Vasil Kanev
Eco-Cybersecurity Expert
Securing environmental data for a sustainable future.
Focus Areas
- Cybersecurity policies & regulations
- Data security: transfer, archiving & backup
- Critical infrastructure protection
- ESG & trusted environmental data
- Public communication & awareness
Biography
I hold a Master’s degree from the University of Chemical Technology and Metallurgy (UCTM), where my diploma thesis focused on developing software solutions to optimize foundry operations – an early example of applying IT to industrial challenges.
My career started in 2001, when I managed a small internet services company in Sofia, operating two internet clubs and providing broadband access in the ‘Strelbishte’ district. Between 2003 and 2007, I worked at the Bulgarian National Television (BNT) as a system administrator, responsible for the broadcaster’s antivirus protection and also leading the development of several online platforms, including the Sports Directorate website and a national flood monitoring portal.
From 2007 to 2009, I combined entrepreneurship with media work as manager of a real estate agency and host of the IT television show Stay Updated on Eurocom TV. From 2009 to 2019, I served as a broadcast system administrator at bTV, where I managed the station’s on-air monitoring systems.
In 2019, I joined the Bulgarian company SoftGroup, supporting its specialized hardware and software solutions for the pharmaceutical industry. Since 2022 I have held the position of cybersecurity expert at the Ministry of Environment and Water, where I focus on monitoring digital risks, securing environmental data infrastructures, and contributing to policy frameworks for sustainable and resilient IT systems.
Alongside my professional path, I have been active in writing and public initiatives. I have published analytical articles such as The Future of Cryptocurrencies, Crypto Boom and Hallucinations of Artificial Intelligence. I am the founder of the Environmental Protection Club within the Bulgarian Libertarian Society.
Over the years, I have organized events that connect environmental causes with civic action, including the conference Protecting the Environment through Free Market Tools, a charity concert in defense of the Karadere coastal area, and a fundraising concert For the Greens.
I am a member of the Interdepartmental Council on Cybersecurity under the Ministry of E-Governance, as well as a member of the working group for the development of the National Cybersecurity Strategy. I am also a member of NPO “AI Institute” and the Bulgarian organization of cyber specialists – CyberClub.
Resources
Curated resources that explain key concepts and connect cybersecurity with sustainability. Click Read more to explore details and external references
Basics
What is Eco-Cybersecurity?
How security practices impact the environment: energy use, hardware lifecycle, and sustainable approaches.
Read more
• Key metrics: energy consumption, emissions, asset lifespan.
• Typical trade-offs: stronger encryption/logging vs. higher resource use.
• Balanced approach: align security goals with minimal footprint.
• Resource:
IT Footprint
Scope 1/2/3, embodied carbon, and metrics such as PUE/CUE for data centers and networks.
Read more
• Scope 1/2/3 with IT-specific examples (offices, data centers, suppliers).
• Embodied carbon in laptops and servers.
• Quick orientation: PUE and CUE indicators.
• Resource:
Security vs. Sustainability
How to balance security controls with energy efficiency.
Read more
• Risk-based approach: prioritize critical controls.
• Log “noise” = more storage, less visibility.
• Optimize scans and telemetry.
• Resource:
Standards & Policy
NIS2 Essentials
EU cybersecurity directive requirements on risk management, incident reporting, and supply-chain security.
Read more
• Core obligations: risk management measures, incident reporting timelines, supplier oversight.
• Impact: governance, roles, and accountability for essential & important entities.
• Practical start: gap assessment, KPIs, supplier questionnaire.
• Resource:
CSRD & ESG for IT
How corporate sustainability reporting (CSRD) touches IT: data collection, emissions, controls, and evidence.
Read more
• What to track: IT energy, storage/log retention, data center regions, device lifecycle.
• Evidence: policies, logs, inventories, supplier attestations.
• Link with security: controls that also reduce footprint (log strategy, lifecycle policies).
Resource:
ISO/IEC 27001 ↔ Sustainability
Where ISMS controls support sustainable processes: asset lifecycle, logging/retention, and supplier management.
Read more
• Asset inventory & lifecycle: extend device life with secure configuration and tracking.
• Logging: right-sizing retention/verbosity; rotation, compression, archives.
• Suppliers: integrate security + sustainability in due diligence.
• Resource:
Tools & Checklists
Green-Security Checklist
15 practical points to balance security controls with energy impact.
Read more
- Use hardware-accelerated crypto (AES-NI, ARMv8 Crypto).
- Offload TLS where safe (smart-NICs) to reduce CPU per connection.
- Right-size endpoint agents; disable unused modules & tune sleep intervals.
- Schedule vulnerability scans/patching in low-load windows.
- Log strategy: “signal over noise”; tier events and sample noisy sources.
- Retention by class; rotate, compress, and archive to cold storage.
- Lifecycle governance: auto-delete stale snapshots/backups/temp logs.
- Kill orphaned cloud resources and zombie accounts/keys.
- Auto-shutdown dev/test out-of-hours; prefer scale-to-zero where possible.
