Quantify the value of Netskope One SSE – Get the 2024 Forrester Total Economic Impact™ study

close
close
  • Why Netskope chevron

    Changing the way networking and security work together.

  • Our Customers chevron

    Netskope serves more than 3,400 customers worldwide including more than 30 of the Fortune 100

  • Our Partners chevron

    We partner with security leaders to help you secure your journey to the cloud.

A Leader in SSE. Now a Leader in Single-Vendor SASE.

Learn why Netskope debuted as a leader in the 2024 Gartner® Magic Quadrant™️ for Single-Vendor Secure Access Service Edge

Get the report
Customer Visionary Spotlights

Read how innovative customers are successfully navigating today’s changing networking & security landscape through the Netskope One platform.

Get the eBook
Customer Visionary Spotlights
Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.

Learn about Netskope Partners
Group of diverse young professionals smiling
Your Network of Tomorrow

Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.

Get the white paper
Your Network of Tomorrow
Netskope Cloud Exchange

The Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.

Learn about Cloud Exchange
Aerial view of a city
  • Security Service Edge chevron

    Protect against advanced and cloud-enabled threats and safeguard data across all vectors.

  • SD-WAN chevron

    Confidently provide secure, high-performance access to every remote user, device, site, and cloud.

  • Secure Access Service Edge chevron

    Netskope One SASE provides a cloud-native, fully-converged and single-vendor SASE solution.

The platform of the future is Netskope

Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), and Private Access for ZTNA built natively into a single solution to help every business on its journey to Secure Access Service Edge (SASE) architecture.

Go to Products Overview
Netskope video
Next Gen SASE Branch is hybrid — connected, secured, and automated

Netskope Next Gen SASE Branch converges Context-Aware SASE Fabric, Zero-Trust Hybrid Security, and SkopeAI-powered Cloud Orchestrator into a unified cloud offering, ushering in a fully modernized branch experience for the borderless enterprise.

Learn about Next Gen SASE Branch
People at the open space office
SASE Architecture For Dummies

Get your complimentary copy of the only guide to SASE design you’ll ever need.

Get the eBook
SASE Architecture For Dummies eBook
Make the move to market-leading cloud security services with minimal latency and high reliability.

Learn about NewEdge
Lighted highway through mountainside switchbacks
Safely enable the use of generative AI applications with application access control, real-time user coaching, and best-in-class data protection.

Learn how we secure generative AI use
Safely Enable ChatGPT and Generative AI
Zero trust solutions for SSE and SASE deployments

Learn about Zero Trust
Boat driving through open sea
Netskope achieves FedRAMP High Authorization

Choose Netskope GovCloud to accelerate your agency’s transformation.

Learn about Netskope GovCloud
Netskope GovCloud
  • Resources chevron

    Learn more about how Netskope can help you secure your journey to the cloud.

  • Blog chevron

    Learn how Netskope enables security and networking transformation through secure access service edge (SASE)

  • Events and Workshops chevron

    Stay ahead of the latest security trends and connect with your peers.

  • Security Defined chevron

    Everything you need to know in our cybersecurity encyclopedia.

Security Visionaries Podcast

A Cyber & Physical Security Playbook
Emily Wearmouth and Ben Morris explore the challenges of protecting international sports events where cybersecurity meets physical security.

Play the podcast Browse all podcasts
A Cyber & Physical Security Playbook, with Ben Morris from World Rugby
Latest Blogs

Read how Netskope can enable the Zero Trust and SASE journey through secure access service edge (SASE) capabilities.

Read the blog
Sunrise and cloudy sky
SASE Week 2024 On-Demand

Learn how to navigate the latest advancements in SASE and zero trust and explore how these frameworks are adapting to address cybersecurity and infrastructure challenges

Explore sessions
SASE Week 2024
What is SASE?

Learn about the future convergence of networking and security tools in today’s cloud dominant business model.

Learn about SASE
  • Company chevron

    We help you stay ahead of cloud, data, and network security challenges.

  • Careers chevron

    Join Netskope's 3,000+ amazing team members building the industry’s leading cloud-native security platform.

  • Customer Solutions chevron

    We are here for you and with you every step of the way, ensuring your success with Netskope.

  • Training and Accreditations chevron

    Netskope training will help you become a cloud security expert.

