Jibran Ilyas || International zoom Webinar | Cyberspace: The Future territory of National Security

Mr. Jibran Ilyas. He's the Director of Incident Response at FireEye Mandiant and an Adjunct Professor at Northwestern University. Mr. Jibran was awarded with Crain's 40 Under 40 in 2017 for his extraordinary contributions in the realm of cybersecurity. He brings over 15 years of experience in the field of information security with 12 years specializing in the area of incident response, digital forensics, and threat intelligence. Today, he continues to contribute to the development of policies and procedures of securing cyberspace with an added focus on incident response and threat intelligence initiatives. Today his topic of speech will be national strategies and capacity building for cybersecurity. A very warm welcome, Mr. Jibran. The stage is yours now.

All right, so thank you so much, Aris. I appreciate it. So I will share a presentation, if that is okay. And then, so I understand I have 15 minutes, but I do want to leave room for some Q&A. So please, I encourage questions at the end of my short video here. All right, so let me know if you can see my screen. Are you able to see the slide deck, Luis?

Yes, sure. Yeah, okay, it's visible.

Excellent. First of all, thank you for inviting me here. It's an honor to be speaking among such esteemed panelists and speakers here. Thank you so much. So always thank you for giving a short intro. I won't take too much time here on this one, but just one thing that I wanted to mention is incident response. The lecture, or just 5 to 10 minutes that I'm going to speak, it's going to be from the vantage point of incident response because that is where I spent 13 years of my life. So there will be a lot of technical information in here. So if you have questions, I really welcome at the end of my session to ask questions on those technical things. I really want this to be— I want to share as much as possible right from the trenches. The importance of sharing what I know, I believe, is because I get to see the incidents firsthand. Like a lot of— when I wasn't an incident responder, I would see the incident news on, you know, these publications or news sites. I can tell you that by the time it makes to the news sites, it's already filtered. It's not the, you know, the alpha information. So that is what something that I want to share in this presentation. So I was listening to Dr. Aftab Rizvi. A lot of the things that I wanted to speak about on national strategy were covered, so I won't dive too deep in that because you've listened to some of them already. So, thank you there. And— but I do want to highlight these 5. We really— I think the first and foremost thing, we need ownership and stakeholders defined. So, Dr. Aftab was talking about, you know, figure out what the assets are, define the stakeholders, and going with that. I can't agree more. I think this is a very, very key point because without it, we're going to be all over the place. And the danger there is that nobody will have one, you know, the comprehensive picture. Everybody will have a piece of it, and this is not how cybersecurity works, especially for a nation. You need one central command, and I think once we have that, things are going to be easier for us. So number 2 is threat awareness, and I'm going to cover this in detail just right after this slide. So I think the, the really important thing is understanding what's— what are the capabilities. Like, for example, in traditional warfare, if people didn't know that there's, you know, these air Air Force and they can come bomb you, you wouldn't even be prepared for that, right? If you didn't know about advanced weapons, you would not be prepared for that. So just like that in cyber, you have to be fully aware of what are the capabilities, and not just the capabilities, but the capabilities of different kinds of threat actors. There is a certain scale, and I think that, that's one thing that I'm going to cover in the next slide. So The next point, because there's digitization whether we like it or not, you know, for many years I did— I would hear in our country that, you know, our assets are safe because they're not online. So that was— that won't go a long way because everybody that you and me know, we all see smartphones in our hands, right? So a lot of our data is digitized already. And I think what we— like, I'll give you an example. A lot of people think this email and WhatsApp, they're just communication tools. That's kind of like the common belief, right? But if you think about it, email, especially email, is also our document repository because that's how we exchange files. And now WhatsApp even allows file exchange. And there's voice notes and there's data there, right? So it's— these are not just communication tools. These are document repositories for a lot of critical data. So we can't— we can no longer say that, okay, we've got our assets offline in air-gapped systems because there are— we do talk about those things in our comms channel. So WhatsApp, email being one of those. And another thing I would say about digitization and impact awareness, I know you folks might have heard a lot about security awareness. I like to say impact awareness for a reason. So what do I mean by impact awareness? Security awareness is like, okay, you keep a strong password, you do multi-factor authentication on your Gmail or Facebook or whatever other online account that you wanna secure. But if you think about it, you know, all these things we've been saying for at least, you know, 10, 12 years, but are we really seeing mass adoption? So I think one thing that we need to change when we, as cyber experts, when we're talking about cyber, we don't just talk about what needs to be done, but we talk about its impact to that person whom we're preaching to. So give you an interesting example of some analogy, but I was born and raised in Karachi. So there would be times when people will tell us, okay, ये मोबाइल आप लेके जा रहे हो इस गली में मत जाना क्योंकि छीन जाएगा। तो अपनी सेफ्टी फिर आपको खुद समझ आ जाती है कि यार ये वाला इस गली में मैं जा रहा हूँ या इस इलाके में मैं जा रहा हूँ तो फिर मैं ये वाला मोबाइल हाथ में रखता हूँ, दूसरा वाला मैं छोड़ के आता हूँ। तो जो पॉइंट मैं कहना चाह रहा हूँ, बहुत सिंपल तरीके से कन्वेंट करना चाह रहा हूँ कि बिकॉज़ मुझे इम्पैक्ट पता था उसका, तो उस मैंने अपनी सेफ्टी फिर अपने हाथ में भी दी, अपना यानि कि अपनी ज We apply, we make sure that our examples hit home. Because if they're not going to impact or people don't understand the impact of what we're trying to preach, they're not going to do it. And I think we have an advantage. Our population is mostly youth and they are heavily digitized. You know, look at a 4-year-old with like the way they operate the iPads. Even, you know, my parents can't operate at that level. So I think that, that is where we need to do a really, really solid job. But at the end, I will tell you, we have the advantage because we can do this better than other countries out there. So the next point, research and development. I say this because we use a lot of technology from the West, and even that threat intelligence point later on. And I see Farooq Nair, so he's like the master of threat intel, so he will tell you a little bit about why threat intelligence matters. But my point is, we use the products from the West, but we also use the intelligence, the threat intel from the West. So I think there's a need for