Ray Le Maistre, TelecomTV (00:05):
National telecom security has never been as high profile a topic as it is right now, as cybersecurity challenges grow and digital sovereignty trends impact public and private sector strategies alike. So I'm talking today with Jo Cavan, who is managing director of the UK Telecoms Lab or UKTL to discuss these trends. Jo, great to see you. Thanks very much for joining us today. So to open up, can you just tell us about UK Telecoms Lab and its role in the sector's ecosystem?

Joanna Cavan, UKTL (00:37):
Thanks Ray, and thank you so much for having me to talk about UKTL's important work. So we are the UK's cybersecurity research and testing facility. So we carry out advanced vulnerability research and industry security testing to protect critical telecoms networks from cyber attacks. So we work with all the vendors and operators that are within the UK's critical national telecoms infrastructure. And your viewers will know that telecoms is the second most targeted sector after government for cyber attacks. And that's because really telecoms is the connective tissue across all critical national infrastructure. So transport relies on it for signalling, healthcare for connected devices, banking and financial transactions, et cetera. And that's before we even get to emergency calling. And that's why telecoms is so important to make sure that we are protecting networks from cyber attacks. So we work with operators and vendors to disclose the vulnerabilities that we find so they can be patched before they're exploited by, for example, a hostile nation or cyber criminals.

(01:57):
And a number of the vulnerabilities we found are zero-day vulnerabilities. So effectively, if exploited, they would have taken down 95% of mobile coverage within the UK. So you can imagine the type of disruption that those attacks would cause, not least to how we live our daily lives, but also the disruption to GDP and the economy if such attacks were successful. And that really emphasises the importance of our security and resilience work.

Ray Le Maistre, TelecomTV (02:30):
Okay, thanks Jo. So you mentioned there the interaction with the various parties in the sector. How exactly does UKTL interact with network operators, technology developers, and the UK government bodies?

Joanna Cavan, UKTL (02:45):
So I've talked a little bit already about our independent security testing, but we also convene operators and vendors because we're a kind of neutral ground for operators and vendors to come together to learn about the trends and patterns in the cyber threat that we see in the telecoms infrastructure. So we run workshops such as "Hunt, Detect, Evict" workshops to look at some of the persistent threats in the telecom sector and how we can work together to share observations from the testing that we do. So we are not just fixing individual vulnerabilities, we're looking at the patterns and trends in our testing work so that we can fix the root causes and put systemic fixes in place. So that's one of the other ways we work with the ecosystem. We're also really active in International Standards Fora to make sure that we can put security by design and default into the technologies of the future.

(03:51):
Because if we do that, then we'll all be safer and more resilient. So we are working in forums such as 3GPP to try and put security at the forefront of future technology such as 6G standards.

Ray Le Maistre, TelecomTV (04:09):
No, absolutely. I was going to say, and that's a critical time for this because of the starting work we have now on 6G specifications. But I mean in general, digital security is an increasingly hot topic for governments, enterprises, and individuals of course. Should we be encouraged or concerned about network security trends? And how would you characterise the impact of AI on network security strategies?

Joanna Cavan, UKTL (04:40):
I think it's really good to see more conversations about security, and we have seen real progress. If you look at Ofcom's report in the UK, we have the Telecommunications (Security) Act, and there's some really good processes being put in place by operators to make sure that networks are secure. So we are seeing progress. AI is a buzzword of the moment. We are using AI in our lab, large language models, for example, which are improving actually our advanced vulnerability research, speeding up our work, and they can be used as a real force for good. But also they're another vector for attackers to use. So it's really important to make sure that AI is used safely, securely, and for good. And that's something we are really passionate about at the UK telecoms lab.

Ray Le Maistre, TelecomTV (05:41):
Okay. And of course that's something that's cropping up now on almost a daily basis with these advanced models coming out all the time. So I'm sure you've got your work cut out there to keep up with what's going on. Another fast-moving area, of course, is around quantum computing. Is the world ready for post-quantum security? Because I guess it's not really that far away now that everybody's going to need to address this.

Joanna Cavan, UKTL (06:10):
Not yet, but the imperative is real. Quantum computers will be capable of breaking current encryption. It's not something the lab here is focused on in the immediate term because we are much more focused on technologies that are currently in operation within networks, but it is something that the National Cyber Security Centre have given advice to organisations about how to get quantum ready. Here at the UK Telecoms Lab, we've focused on AI in telecoms, other areas where telecoms is converging, for example, non-terrestrial networks, eSIM technology, private networks. So actually we're doing much more near-term work here to look at what are the cybersecurity threats in those areas where telecoms is converging or new and critical technologies to the operation of telecoms networks and how can we support operators and vendors to improve security and resilience.

Ray Le Maistre, TelecomTV (07:15):
Okay, great. Now you mentioned a couple of really hot technology trends there, but another key trend, of course, and it's absolutely everywhere globally is sovereignty. How is the increasing focus on digital sovereignty impacting UKTL?

Joanna Cavan, UKTL (07:33):
Well, sovereignty is an interesting topic and it's kind of the latest buzzword. On one hand, it's nice to have something other than AI to talk about. But joking aside, digital sovereignty is interesting because there's no single interpretation of what we mean when we talk about digital sovereignty. And the whole point of telecoms is that it is enabling connectivity. So the opportunity for telecoms networks to be kind of digital islands, if you like, isn't that feasible when we need that global connectivity. So I think what's really important with digital sovereignty is to understand what you mean when you are talking about digital sovereignty. Is it about territorial control of where your data is stored? Is it about making sure you own or have fewer dependencies across your supply chain? So perhaps the more important thing to talk about is broader resilience. So not just security in terms of how you stop attackers getting in, but how resilient are your networks and what are your requirements?

(08:47):
Do you understand how your network is architected? Do you understand the supply chain? How quickly can you recover and keep going if part of your network is compromised? So I think perhaps the more important topic is the broader topic of resilience. But for digital sovereignty, I'd love to see a clearer definition and understanding about what we mean when we talk about digital sovereignty rather than it just being used as the latest buzzword.

Ray Le Maistre, TelecomTV (09:20):
Great, Jo, thanks very much. Now, of course, the important work you are doing here in the UK is probably mirrored in lots of other countries as well. So does UKTL engage with similar bodies in other industries and other markets?

Joanna Cavan, UKTL (09:38):
I mean, that's really interesting question actually, because I think we are quite unique here at the UK Telecoms Lab. We do work with our German equivalent, which is part of BSI, but there aren't many equivalent security and resilience testing labs around the world. So we really do think what we've built here is world leading in terms of the capability and the generation of telecoms and cybersecurity professionals that we are growing. But we are interested in looking across other critical national infrastructure sectors to look at how we can partner to improve, well, to increase the impact that we can have on security and resilience.

Ray Le Maistre, TelecomTV (10:24):
Okay, excellent. Well, quite surprising that there aren't many bodies like this, but hopefully others seeing this video will be prompted into action and to get things moving in other markets. But Jo, it's been a pleasure to talk with you today. Thanks very much for joining us here on TelecomTV, and I look forward to talking with you again in the future. Thanks very much.

Joanna Cavan, UKTL (10:47):
Thanks, Ray.