Supporting sustainability through data security

Netskope is proud to participate in Vision 2045: an initiative aimed to raise awareness on private industry’s role in sustainability.

Find out more
Supporting Sustainability Through Data Security
Help shape the future of cloud security

At Netskope, founders and leaders work shoulder-to-shoulder with their colleagues, even the most renowned experts check their egos at the door, and the best ideas win.

Join the team
Careers at Netskope
Netskope dedicated service and support professionals will ensure you successful deploy and experience the full value of our platform.

Go to Customer Solutions
Netskope Professional Services
Secure your digital transformation journey and make the most of your cloud, web, and private applications with Netskope training.

Learn about Training and Certifications
Group of young professionals working
Post Thumbnail

Security Visionaries is back for 2025, and host Emily Wearmouth is kicking things off with a conversation about the intersection between cyber and physical security when it comes to major events with Ben Morris, Group Head of Cyber Security for World Rugby. In their conversation, Ben and Emily discuss the unique challenges of safeguarding international sports events, where cybersecurity and physical security intersect. From securing stadiums worldwide to collaborating with governments and navigating evolving threat landscapes, Ben offers fascinating insights into the complexities of modern sports security. Additionally, they also discuss how popular culture portrays security and the future of cybersecurity in global sports.

So one of the things that I’m really passionate about is making sure we uplift all of Stadia and all of venues to particular set of standards and using the UK with it’s amplification and it’s connections to go, “Okay, we like these standards from the private sector, from sport, and why don’t we put that into a blueprint.”

—Ben Morris, Group Head of Cyber Security for World Rugby
Ben Morris, Group Head of Cyber Security for World Rugby

 

Timestamps

*00:01 - Introduction*14:56: The shift from temporary setups to sustainable, repeatable security frameworks
*0:45: The complexities of securing diverse physical venues for global events*18:29: Fresh builds vs. legacy infrastructure: Security preferences and challenges
*3:20: Balancing responsibility across dynamic venues*21:12: Staying ahead of the evolving threat landscape through collaboration
*5:47: World Rugby’s role as a standards body for cybersecurity and physical security*24:43: Working with law enforcement and government entities during major events
*8:11: Collaboration with physical security teams and integration of cyber and physical efforts*27:01: Regional differences in hosting global sports events and partnering with local stakeholders
*12:11: What popular culture gets right and wrong about security*29:32: Closing thoughts on the universal language of cybersecurity in sports

 

Other ways to listen:

green plus

On this episode

Ben Morris
Group Head of Cyber Security for World Rugby

chevron

 

Ben Morris, Group Head of Cyber Security for World Rugby

As the Group Head of Cyber Security at World Rugby, Ben leads the direction in protecting one of the world’s most prestigious sports. He oversees cybersecurity across the international federation, global services, and major events like the Rugby World Cup, with expertise spanning the full spectrum of cybersecurity, including safeguarding complex broadcast networks, supporting sponsorship requirements, to the intricacies of physical venue planning.

LinkedIn logo

Emily Wearmouth
Director of International Communications and Content at Netskope

chevron

Emily Wearmouth

Emily Wearmouth is a technology communicator who helps engineers, specialists and tech organisations to communicate more effectively. At Netskope, Emily runs the company’s international communications and content programmes, working with teams across EMEA, LATAM, and APJ. She spends her days unearthing stories and telling them in a way that helps a wide range of audiences to better understand technology options and benefits.

LinkedIn logo

 

Ben Morris, Group Head of Cyber Security for World Rugby

As the Group Head of Cyber Security at World Rugby, Ben leads the direction in protecting one of the world’s most prestigious sports. He oversees cybersecurity across the international federation, global services, and major events like the Rugby World Cup, with expertise spanning the full spectrum of cybersecurity, including safeguarding complex broadcast networks, supporting sponsorship requirements, to the intricacies of physical venue planning.

LinkedIn logo

Emily Wearmouth

Emily Wearmouth is a technology communicator who helps engineers, specialists and tech organisations to communicate more effectively. At Netskope, Emily runs the company’s international communications and content programmes, working with teams across EMEA, LATAM, and APJ. She spends her days unearthing stories and telling them in a way that helps a wide range of audiences to better understand technology options and benefits.

