Author: CJPeter Etuokwu MSc. MBCS

Academic, Mental Health, Well being, Diversity & Inclusion champion , Education and Information Security Professional blogger.

Ukraine IT: resilient and open for business (bcs.org).

In spite of the grim events that started February 24 in Ukraine, their IT sector remains open for business. Konstantin Vasyuk, the IT Ukraine Association’s Executive Director, spoke to Brian Runciman MBCS about the nation’s tech industry resilience, business continuity and what help looks like.

In the last decade or so, the tech industry has talked a great deal about digital transformation and in early 2022 some of that work has borne fruit in a fascinating way, despite the horrible context. During war, Ukraine is keeping its economy going in large part through digital means and in a way that previously countries under these sorts of pressures couldn’t.

A combination of effective business continuity and resilient connectivity is allowing Ukraine to cope economically now, and maintain future potential.

Konstantin Vasyuk says: ‘This is in part due to us being quite a young nation. The average age of our IT professionals is 27 years old and that has allowed us to take to new technology very fast.’

The IT Ukraine Association represents more than 100 tech firms and about 75,000 IT specialists in the country. Vasyuk is keen to stress that, despite the Russian invasion, the sector remains open for international business.

Business continuity

Business continuity has been tested in the world in general throughout the pandemic but the outbreak of a war in Europe added a whole new layer for Ukraine.

‘I should say,’ says Vasyuk, ‘that we weren’t surprised. We have been in the state of war with Russia since 2014. Companies developed business continuity plans before Russia invaded Ukraine. But there were things we hadn’t expected, for example, the Belarussian regime’s help to Russia and the volume of territory attacked during the first day of the war. We hadn’t experienced anything like this before, but it just proves that you have to be ready for everything. Now we see that we were ready, and we are coping with it exceptionally well.’

Vasyuk is working and, as he points out, this is true for thousands of Ukrainians. In some cases, relatively normal life has continued, especially in the safer regions of Ukraine. ‘It is really fantastic that most of our IT companies work almost as usual, and this is partly due to the huge territory of Ukraine,’ says Vasyuk.

Ukraine’s well-developed infrastructure, internet and fibre-optic network have allowed stable digital connections – and this has been supported by 5,000 of Elon Musk’s Starlink devices previously supplied to Ukraine.

‘Before the war,’ says Vasyuk, ‘it wasn’t possible to operate Starlink due to some limitations in European legislation. And in Ukraine it wasn’t possible to use this officially or legally, but the situation has changed. Now they are operating. There was a record number of downloads of the Starlink application. We now have very good experience of using this equipment. It’s a reserve alternative for network connections, but it helps for the regions which temporarily have problems with internet connection.’

Vasyuk agrees that Ukraine IT’s business continuity planning has been tested to another level but, as he says, ‘we are, and we will always be, a human-centric industry, a talent-centric industry, and that’s why all the business continuity plans related to people worked so well.’

When it was put to Vasyuk that, as the Executive Director of IT Ukraine he must feel a good deal of personal pride in the way the industry he represents has stepped up, he points to the maturity of the IT profession in Ukraine. ‘We have reliable IT businesses, more than 4,000 quality companies in Ukraine and according to our recent report, issued before the war, they’re very socially responsible and very flexible.’

Vital cybersecurity assets

On the subject of cybersecurity Vasyuk is necessarily cautious. ‘We have a lot of projects now which we cannot speak about,’ he says, ‘but we have a lot of examples where people have applied their expertise to create new products. For people, for government, for the military.

‘For example, we have some projects that identify people and vehicles, or even map the placement of enemy troops. That data goes to the proper state services, the military services, but that’s just the visible part.’

He also discusses the hidden part of cybersecurity. ‘This is most complicated, sophisticated and interesting because this is a collaboration on exact tasks with exact goals,’ he says. ‘There are three levels of this, the first level being DDOS attacks. It’s very simple. You can launch an application on your phone and you are in. But these have a short-term effect, so it’s not that harmful for the enemy.

‘The second level is pen-testing and hacking of some resource servers, and this is much more sophisticated, we have good experience in this.

‘The third level what we call internal work where you penetrate infrastructure, you organise some internal structure for continuing attacks and destroying information. And this could lead to huge damage. We have examples where one of these efforts just eliminated all documentation, all data inside the servers of one organisation. It just left the target without any information at all. When you destroy data it’s perfect. The most sophisticated level is developing special software and special firmware for equipment for internal for military projects, because they have a lot of very sophisticated, nice, smart things which helps our army.’

Ukraine recently thwarted a cyberattack targeting its electrical grid, which could have affected millions of users. It’s thought to have been released by Russian hackers known as Sandworm, a group believed to be part of Russia’s GRU military intelligence agency.

The malware was described as an upgraded version of a programme which led to power blackouts in Kyiv in 2016.

Part of the malware programme was designed to take over computer networks at the energy provider to cut power, while a second part was deployed to wipe out data with the intention of slowing down attempts to get power back online.