curating local threat intelligence that we understand what threat actors are after us in our country. And you know, then we create our defenses according to that. That research development, I know it takes time, but I have seen a lot of really good initiatives in Pakistan. There is going to be a time when we will have our own platforms, but I think we need to keep encouraging that trend because that— So from the threat awareness point of view, really want to share this quickly. It's what we're seeing out there when we're responding to incidents and the biggest incidents in the world, quite frankly. It's basically a who, not a what. What I mean by that is that there is a human at the keyboard at the other end. You know, back in the days you would hear about, okay, this is a Melissa worm or MySQL worm. It just comes in and it just propagates. These days it's quite the opposite. Back in the days, the hackers wanted to attack for glory. They wanted to destruct and they wanted to be you know, that's how they would gain notoriety in news, that this malware destroyed this many computers. Now it's more like slow and steady wins the race, and they only target specific computers that they need the data from or they want to sniff communications from. So they're very professional, well organized, and well funded. Dr. Aftab talked about both cybercrime groups and nation-states, which I'm going to get to in a bit. So the sophistication is, is quite high. So And they basically have a goal, and until they achieve that goal, they keep trying. So they're persistent as well. Talking about persistence, if you kick them out, they will return. Look at it this way. So I'll give you an example. If somebody needs credit card data to steal, they could go to Metro Cash and Carry, and they— or they could go to Imtiaz, you know, store chains, right? They will get that same data. I mean, not same, similar data, but if they want credit cards, they can get credit cards from one business or the other. But think about this: if a threat actor has a goal, if they need to get data from say Boeing, and Boeing has really good security, they're not going to go to Lockheed Martin and say, look, I got you this, you know, space— the design of this aircraft. They're, you know, the people who tasked them for it, they'll say, no, no, no, we asked you to get Boeing designs, not Lockheed Martin. So the point is that they have a goal, and until they reach their goal, they'll keep trying. So we need to really understand that, and especially in the context of critical infrastructure. So because critical infrastructure, we need to have really good defense in depth. Okay. So I'll— I've spoken about most of this. I usually merge the criminals and organized crime in a bucket, and then Insiders, you know, the people who have access, but the most important kind is this state-sponsored threats because they're the ones who can get sophisticated at will. They have, you know, malware version 1, version 2. It depends on what kind of organization they're going into. And then I want to connect this back with my earlier slide where I said that there's a human behind the keyboard at the other end. So most of the times, I don't know how many of you play chess, but when we're doing incident response, it is a chess game. It's, you know, we, before making a move, we try to think that, okay, we're trying to basically think, you know, 7, 8, 10 moves in advance because we want to understand, we want to anticipate what the attacker is going to do. Because if you remediate too quick, you can actually lose out visibility of the attackers in the environment. So we basically like to understand the scope and then basically predict what the attackers might do in reaction. So with that, I'll talk about capacity building and then we'll move to Q&A. So capacity building, the first and foremost, I— what I see when I visit Pakistan and when I talk to people, there's a lot of focus on tools that, hey, I know how to use this tool, I've done a certified ethical hacking course, I have done this bug bounty and I'm able to hack. Or sometimes the questions, very candidly, when we talk about security, the question is, can you hack Facebook? Can you hack Gmail? So I think we need to shift that focus to teaching people fundamentals of computing rather than diving right into the offense or defense for that matter. Because if you understand the fundamentals of computing, you can do either or. You can attack, you can defend, because you know the ins and outs of those— the operating system. So. When I say fundamentals, what I mean to say is that learn Windows and Linux and Mac. You know, that should be the baseline. If you learn that technology really well, then, you know, that should be the base, not like, okay, I know how to use Nmap or Nessus or some other pen test tool. So, so I think that's, that's, that's, that's priority number one. Number two, we need to encourage innovation. And I say this not for products mainly, but like process as well. So Dr. Afdal talked about like people's process and technology. So technology is just one piece. You know, if you have an innovation on people or process part, that is also very, very good. Number three is very dear to my heart. I Really, you know, in my life, and, you know, I've studied until I've got a graduate degree, one thing that I enjoyed the most, or what I remember the most out of my schooling, is, you know, the teachers. And I know that there are good teachers, better teachers, and best teachers. So what I'm trying to say here is that the teachers who are interactive, the teachers who are you know, would do this with full passion. I think most teachers do. I think we really need to incentivize those teachers because cyber is a really, really hot field right now. And teachers don't get paid that well. So I think what we're dealing with is that there are not enough good instructors out there to teach our young, you know, to our youth so that they learn the best from the best. So because the cyber industry is paying really well, everybody is moving to commercial or commercial side of things. So that is my plea, my wish. I wish something could be done there. So that is very, very important, the importance, the need of good instructors. Number 4, the practical experience. So, and number 5 and 4 kind of go together because I always hear that because there's not a lot of incident response cases, we don't get to work on the big stuff. But if you have a mentor in other country or another region, you can work pro bono on some of the cases with them and, you know, get some real-life experience. There shouldn't be an excuse to not getting practical experience. I will also share this point that, you know, in 2020, there are a lot of challenge sites like CTF sites. So if you want to do digital forensics challenges, you can go jump on that and, you know, learn there. You know, Sir Mark Joffrey, he leads cyber drills for FISA. So if you ever want to get a real, real experience, you can join his team and you will get to know, you know, how to cope with pressure in times like that. And you have a wonderful team who does that, and they score pretty high. So you'll not only learn the cyber skill, but you will learn to be a team player, which is a very, very important skill in cyber. So with that, I hope there are some questions because I did go very technical on the national capacity building and national cyber strategy. So I'll turn it over for questions.