LinkedIn logo

Episode transcript

Open for transcript

0:00:01.6 Emily Wearmouth: Hello and welcome to another edition of the Security Visionaries podcast. Today's episode is an absolute caulker for anyone who's a sports fan or I suppose anyone who likes any sort of physical live event. My guest today is Ben Morris. He is the Group Head of Cybersecurity for World Rugby. And today he's joining me to chat about the intersection of cyber and physical security. So welcome to the podcast, Ben.

0:00:25.5 Ben Morris: Thank you very much for having me and I'm excited to delve into the world, not just of cybersecurity, which obviously I'm gonna be biased, but naturally sport as well and how they interchange with the world that we find ourselves in today. So yeah, very excited to dig into it today.

0:00:38.7 Emily Wearmouth: Excellent. Now if you don't mind, there is so much that I want to ask you about and I know we're on the clock, so can I just dive straight in?

0:00:45.6 Ben Morris: Absolutely, yeah. Keen to.

0:00:47.3 Emily Wearmouth: Brilliant. Alright. So my first question, when we talk about modern security challenges, we very often zoom straight into the lack of consistent physical environment and see it as a problem. We talk a lot about the challenges of remote work, for instance, and I suppose we are doing that. We are harking back to a more straightforward time where physical location was a controlled environment. But I suspect you are gonna tell me that physical environments can add complexity and it doesn't necessarily make life easier. So could you give a quick overview of some of the complexities that are involved when the location itself is a dominant character in your security plans?

0:01:21.7 Ben Morris: Yeah, with the responsibility of World Rugby being a major event organizer, there's so much of a heavy reliance on physical venue and the presence. And unless you have a way of moving a stadium from country to country, that isn't gonna be the case. So the challenge that we face is we have venues we have to secure, we have devices always on the move. We've got local operating companies all across the world. It is a diverse challenge. So how do you provide a secure environment for these physical venues, the coffee shop enthusiasts, all that kind of stuff. And I don't think sport's unique in that challenge, but I think sport has really been forced to think differently around security.

0:02:06.5 Ben Morris: So nowadays when we're talking about organising a major event, we now have to consider all those elements. So it's significantly evolved. I am spending more of my time on the physical security element of the venue more so than anything else nowadays. And with that, the complexities of how do we provide that zero kind of performance hit really robust security and such. So we've had to really evolve our ecosystem and our architecture around Zero Trust cloud first, providing richness when it comes to DLP, but all over the world. So yeah, not an easy topic to digest, but it is significantly involved the complexity of managing major events nowadays.

0:02:51.1 Emily Wearmouth: So I guess for listeners that are less familiar with World Rugby, it's probably worth pointing out, you are not the security lead at Stanford Bridge or I looked up a US Stadium name, so I'm gonna say Michigan Stadium. You are not a security manager at a physical venue like that. You are in charge of security of a sport that travels around the world. And much like something like Formula One rocks up in different cities throughout different tournaments, does that make your job completely different to the people that might be responsible for a specific static sports venue?

0:03:20.4 Ben Morris: It does. It does. And there's a lot of responsibility to building really solid relationships with dedicated venues, such as you mentioned Stanford Bridge as a case and Point. In the UK, we are running the Women's World Cup next year and there's eight to nine venues. We have no responsibility over these venues. We have a contractual agreement in place, but there's no obligation for these venues to go, yeah, we're just gonna let you rebuild our whole network. These venues are multipurpose. So on a Saturday and Sunday, they might run a rugby event. On Monday, they might be running a live concert or they might be running a completely different event. So the challenge that we face as an organisation is how do we instill the standards that we really are looking for as a governing body and a major federation on these venues, but also make it rewarding for the venue to help us on that journey.

0:04:14.8 Ben Morris: The complexity when it comes to the venues, I'm just putting... If I was a venue manager, is I can't build to one set of standards that World Rugby are saying. Also build to standards that maybe a major concert like a Taylor Swift will be staying and we've got a Euros in 2028, maybe UEFA are gonna stipulate some standards as well. We can't just keep building. So what as World Rugby and my role really is required is what are the minimum requirements that are transferable to the venue to other major event organisers. So when we are finished next year in 2025, UEFA can come in and go in, "Oh, they've got all this stuff in place already." And the venue feel comfortable that they can show these standards that we've helped evolve. And that's the responsibility of any major governing body, not just World Rugby, but we're talking about the likes of FIFA and the Olympics and UEFA, NFL, just I could keep naming on the federations, it's our responsibility as a global sport to make sure we uplift the standards of venues, help with that risk versus reward kind of situation when it comes to investments and costs to a venue.