- Prefer managed/serverless security services for elastic efficiency.
- Network segmentation / Zero Trust to limit unnecessary east-west traffic.
- Use CDN/WAF at the edge to cut backhaul securely.
- Choose regions/providers with transparent PUE/CUE & lower carbon intensity (where compliant).
- Endpoint policy: power plans, Wake-on-LAN, coordinated patch windows; extend device life.
- Track KPIs monthly: scan CPU time, log GB per user/session, cost per protected workload, asset lifespan.
External guide:
Vendor Assessment
Quick due-diligence topics for cloud and on-prem suppliers
Read more
- Energy & regions: do they disclose energy mix, PUE/CUE, and carbon intensity for chosen regions?
- Data lifecycle: retention, deletion timelines, backups/snapshots, data location & legal basis.
- Logging & monitoring: retention policy, access controls, audit logs available to customers?
- Incidents & SLAs: notification windows, evidence sharing, RTO/RPO and playbooks.
- Encryption: in transit/at rest, KMS ownership (customer-managed keys?), HSM options, hardware acceleration.
- Identity & access: MFA, least-privilege, key/secret rotation, review of third-party access.
- Secure development: patch cadence, vulnerability disclosure, SBOM for critical components.
- Sub-processors: list available, change notifications, tiering of critical suppliers.
- End-of-life: certified sanitization/disposal, recycler certificates, chain of custody.
- Assurance & ESG: ISO/IEC 27001 or SOC 2; sustainability attestations (Scope 2/3 claims, ISO 14001).
External guide:
Secure Disposal SOP
Safe data sanitization with environmentally responsible end-of-life.
Read more
- Classify asset sensitivity → choose method (crypto erase, overwrite, physical).
- Record: serials, method, date, operator; keep recycler certificate.
- Use licensed partners; comply with local e-waste rules.
- Sample verification & dual sign-off (Security + Sustainability).
Resource:
Case Studies
Data Center Hardening with Lower PUE
Security hardening + telemetry tuning to reduce energy while maintaining protection.
Read more
- Baseline first: PUE, kWh/day, CPU/memory utilization, cooling setpoints, TLS offload presence.
- Hardening with efficiency: firmware/BIOS updates; enable CPU power states; prefer hardware crypto (AES-NI/ARMv8); tune IDS/IPS sampling rates.
- Scheduling: patching/scans in low-load windows; batch jobs to reduce peaks.
- Network: micro-segmentation/Zero Trust to cut unnecessary east-west traffic.
- Telemetry: keep high-value metrics; lower verbose debug outside incidents.
- Measure after: compare PUE, kWh/day, average CPU per secured connection, and incident MTTR.
Resources:
Log Strategy: Signal over Noise
Reduce noisy logs to save storage and improve detection quality.
Read more
- Classify events: security-critical, operational, debug. Turn off verbose debug in prod.
- Retention tiers: critical (longest), operational (medium), debug (short). Rotate + compress.
- Sampling: throttle high-volume sources (e.g., auth successes, health pings).
- Storage: hot vs. warm vs. cold; move aging data automatically.
- Dashboards & alerts: focus on high-signal rules; review false positives weekly.
- Metrics: GB/day, alerts/week, false-positive rate, time-to-investigate.
Resources:
Secure BYOD with Longer Device Life
Policies that extend device lifespan without compromising security.
Read more
- MDM baseline: screen lock, encryption, remote wipe, OS version guardrails.
- Health checks: posture before access; restrict risky builds/extensions.
- Power & updates: coordinated patch windows; battery-friendly policies; replace parts when feasible.
- Access: per-app VPN and conditional access to limit exposure.
- Lifecycle: secure wipe at hand-off; refurbish or recycle with certified partners.
- Success metrics: device life (months), incidents per 100 devices, support tickets.
Resources:
Glossary
- Eco-Cybersecurity
- Aligning security controls with sustainable IT practices across the full lifecycle.
- PUE (Power Usage Effectiveness)
- Ratio of total facility energy to IT equipment energy; lower is better.
- CUE (Carbon Usage Effectiveness)
- Carbon emissions per unit of IT energy use; helps compare data center footprints.
- Embodied Carbon
- Upstream emissions from manufacturing, transport, and assembly of hardware.
- Scope 1/2/3
- Direct emissions / purchased energy / value-chain emissions (suppliers, use, EoL).
- Zero Trust
- “Never trust, always verify” access model; reduces unnecessary network exposure.
- Supply-Chain Security
- Managing risk from vendors, sub-processors, software deps, and firmware.
- Shared Responsibility Model
- Cloud split of duties between provider and customer for security & compliance.
- ISCM (Continuous Monitoring)
- Ongoing visibility of security posture and drift to cut risk and noise.
- SBOM
- Software Bill of Materials—inventory of components to manage vulnerabilities.
- Secure Disposal
- Media sanitization and environmentally responsible end-of-life handling.
- Right to Repair
- Policies and availability of parts/tools that extend device lifespan responsibly.