Amna, can I, can I make a question to him?

Yes, sure, sure.

Okay, Jibran, you have been coming to Pakistan in our number of events for the last so many years, and whenever you don't come, even you are available to us on Zoom and everything. How do you feel the last, say, 7 to 8 years of journey in Pakistan? Are we progressing well? Do we need to accelerate the pace of progress on a fast track, or are you satisfied with the present pace of—

so how honest do you want me to be? Let me ask you a question.

Dead honest.

Dead honest.

I want the real Jibran. I want the real—

okay, so I will share this. When I— the first time I ever spoke in Pakistan was 2013 Cyber Secure Pakistan That was one of the most amazing conferences that you led in Pakistan. I remember it was in Marriott Islamabad, if I'm not mistaken. Amazing participation, amazing speakers. And then right after that time, you started this committee of creating this bill, cyber bill. And if I'm not mistaken, the defense some senator, uh, Mushahidullah, I think, or Mushahidullah Khan. Um, he actually, uh, backed that and he took that to Senate. And that was— that's when I thought things are really, really picking up in Pakistan. But unfortunately, that bill got nowhere. Um, and I think after that, um, I saw this, uh, struggling period. For the last maybe 3 years, uh, I have seen this pick up again and I know there were a lot of people in this mission and you kind of kept them like glue, but, you know, some people went abroad for better opportunities. And that happens when, you know, things are not happening, people are not seeing action. The lucky thing for Pakistan and for us is that you're there and you're persistent and you're resilient and you kept with it. So the last 3 years I've seen a huge comeback. And comeback, not necessarily that things have actually happened. I consider Progress is is is really you know very very important, and I think you've built that momentum over the last three years that I think anytime now within the next three six nine and twelve months we're gonna hear some good news. That is you know मेरा मेरा इमान है कि इतना hard work किया है आप लोगों ने कि ये there's no other way to for this to end other than in success. तो जितना momentum, जितना आगे तक आप लोग जा सकते थे आप लोग गए Now I see you in higher committees and whatnot. You've got like a very, very strong team. There's a great ecosystem of, you know, cyber in Pakistan now, and people have realized— I hope there might be some remaining, but I think people have realized that if they're going to go in their silos and work, it's not going to work. I think I remember, I think in 2014, You had a vision 2025 in Cybersecurity Pakistan, and you mentioned that we all need to come together. It is 2020, and I already see people are coming together because they have realized that if we're going to be in our silos, this is not the way cyber is going to work in Pakistan, and it doesn't work like that anywhere. So I think 2025 is still 5 years away, but I think we're going to achieve it much sooner, inshallah. And look at this conference. I mean, look at this, the participation here, look at people interested in cyber. It's been great. I think COVID kind of actually bridged the gap because before we used to rely on, okay, when are we gonna talk to people in different parts of the world to come to Pakistan? Now everything is virtual. So it's, you know, all we have to do is wake up early to be part of these conferences and parties here. Well, attest to the same thing. So I think there's more collaboration, more communication, more passion, and huge momentum. I think we underestimate momentum. If you have the momentum, you know, the process is so much fun. If results may be 3 months away, 6 months away, but because this process is so much fun, we're all like all in. And it's exciting times for Pakistan in cyber. Thank you, Jibran.