0:05:23.7 Ben Morris: So yeah, that's my role is I am nearly a elevator of standards and I've got my minimum requirements to go, you need to make sure you've got MFA or you need to make sure you secure your devices properly. You train your staff for that instance. It's making sure we're uplifting the whole of sport, not just being really selfish going, you have to follow my standards 'cause that's just not gonna get anybody anywhere.

0:05:46.6 Emily Wearmouth: And so if you become essentially a bit of a standards body or someone that's setting a best practise, how closely are you aligning with other organisations that do that? I'm thinking perhaps governments that also have security standards. Are there some best practices that you take from government regulations or are governments in some respects looking to you for advice on what they should be putting into their national requirements?

0:06:11.7 Ben Morris: It's a bit of both. So naturally the government isn't just beholden to sports or entertainment. They've got a raft of requirements across different sectors. I'm gonna use the UK as a prime case and point. The NCSC, we have a really strong relationship with the NCSC 'cause we recognise that we're playing catch up in venue and stadium and technology's evolving so quickly now it is not at the cutting edge of technology investments. So they also need our feedback and our requirements going as a major event organizer. This is where we are moving the goalposts, and I'm gonna lean onto the cybersecurity aspect here, is there isn't really what I could say a global standard for securing a venue when it comes to cybersecurity. I feel that's gonna significantly evolve over the next four years because historically venues have been a very physical health and safety ecosystem.

0:07:09.9 Ben Morris: And naturally so the safety of fans, safety of players, the welfare of all those elements has always been paramount. So there's a real good process in place already at a national level, not just in the UK. We're talking globally here around that. So there's very strict requirements on physical security. Cybersecurity, as you all know, has changed even just in the last year, nevermind the last 10 years. So the government, and not just in UK, everybody is playing catch up when it comes to cybersecurity requirements. So one of the things that I'm really passionate about is making sure we uplift all of Stadia and all of venues to particular set of standards and using the UK with it's amplification and it's connections to go, "Okay, we like these standards from the private sector, from sport, and why don't we put that into a blueprint."

0:07:57.9 Ben Morris: So when there is a new stadium being created, there's multiple stadiums being built, even just this year, make sure they follow these standards. And then using the same framework and the same auditing procedures that they have around physical safety, why don't we make sure we check cybersecurity as well and trying to mandate and build the maturity in that. So that's how we're working with government just on that side. There's lots of other areas that we do work with government on, but that is a particular one that I am passionate about and really heavily involved in is uplifting the whole of Stadia and using the UK government and it's connections to amplify the message.

0:08:35.1 Emily Wearmouth: And how about, you've talked a little bit there about physical security perhaps being slightly ahead in terms of regulations and what's expected and standards. When push comes to shove and you are looking at a particular event, how are you working with that physical security team? Are they completely separate to you or are you integrated?

0:08:52.7 Ben Morris: There's two separate teams with different, I guess goals and objectives when it comes to a major event. However, if you asked me 10 years ago, I can guarantee they probably had no communications or if any, nowadays you're very much conjoined at the hip when it comes to physical security. It's absolutely essential. So if you think about how interconnected venues are, you have so many touchpoints. You have lots of IoT devices, you have point of sale devices, you have turnstiles, you have HVAC systems, all these are now digital. They're digital connection points. Before you might have just isolated it on it's own. You have maybe a contractor comes into the venue and supports that. That's no longer the case. A lot of these is somebody remote is monitoring on some system. So nowadays as particular World Rugby, we are just one of the same. So we have collaborative working groups regular when it comes to the major events.

0:09:49.9 Ben Morris: So we're working every single, I think it's every fortnight we get together talking about the physical security of the venue, the cybersecurity practices, and how all those interlinked. Because you can have the best physical security system in the world, but if it's exposed from a cybersecurity perspective, it's so vulnerable and now you're hearing horror stories of people turn off turnstiles when it comes to major events. We don't want that. And that's the element that cybersecurity can bleed into physical security. Because if you turn off the turnstiles, you can no longer guarantee the health and safety of not just people outside the venue trying to get in, but the people in the venue as well. So that's just an entry and exit system. Then we're talking about accreditation, making sure the right people are going into a venue at the right time, making sure they have the right access.