Vasyuk said this showed how well prepared the Ukrainian’s now were when it came to defeating such attacks: ‘On the battlefield we were faced with the second army in the world, and it was declared that it’s the strongest second army in the world. But our people, our soldiers who fight on this front, they know that this is not the second army of the world anymore. And the same I should say regarding cybersecurity and the cyber army of Russia, the cyber potential of Russia. Of course, they have some potential, some expertise, but it’s again another myth.’

How the international IT community can help

Conversing with Vasyuk and some of his colleagues is a moving experience – they are engaging and upbeat. And that was well reflected when we discussed what help was needed.

‘We are not asking for donations,’ says Vasyuk. ‘We’re asking for a bit more business trust in Ukraine IT. It’s not obvious when you see these awful pictures of destroyed buildings and everything, but we managed to save our business – our IT business is working, so we want to tell people about this and share this information. Our most important support companies can provide a continuation of contracting and continue working with partners. And maybe if some companies have relocated people abroad, it would help to provide some office spaces or logistics for them.’

It’s inevitable that there will be some percentage of cancelled contracts, says Vasyuk, but, as he says, ‘we just proved that even in these conditions we can work. And they are very hard conditions.’

He is also looking forward: ‘the situation now is very, very dramatic. Still when we overcome this a lot of customers will return even if they reject some contracts.’

One particular current issue is, understandably, with site visits of IT specialists to customers. Says Vasyuk, ‘We are talking with government regarding this to maybe provide some special procedures to allow people business trips for a specific term – maybe two to four weeks – to visit customers on site. That will help to continue business processes.’

Vasyuk’s message is to trust current contracts with Ukrainian partners and if possible even start new projects.

‘Investors can explore their tech needs in Ukraine,’ says Vasyuk. ‘Explore the landscape of the IT industry of Ukraine and you will find exactly the partner you need. We (the IT Ukraine Association) can assist in this. And if you think that all these people are sitting in Ukraine – no. Most of our companies have offices in different countries and they have different teams.

‘Of course we spend a lot of money now for military purposes, for humanitarian purposes but we are also spending money to develop business at the same time.’

IT professionals in Ukraine

In the region of 85% of Ukraine’s IT workforce is still working, but Vasyuk is keen to point that whilst availability runs at ‘85% plus, efficiency is more than 90%. That’s important because you can have lower efficiency with higher availability, but we have both figures quite high. In general, we see that people are very motivated because they are patriotic. For example, we were supplying some special medical kits for troops. We have foundations which gave these some donations. But sometimes just one company will send money for this purpose.

‘So because people can still work, they can earn money, then they spend money for the army and humanitarian aid. IT Ukraine’s survey showed that in the first 10 days we collected $24 million.’

Role of data

Vasyuk says that around 2% of IT people went into the army. Around 5% of their IT experts are involved on the cyber front. And 16% of people have relocated to neighbouring countries in Europe. IT Ukraine are monitoring general trends and regularly reporting.

Mental Health

“Mental health is on a spectrum – we can be ill and struggling and well and functioning. It constantly changes which can be exhausting, but it’s also a reminder that things will change for the better again”. Mind UK.

Stigma of mental illness

Stigma of mental illness, a significant public health concern, has long been recognised as a major barrier to the successful treatment and recovery of persons living with mental disorders. Effective interventions need to be implemented to reduce stigma related to these conditions in order to enhance public physical and mental health.

Green IT: A cost or benefit to cybersecurity?

Tony Proctor CITP, Principal Lecturer at the University of Wolverhampton and Emily Proctor, Post-Graduate Student in International Security, discuss whether green IT and cybersecurity can be mutually beneficial.

When asked to do something different in the workplace, there are often objections raised and sometimes, we may be presented with a list of reasons why it might not be a good idea and the negative consequences that are certain to result. For example, in implementing better security, users may tell us that this slows them down and results in them being denied access or produces other hindrances when undertaking their work.

It is reasonable to suggest that there are ‘costs’ in implementing effective security. This is what makes finding and using appropriate security measures so important. But astute security practitioners will highlight security as the enabler of services (for example, the ability to work remotely) rather than trying to enforce an approach where the ‘computer says no’.

So, this leads us into considering whether there is a link between ‘green IT’ and cybersecurity, and what might be the requirements for organisations to ‘do things differently’ in the context of operating more ecologically whilst improving security.

Green IT is the future

The Waste Electrical and Electronic Equipment recycling (WEEE) regulations certainly provide opportunities for not only recovery, reuse and recycling, but also for data sanitisation / destruction as part of an integrated process. Adoption of cloud systems makes for a much better approach ecologically (server utilisation increases from 15% to between 65 – 80%) than running multiple on-premise systems, as does virtualisation.

But there are currently many security concerns raised with respect to widespread cloud adoption. However, a well-secured, shared centralised infrastructure surely offers greater security than dedicated, poorly secured, physically separate systems.

As is frequently the case – the devil is in the detail! What we do know, is that a number of more recent high profile data breaches have affected legacy systems, where organisations were in the process of moving towards zero trust cloud-based architectures (that were unaffected by the breach).

Virtualisation facilitates the operation of different environments on the same hardware systems. This produces a reduction in the hardware requirements and much better utilisation of that hardware.