You know, you reminded me of 2013 when we presented the cybersecurity bill in the Senate. Trust me, this is the pain I'll take with me. Trust you me. Whenever I think about it, that had they listened to us at that time, 2013, Pakistan would have been much, much, much ahead today. But I think we shouldn't lose heart. And I'm very happy that now people are listening to us. And we must thank all of you, especially you, Farooq Nair, everybody who is giving us the advice from abroad. Thank you. Thank you much. Thank you.

No worries, no worries. I mean, I think ये तो बड़ा एक cliché सा sentence है कि you know हमारे हाथ में अल्लाह ने कोशिश दी है कामयाबी को देता है तो I think कोशिश तो हम अपनी पूरी कर रहे हैं inshallah we'll we'll reach I have no doubts I think we'll thank you voice I'll turn back to you you're the moderator so आपका mute है actually आवाज नहीं आ रही If anyone from the panelists have a question, they can ask. Sorry.

I'll just I'll just I'll just add a comment over here.

Can everybody hear me okay? Yes.

Okay. Let's have a comment, and the comment is that persistence pays off. मैं पिछले मेरे ख्याल में सत्रह अठारह साल से सब कुछ देख रहा हूँ. I've been out of Pakistan for the past nine years. The progress that I've seen in the past three years has been phenomenal. Phenomenal. And it's not just happening at the federal level. I had a call with the IT Minister of Sindh last night. There are some really good things happening. And the good thing is that whatever is happening is agnostic of politics right now. And that's the best thing. We should keep politics aside and work together in the national interest of this country. And cybersecurity is something which is a national issue of national security. So I'm really happy to see what is Happening right now, and Jibran, me, and Dr. Aftab, people like me are there to help you guys out. So just let us know, and we'll be there for you. Thank you.

Thank you very much, Jibran and Farooq Nayeer Saab. This is a very informative session, and actually, this is our concluding session. We are also in the process of preparing the final recommendations. My question is, you know, we we are relying on you know. international hardware and software, and we are unable to work on our indigenous data management. And if we talk about the cybersecurity threats, and if we are relying on artificial intelligence— so data is the food for artificial intelligence. So how do you think we as Pakistanis cope up with these challenges? My question is with Jibran Sahab, and if Farooq Nair is here, I would like to ask the same question to him as well.

Sure, Parikh, if you want to go first, I don't mind.

Jibran, sir, you first.

So I had one of the things in my slides. Am I still sharing the slides? I don't know. But one of the big things in my slide was this research and development point that was in my point number 4 in national cyber strategy. I feel that is very, very important. But it doesn't have to be from scratch. I would add this. If, you know, we— you know, if you think about innovation, it's basically whatever we have available and then improving that. So I wouldn't suggest that go build something like right out of scratch. I think there is— there are some frameworks there that you can study, you can utilize, and then build on top of it. So, the speed is better for that. You don't want to wait, you know, 20 years for having our own boxes for our own appliances. I think this could be achieved much sooner. But I totally agree because we— I call data the new oil. And I think a lot of people call it that. Oil used to have the most importance. Now data has. So, wherever we're giving our data, We have to be cognizant of the fact that, look, this data is going to machines that are out of our control or countries that are not in our control. So I totally agree. I love the question. I think this is that research and development. I feel we have to give a lot of importance. We have to reward our researchers a lot because, you know, we're all in this race of like Okay, not— we're all basically working, but I think we all need to take a timeout, look at the big picture, and then decide what our priorities should be in the next 2 years, 5 years, and then create a game plan and just focus on it. We can't, you know, we can deviate, but we can't lose focus. I think that's, that's what I'm doing.