0:10:38.4 Ben Morris: What if some compromises that system? So nowadays physical security and cybersecurity kind of just prioritize the same level, which is really, really good. But the challenge that we have in cybersecurity, we don't really have prescripted standards, physical security, they're really well established. They have really strong connections with local government, local police as well. So now when you talk about the working group in World Rugby, you've not just got the cybersecurity and physical security, you've got Metropolitan Police, you've got transportation, you have the home office, DCMS, all of us are in the same call. There's a reason for that. 'Cause it's so interconnected in that instance. So you're completely right. There is no longer a really clear separation when it comes to physical security and cyber. It's kind of one of the same. And you have responsible people in each areas driving their own initiatives, but working in collaboration with each of them.

0:11:32.8 Emily Wearmouth: So my next question is a little bit like hearted. When we first spoke, I frivolously threw out a load of movie and TV show examples. That play with the idea of physical and cybersecurity. We were talking about Ocean's Eleven, Logan Lucky, Prison break, and in fact it was about 24 hours before the UK's Ministry of Justice announced that the prison plans had been leaked on the dark web that I was saying. Well, is prison break a real concern? So I felt very prescient with that. But I wanted to find out, who got it most right do you think in terms of popular culture, where do we find as accurate as we can get to representation of your world in the movies or TV?

0:12:11.5 Ben Morris: Yeah, I remember when we had a brief chat about this one. It is quite interesting because when you look at the dramatization of Ocean's Eleven, there's elements of that which are quite realistic, but a lot of it is quite farfetched. So Ocean's Eleven, I think there's a real good element in that when it comes to social engineering and disguises, it's very easy for somebody to do some reconnaissance of an organisation, what people dress up as, what the security staff dress up as, looking at your accreditation, looking at your key cards and replicating that and trying to find their way into a venue. So Ocean's Eleven, yes, although absolutely wild and farfetched, there is elements of that which is transferable. Then if I think about prison break, similar.

0:12:56.5 Ben Morris: When it comes to the insider fret, do you really know all your staff? How many background checks do you do and the people, can you trust them people? Are they reliable? And that's the same at a major venue. If you are gonna bring in all this steward staff and physical security, can you verify everybody who they say they are? Has somebody cloned somebody else's past and managed to get in? So yes, again, prison break is very dramatized and naturally to make it entertaining. But there is elements to that 'cause you mentioned who really does justice to cybersecurity. When it comes to entertainment, there isn't an outlier. I think I use Mr. Rover, it's probably the main one that I go to because it shows a blend of how much sophistication goes into that initial access piece, how much reconnaissance, how much social engineering, how much can you scrape on a Facebook or a LinkedIn, can you catch about somebody's identity and play around with that?

0:13:52.1 Ben Morris: And then it's the technical ability of transferring all that reconnaissance and intelligence and knowledge of an environment and then building it into technical. So yes, it is all very dramatized and I can say with a high degree of certainty, Prison Break, Ocean's Eleven and such, there's probably 95% of it, which is farfetched, but there is that 5%, which is quite accurate. And it's an area which also cybersecurity professionals keeps us up at night because it's the what ifs and stuff like that.

0:14:23.3 Emily Wearmouth: Well, thank you for letting me ask that one. I'll move to a more serious question, my next one, which is that, when you think about things like the rugby World Cup, the football World Cup, the Olympics, these four year cycles seem to come in a lot. I don't know why four years. But I was wondering when you are working on these four year cycles, sort of decamp and then strike everything anew for the next one, or do you have to come up with whole new security approach for every World Cup? Or do you have continuity of teams and processes? How do you build that as a long-term approach?

0:14:56.3 Ben Morris: So I think if you're gonna ask me this question four years ago, it was very much a build it, tear it down, start again approach. And that's not just a unique thing for World Rugby. Everybody's did that. You've probably all heard the stories of the Olympics where they go to a host nation, they build all the infrastructure, run the event, and off they go to the next one. Nowadays, that's just not a sustainable model. For all the federation, sustainability and reuse is one of the key objectives for us. And what we recognise is during that four year cycle, we tie up our time in other areas, refining that framework. Refining that blueprint. So for example, World Rugby, we probably work off more two year cycles. So every four years we have a men's World Cup, then we have a Women's World Cup two years later.

