for the effective uptake of innovative technologies, and the need to work together to ensure that national talent contributes to the country’s cyberdefense.