The challenge is in ensuring that effective monitoring is in place to prevent malware from running amok across virtual machines running on the same physical servers. Virtualisation has allowed more people to work from home, especially during the COVID-19 pandemic, and many firms looking to boost their environmental image are now switching to work-from-home on a more permanent basis.

Environmentalists have offered telecommuting as a green alternative to the traditional commute for a long time, since workers will no longer have to drive carbon-emitting cars or take public transport to work. Though perhaps more beneficial to the environment, it presents some security challenges.

Unlike corporate networks, home networks tend to be less secure and employees can be neglectful in the prompt implementation of updates and security patches. So, one of the main challenges is how we can make work, both more environmentally friendly (and flexible for those who wish to work at home) while still retaining the security of being at the office?

Security systems themselves are also evolving as ‘greener’ products. Unified threat monitoring (UTM) provides multiple security functions from a single server, e.g., firewall, filtering, IPS/IDS, and other functions.

Hence, there are two sides to the question offered in the title of this article: one is to consider any security advantages in moving towards a greener approach to using technology and the other considers how security systems themselves can be greener. (Indeed, the increasing growth of cloud security services may render local security solutions uneconomical).

Consumer is key for both

One of the major challenges to green IT is the paradigm of ‘replace’ rather than ‘repair’ or ‘maintain’ that is the rule of the IT industry. Though there are campaigners attempting to push through ‘right to repair’ legislation in many countries across the globe, the costs of hiring skilled repair workers are still too high for many of the largest tech manufacturers to justify paying out.

The IT industry in general needs to clean up its image here – the desperate downward scramble to produce tech at the lowest possible cost to the manufacturers creates devastating consequences for those affected by the industry, from child labour in precious metal mining, to incredibly low wages on final assembly lines in developing countries.

Consumers want to be able to buy tech at the lowest possible price, and that will always be the case. But for green IT to be successful, consumers need to be made aware of the consequences of cheap tech and why, in the future, we might (and probably should) have to get used to paying more for our new phones. Since questions are now being asked about whether some of the nations that produce the cheapest tech are able to offer appropriate assurance for privacy, there is also another link to security.

For many years, cybersecurity has suffered from a similar problem – antivirus software is expensive, and a lot of people make the argument that ‘there’s nothing important on my device, so why do I need to pay that money to protect it?’ Through educating the masses, cybersecurity has (slowly, but surely) begun to change this attitude.

Green IT can take inspiration from this change and map out its own future on the back of cybersecurity’s success. If more people can understand why replacing damaged or out-of-date technology is harmful and the IT industry can be incentivised to change, green IT can be more successful.

However, success in recycling our technology has implications for cybersecurity. While data may have been deleted by the user, it isn’t forensically removed from the device. So personal and sensitive information can still be discovered on the device.

More widespread secure tech recycling facilities could help solve this issue, creating growth and opportunity for interdisciplinary research between the fields of green IT and cybersecurity. Legislation or consumer demand are strong factors that can effect a change of approach towards both security and green IT within the industry.

Shared objectives

There is a lot to be said in both fields about data storage and what some may deem as taking a more minimalist approach to IT. Environmentalists have, in more recent years, made much of ‘deleting emails to save the planet’, with one energy provider going so far as to claim that if people in the UK sent one less ‘thank you’ email per day, it would save more than 16,400 tonnes of carbon over a year (that’s equivalent to 81,152 flights to Madrid!).

Clearing out data is not only important for green IT but is also key for cybersecurity – quite simply, the more data that is used and stored, the more data there is to be lost, damaged, misused or leaked in a cyber attack. Data storage can be a common ground on which these two fields can collaborate and benefit one another, if they so choose.

A requirement for energy is another common objective shared by both cybersecurity and green IT. Any user of technology or IT professional has a vested interest in this. As we move away from fossil fuels, we need to find new ways to power our digital devices that can be relied upon to provide access to files and data 24/7 (‘availability’ from the CIA. security triad).

Green IT advocates for greater use of renewable energy such as wind, solar, and nuclear energy. This creates another nexus between the two fields and a drive to find better ways to power our devices that can be both renewable, and ultimately reliable.

Conclusion

This article suggests a common thread between green computing and cybersecurity. There are definitely aspects where the two fields can collaborate. However, it may well be that asking whether green IT is ‘a cost or benefit’ to cybersecurity, is the wrong question to ask. There is an ongoing requirement for security to evolve (most changes in technology necessitate review or changes in security).

The reduction of the environmental impact of technology must, ‘just be a good thing to do’. Perhaps returning to an enabling theme, a better question to ask is, ‘How can cybersecurity support green computing?’ It is surely a theme worthy of continued work.

What is good mental health?

Good mental health is not simply the absence of diagnosable mental health problems, although good mental health is likely to help protect against development of many such problems. It is characterised by a person’s ability to fulfil a number of key functions and activities, including:

  • the ability to learn
  • the ability to feel, express and manage a range of positive and negative emotions
  • the ability to form and maintain good relationships with others
  • the ability to cope with and manage change and uncertainty.
  • Let’s take our mental health seriously.