0:15:42.3 Ben Morris: So it's more like two years cycles. But now, with governing bodies, we have events during those, I'd say quiet years. So that really refines that blueprint. When we go to a host nation now, we have a list of frameworks. So at World Rugby we have 45, I think it is frameworks that we have developed over this period of time. I think World Rugby is going for 137 years, so we're pretty decent at it now when it comes to gonna a host nation, we've got a major event and okay, these are the things that we need to do. The reason why it's in kind of four year cycles, 'cause there's a lot of preparation and planning that needs to go into major events. And this is the sustainability piece is you can't do that with temporary staff that are coming in, coming out. So World Rugby is hiring specialist teams.

0:16:33.5 Ben Morris: I was part of that specialist team when World Rugby decided that we want to run the major events ourselves. Instead of putting that responsibility on the host nation, World Rugby will do it ourselves. And FIFA's now taken that model and the Olympics has taken that model where it's like we'll have a permanent members of staff that are responsible for these frameworks that will then standardize it and the repeatability of it. And that's why we wanna use existing venues and Stadias because it's very hard to do that repeatable model when you're building stuff constantly. So now actually we go to host nations where they've got the infrastructure set up, they've done this before. So now it's all about the organisation of the major event, not thinking about the infrastructure and the transportation and such. So the whole, this is all across sport. It's become a much more sustainable and reusable for that reason, which is good for me because we can iterate upon that blueprint over time.

0:17:26.8 Ben Morris: So we're gonna learn a lot from 2025, so then for the Men's World Cup in 2027 in Australia, we've picked up some lessons learned. We said this worked really well, this didn't, and then we can refine it over time. By the time I think the World Cup is 2031 in the US, that model would've been refined for 10 years and it keeps us on the cutting edge when it comes to emerging technology, emerging threats. So it's really, that's where all of the governing bodies and major event organisers now go in, is that refinement, blueprint model, standardization and repeatability.

0:18:03.1 Emily Wearmouth: So if you compare a recent football World Cup, which went to a market where a lot of stadiums were built especially, and that was why they wanted the World Cup, is to build their infrastructure with something like the most recent Olympics where it was all about reusing venues, which of them would you prefer to be in charge of the security for a complete fresh build or having to grapple with some legacy challenges, but infrastructure that's already there?

0:18:29.0 Ben Morris: From a purely cyber perspective, I would love to build new 'cause you can bring in the latest technology, you can make sure it's designed by security by design effectively. I would prefer that personally. However, when it comes to major events, cybersecurity is only a small fraction of the overall picture when it comes to a major event. So me as a sports enthusiast and a fan, and you mentioned F1, massive fan. Football, rugby, all that kind of stuff. As a fan, I think it's not scalable and it's not healthy for regions where they build all these venues, use it once, and then it just ages. You've seen the ones in the Olympics, and I think it's a horrible state of affairs. So actually as a fan, I prefer the reuse model. It's more challenging as a cyber professional because you've got this age and infrastructure that you need to modernize.

0:19:16.8 Ben Morris: But that's part of the role that you take on really. So yeah, it's like a 50/50. I'm torn between, oh, I'd love it. Like a fresh rebuild. I build everything from scratch. Like I'm gonna use White Heart Lane, Tottenham's new stadium. They've built everything from the ground up. It's all modernized. The greatest technology that would be brilliant to be on the ground up to build things based on proper standards, but it's not reusable, especially for a major event where it changes it's geographical location every four years. That's just not the way the world works. So as a fan, I actually prefer the model, which is go to a country, use the physical infrastructure that's there, modernize it to a certain extent so it can keep getting reused. We might go back in eight years, 10 years, 12 years, whatever it may be. The one thing that people maybe don't understand when it comes to sport is all of the federations work very closely with each other for that reason.

0:20:07.1 Ben Morris: So we might run a major event in the US in 2031. We might use a lot of the venues that FIFA's using for 2026. And the reason for that is because the reusing of things, we have a degree of confidence going, "Oh, the FIFA World Cup was in these stadiums." So it must be able to run our stuff and vice versa. Same with the Olympics. So we're trying to uplift the overall sport in that degree. So yeah, a long way to answer your question. But yeah, I think I prefer the reuse model just because of that reason. We uplifting the existing infrastructure. I think it also modernizes the local area, the people who live there, the citizens, the public. So there's lots of reasons why I think that model is the way to go.

