Today, companies and government institutions have turned to the intensive use of information in order to maintain their activities. The storage, transfer or security of information, whose importance is increasing daily, has become a significant requirement. Information is now the most valuable asset for institutions. Therefore, all institutions and organizations, particularly the government agencies, as well as the defense industry and financial institutions, have to take measures about the security of their information. Cyber attacks, viruses and malware also raise concerns and questions about information security. So, what kind of strategies should companies and government agencies develop regarding the security of information? In order to find an answer to this question, we met with one of the doyens of the field. We spoke to Ufuk Yilmaz, one of the founders of Rootcon Information Technologies, which has been advising many institutions in the field of information security since its establishment.
What are the areas of expertise of Rootcon Information Technologies?
Rootcon is one of the few companies in Türkiye that offers technical training, consulting and testing services in the fields of information security and cyber security. We completed one of the first ISO 27001 studies in Türkiye in 2006, and have achieved many similar achievements since then. We have offered consultancy for the first ISO27001 certificate obtained within the scope of YYS in Türkiye, and provided trainings for various associations in this field. Since our establishment, we have been preferred by many companies as a solution partner for information security related studies. While offering consultancy services for standards such as ISO27001, ISO 27019, CMMI ISO22301, SPICE, we are also reconstructing the information technology infrastructures of the companies both operationally and in terms of security. While providing technical trainings in SOME, CEH and similar fields, we also offer services in areas such as penetration, vulnerability, social engineering tests and code analysis. We are one of a few companies that can do all of these and are not integrators. Therefore, we are not worried about selling any product or software. With this, we have managed to keep customer satisfaction at a high level in the projects we have undertaken. Mainly two sectors offer consultancy services in the field of information security in Türkiye. One is integrator companies, which are very motivated to sell products to their customers, and the other is general consulting firms. They are experts in the fields of quality, occupational safety, environment and food, and they carry out brand patenting and corporate identity studies and are also looking for government supports. Such approaches make it impossible to specialize in specific areas, especially in information security. Our main strategy, on the other hand, has always been to grow by specializing in information security.
How many people your team consists of?
We work with a team of 22 people. We have consultants, trainers and testers. We offer remote monitoring and intervention services to companies in the field of cyber security, within the range of the permissions granted. Of course, the most important parameter in information security and cyber security is users. In our extensive penetration tests or targeted attacks on companies, the process proceeds like a “ripping sock”, and we look for the first loop that can cause the complete sock to tear. With the authorities we get from that point, we start the next process. This loop is usually the users. They often open the wrong emails, share something that should not be shared, or use a USB stick that should not be used. And the aftermath is certain.
“We have completed one of the first ISO 27001 studies in Türkiye.”
Can you give us an example on this?
Sure. Everyone knows that Bank of America has been cyber-attacked. The attackers have physically followed the bank's employees for years. They found out that one of them was interested in motorcycles. They contacted this employee on a motorcycle-related forum and submitted photos to sell engine parts. The virus entered the system when this person looked at photos of engine parts while he was at the office. The interesting thing is that the virus waited in the system for years. 5 – 6 years later, the virus inside transferred several billion dollars to Panama. I can give another example. China stole the plans for Iran’s nuclear power plants using a similar method. Not only that, but they also slowed down its nuclear turbines and reduced their energy production capacity. The method they followed for this was as follows: They sold cheap USB sticks around Iran's nuclear power plants. When one of the power plant employees bought a USB stick and inserted it into one of the devices at the power plant, they introduced the virus inside. Cyber attacks are also targeting power plants. Russia has been continuously disrupting Ukraine’s electricity for the last year by infiltrating their systems. There have also been power outages in Türkiye from time to time as a result of cyber attacks. Our banks and airports can also be the targets of frequent cyber attacks. Since we are aware of these attacks as the country, we are now giving priority to the issue of cyber security. In recent years, ministries have begun to prioritize the issues related to cyber attacks.
So, what kind of strategies you think should be developed in the field of national security?
Our major requirement is local products. On the one hand, we need to improve our security infrastructure. Aviation and energy are among the most critical sectors for our country. For this reason, in recent years, leading aviation companies and airports have been asked to establish special teams that can resist cyber attacks and obtain 27001 certificates. Likewise, the power plants as well as the distribution, marketing and production companies are also asked to set up a cyber incident response team to obtain 27001 and 27019 certificates. We also need to complete our compliance with ISO20000-1 and ISO22301 regulations.
The KVKK law fills the agenda of companies in recent months. What kind of services do you offer in this area?
The Law on the Protection of Personal Data is one of the subject matters we are interested in. The Law on the Protection of Personal Data, which still requires some legal interpretations, is actually related to information security. In recent months, the official preparation time for the KVKK has come to an end. This caused a hustle in the companies. In other words, fines will be charged to companies that no longer comply with the standards. Such administrative fines could reach up to 1M TRY per case. According to the size of the job, even prison sentences may be given. KVKK consultancy services can be offered by legal consultancy and security firms like us. Interpreting the law does not fall into the field of expertise of security firms. One the other hand, it is also impossible for lawyers to master the issue of information security. For this reason, legal consultancy and technical information security consultancy should be offered simultaneously.
Will artificial intelligence applications be on the agenda in the field of information security?
If the software you use has the ability to learn, it means that is advancing towards artificial intelligence. In our country, we need to start from a technological point. It may take years to reach the level of Google and Amazon. The information security field will also be an area where artificial intelligence software is preferred. Qualified personnel trained in this field will also be required, but unfortunately the opportunities are very limited in our country. Also, most of the Turkish teens desire to move and work abroad.
“Aviation and energy are among the most critical sectors for our country.
For this reason, in recent years, leading aviation companies and airports have been asked to establish special teams that can resist cyber attacks and obtain 27001 certificates.
So, what do you offer to the companies that want to train their staff against cyber attacks?
We are able to offer several trainings to the companies, including information and cyber security trainings, network forensic trainings, conducting cyber attacks, countering cyber attacks, chief auditor trainings, internal audit trainings and application trainings. If there is a cyber incident response team within an organization, this team should have the required competence.
What do you think those who want to become an information security specialist in Türkiye should do?
Students studying information security at universities in the US are developing along with the sector. In the US, students learn both theory and practice, and get prepared for the industry. This runs rather “theoretically” in Türkiye. Apart from the university education, they also need to devote serious time to this field, follow relevant publications and trainings, and practice every opportunity they find. Because, the countries have turned against and fighting with each other also in the cyber world. Today, our country needs specialists in this field much more than ever.
