Interview with Sergiy Yakymchuk, CEO of Talsec

It is a very known fact that an average user uses a lot of apps during the day. All of these applications contain a set of data connected with our lives, and their safety is considered crucial. This constant exchange of data is a thrilling target for hackers. Therefore, mobile app security is about defending these apps by implementing advanced, state-of-the-art security measures.

But unfortunately, all these applications are vulnerable since everything is connected to a constant internet connection. This continuous flow of data gives the attackers a chance to get into the process of transitions and get their hands on sensitive information being shared. That’s why the need to monitor these apps constantly is a must when discussing the end user’s security.

Proactive approaches to mobile application security are essential, but there’s only so much you and your team can do. No matter how proficient you are, the software is still the best option to secure your app quickly. In cases like it is best recommended to refer to service providers that are specialized in cyber defense mechanisms.

Our top suggestion for app security software and service providers is Talsec, an innovative company that offers complete security coverage through detection and preventing mechanisms. Talsec implements in-app security shields that could protect your Android or iOS from different malware, even offline.

Since we were very interested in getting to know this cutting-edge company and its people, 4imag got the opportunity to interview Sergiy Yakymchuk – CEO of Talsec, who shared precious information with us based on his yearly experience in the cyber security world.

What is the background history of Talsec?

The roots of Talsec are about ten years of evolution as a mobile security branch within our parent company Monet+. This is 25 years old mobile security vendor in central Europe. We have been working on the mBanking, authentication, and eID apps for quite a long time, and recently (2020), we decided to productize our know-how as a re-usable safety SDK.

Can you give us a bit of description about the App product and its innovative features that make it different in the cyber market today?

Historically, the core technology of Talsec was RASP (Runtime App Self Protection) that we wrapped to SDK. RASP allows apps to actively protect themselves from the different threats in the given execution environment. But at some point, we realized that on top of just protecting the app, it is crucial to let users know that the app issuer made extra efforts to ensure the security of the users. Protect is not enough; you need to visualize and explain security affairs to users.

This is how we came to the CybeTribe app idea. It works today as a Demo of our concept of “User safety intelligence,” where we explain to users the most important security controls, educate them on cyber-hygiene, and provide the possibility to report attacks or scams.

The next versions of the app will also aim at the needs of cyber-security professionals and investigators of the attacks. It will allow them to send the dynamic app link to a victim’s phone, collect diagnostic information from this device and deliver the diagnostics data back to the investigator.

What exciting services and solutions do you offer regarding cyber protection, defense, and detection?

If I had to select one innovative solution from Talsec I would mention AppiCrypt ®. It stands for App Integrity Cryptogram. This technology ensures the app and device integrity and identity for backends. It implements the idea of mobile endpoint protection in the concept of zero trust. Appicrypt is the cryptographic integrity proof of mobile OS and App that can help prevent mobile API abuse and eliminate the intrinsic weakness of standalone RASP protection. Generally speaking, the RASP is always just mitigation of Reverse Engineering risk by just making the Attackers’ job more difficult. Conceptually the attacker is able to cut off the RASP part from the app by tampering. So, it depends mainly on the attackers’ experience, efforts, and resources available to break the RASP protection.

Appicrypt solves similar problems as Device Attestation services. Still, in contrast to such attestation solutions, it doesn’t depend on external web services and doesn’t introduce any risk of outage due to external party service unavailability.

AppiCrypt solves significant security problems that WAF and API gateway solutions cannot address for mobile APIs since they miss endpoint integrity controls. All that can be achieved with minimum integration efforts, and it is pre-integrated with conventional public cloud API gateways.

How open are businesses to investing in cyber security changes and taking new measures to ensure cyber safety?

Generally, businesses are ready to accept security costs. But “necessary minimum” approach is dominating. It is due to the fact that TOP management doesn’t see a direct impact on revenue, and the actual security is not visible to users. We as users don’t choose apps by security factor, right? Is security hidden from us? We in Talsec are keen to change this trend providing the businesses with a clear value from security. We aim to deliver our customers the tools to transform security investments into competitive advantages recognized and visible by their end-users.

Based on your experience so far, working with different businesses, what are some top cyber threats that you have noticed that businesses are facing today?

I would say conceptually; there are two primary types of attack targets for businesses:

• Infiltration into corporate systems
• Attacks on the end-users and client apps

It is nearly impossible to select one or just a few attack technics since the attack vectors are usually multi-step and can include elements of social engineering, reverse engineering, malware, botnets, API-abuse, and many other technics.

I would like to highlight that mobile solutions are becoming a dominant entry point of attacks. Both end-users and employees are inclining using it more and more, while the majority of security solutions were designed for Web browsers or PC world. Due to a quick paradigm shift towards mobile-first, attackers are targeting mobile use-cases, so we shall catch up with mobile security.

What are best practices for today, and how can businesses avoid cyber threats such as ransomware, phishing attacks, etc.?

There is no silver bullet or one piece of advice that fits all businesses. It is important to understand that the security chain’s strength is as strong as its weakest link. Whatever you do, the attackers will keep looking for vulnerabilities (weakest link) and exploit opportunities. If we want to improve the security situation, we need to keep detecting the weakest parts of our security and invest in improvements. At some point, it can educate users and employees about social engineering and scams. Then it can be RASP or other technologies that help to increase the “cost of attack” for cybercriminals.

My generic recommendation is to invest in collecting diagnostic data and tools for processing this information. This diagnostic information becomes especially valuable if labeled with “attack vector information.” It means if we have the “source of truth” data about the attacks, we can efficiently learn from exploits and apply machine learning technics.

What was the most crucial information security lesson you learned in 2022 so far?

My discovery this year is the power of a community of professionals that are keen to help if you are capable of sharing and contributing the global security. I am really excited about the level of mutual support that we provide each other while facing the common enemy. The concept of collective defense has been proven to be efficient over the years. We can all see how it works, for example, how the global security community supports Ukraine to stand the Russian aggression in cyberspace.

What trends do you expect to see in information security in the near future? Would you like to share any cybersecurity forecasts or predictions of your own with our readers?

I believe we will continue to move towards concepts of Apps and Market Places for both mobile and PC. Apps security will continue to grow in importance. Also, I would expect the Flutter community to gain more traction, and more FinTech will bet on this technology (and we are pleased about it since we bet on Flutter from the beginning of our RASP journey).

We will see the institutionalization of security communities and information sharing about attacks. The Open Data approach will continue its evolution.