0:20:47.1 Emily Wearmouth: I knew that would be a tough question when I asked it. I thought you'd be tall. [laughter] Okay. I'm gonna ask you about the threat landscape because obviously you are dealing with the big bad world of some pretty major threats when you are putting on a huge sporting tournament. And I wondered how do you keep up, how do you personally as well as organizationally, keep up with that evolution of the threats landscape and then how, if at all, does it impact your plans?

0:21:12.9 Ben Morris: Right. Yeah. So there's multiple strands of this. I'm gonna talk more locally right now and then I'll go into more nation state. So locally, when it comes to the way I gather threat intelligence and is through my networking key partners. So we have a lot of strategic investment with technology partners who work for us on that regard. 'Cause we're only a small team at World Rugby, there's no way we'll be able to cover the whole freight landscape in any practical way. And digesting that intelligence is just gonna be too difficult. So work with key partners across different specializations. So as an example, we might work with like an AWS to give us intelligence around the cloud and what they're seeing. They might work with, for example, Netskope in regards to what we're seeing on the networking front from a globalization piece. So we work with key partners when it comes to local intelligence that might affect our infrastructure.

0:22:05.5 Ben Morris: Then there's other industry peers. So I mentioned just a second ago around our work in collaboration with the federations. We share intelligence with each other 'cause most likely the threats that are gonna be targeting us or targeting the Olympics are gonna be exactly the same. So we share intelligence that way. We have a working group already between all of the federations sharing that intelligence from cybersecurity. And stuff that we mentioned this year around the Olympics. We had the intelligence from that event that we have reused and made sure to address part of our plans and the intelligence we have in the Olympics as will be shared with FIFA. So there's the pay level threat intelligence, and then there's more the national or nation threat intelligence. And that's where our collaboration with NCSC is so important. We don't have the connections when it comes to nation state and what's going on in that ecosystem.

0:22:58.2 Ben Morris: So we have to work with the NCSC to understand are we gonna be a target for nation state and can you support us and give us the intelligence we need to make sure we're best prepared? So a lot of the time when it comes to a major event in a country, you'll work with that cybersecurity specialist, the NCSC. In this example, you'll generate a FRET report for the event and then you'll get the findings from that going, the most likely credible source is gonna be X and this is what they're gonna use. And this is the response plan and this is what you need to consider. So that's how we... On those three pronged approach, you've got local with key partners, you've got more federation level with peers, and then you've got more nation state, which is the local government at the time.

0:23:41.4 Ben Morris: And all three of those areas give you a clear picture going what is the threat landscape right now? And that changes all the time. And that's the interesting and challenging and stressful part of cybersecurity is in the UK. Okay, you are gonna be a target, 'cause you are one of the five eyes. So you're gonna get a number of targets. Activism is very big right now, so these are the areas that are most likely gonna affect you in the UK. Then we are moving our major events to Australia. So that's gonna change again, and then we're moving again to US after that. So the threat is changing every single year. So it's an area that you have to invest a lot of time into building those threat intelligence communities. And that's what I'd advise to listeners. If you haven't set that threat intelligence, think of those three levels, to try and help you. And that's what works for me and it's pretty, extremely invaluable. Explaining the threats to the board, articulating the risk and the probability of those risks being material, and then the investments that you need to make as a cyber professional to prevent and reduce the impact of disruption at a major event.

0:24:43.0 Emily Wearmouth: And it is just got me thinking, when you are dealing with putting in place your plans for if something went wrong, do your plans involve things like the military? If you're dealing with a huge event, would the police and the military feature in your mitigation plans?

0:24:56.8 Ben Morris: The police. Big time.

0:24:58.3 Emily Wearmouth: Wow.

0:24:58.9 Ben Morris: So out of all the eight venues, there's a massive police presence. Their presence in our block, which is the main operating centre, they're present throughout. The police, are a crucial part of any major event in a country. And that's not just the UK that is globally, they have to be involved and very early does, especially when it comes to funding and preparation. The police don't have an infinite amount as of funds. They also don't have an infinite amount of operational staff. So the further that they understand that a major event will happen. Usually it's part of the bidding process for a major event. They would be consulted as part of the bidding process for a major event going, what is the police availability for that year?

0:25:35.9 Ben Morris: And part of that preparation also involves the home office where they coordinate that and they usually allocate a commissioner to help work with the planning side of things. So police is absolutely crucial. They're involved throughout the whole process. Military is a bit of a strange one. So if there is a major event and there might be a strike or there might be something which impacts the local police stability to protect the public, it's a very rare circumstances that would happen. Usually they'd have volunteers from other counties coming in to support that bandwidth. I have not been in instance where the military has been drafted in, but I understand in the past for other events that they have been, I think for the UK government to bring in the military, it's worst case scenario.

0:26:18.4 Ben Morris: They haven't got the staff, they haven't got the police available, and then, or maybe the stewards in the ground. There isn't that private support from companies to support that. So there's multiple decision points, and that comes down to the home office. The home office are the final people who have that say, and it's based on the ground operational risks to the public and fans and the organisation of the major events. So yeah, fortunately the military less, so police absolutely. They're crucial part of this process.

0:26:47.3 Emily Wearmouth: Brilliant. And then my last question is, you travel around the world. Do you see any significant differences in the way different countries approach events like yours and want to partner with you for the events that you host?

0:27:01.4 Ben Morris: Yeah, I think when it comes to organising major events across the globe, each region has it's own degree of maturity. When it comes to cybersecurity, just in my world, some are much more mature and it's a considered standard. I think North America is the blueprint right now, and I think they're fortunate where a lot of their venues and stadiums have been built from the ground up with this in mind. I think Europe is very strong when it comes to it's standards and its practicalities. I mentioned the auditing process around physical security, so we're very, very strong, but there is much more investment needed when it comes to cyber. APAC, I feel like is growing for rugby, for example, we are seeing the biggest growth in rugby in Asia right now. Which is, when I say that to people, it's like, wow, really? But yeah, Japan and those regions, it's huge right now.

0:27:49.4 Ben Morris: And we're seeing massive investments in stadiums 'cause they don't really have the infrastructure to maintain a major event and they really would like to at some point. So that's the first side is the infrastructure and the set up to run a major event. It's been very much focused on North America and central Europe. That's been the defacto for a very, very long time. I think there's opportunities really with other regions where they might not have run a major event before. So they're building our own infrastructure to really modernize. But the main difference is culturally and how much support the local country is willing to give a major event. The enthusiasm for a major event is the same. The challenge is when it comes to the infrastructure and the maturity of that country around a major event is different. And that's where my role comes into it to build those blueprints. And that's why as governing bodies, we need to help uplift for the next major event. And that's how things have been transferable, but nothing from a cultural perspective, I would say changes. It's just a challenge when it comes to maturity of the infrastructure.

0:28:50.2 Emily Wearmouth: So sport is an international universal language, and so is cybersecurity?

0:28:55.0 Ben Morris: Well, yeah, I'd say so. At the different stages of common language, and I think watch this space over the next couple of years. I reckon sport is gonna be the ones where we really uplift. And I think that the reason for that is just the transferability and the sustainability of the game. And it's been now globally recognised, not just in sport, but most sectors, that cybersecurity is one of the biggest risks that's gonna be targeting us. And I think with that, it's now being recognised as one of those areas that we need to focus on. So yeah, it is a transferable language, less so in other regions than others, but I'm sure that will change.

0:29:32.5 Emily Wearmouth: Brilliant. Well, Ben, this has been absolutely fascinating. Honestly, I could talk to you for ages about this and my sister is a massive rugby fan, so with this episode, we're picking up at least one more listener, so she's gonna love this conversation as well. It's a win. [laughter] Thank you very much for giving me your time.

0:29:51.3 Ben Morris: Thank you very much for having me, and hopefully your listeners have learned a little bit more about sports and cybersecurity and interchangeability. But yeah, pleasure to talk today and looking forward to many more in the future.

0:30:01.0 Emily Wearmouth: Brilliant. Thanks, Ben. You have been listening to the Security Visionaries podcast and I've been your host, Emily Wearmouth. If you enjoyed this episode and you definitely enjoyed this episode, please do share it. Make sure to follow us on your favourite podcast platform and then you'll make sure that you never miss an episode. We'll catch you next time.

Subscribe to the future of security transformation

By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.