RSAC 2023 Top-Rated Session Conversation with Jibran Ilyas

My guest today is Jibran Ilyas. And am I saying that correctly?

That is just fine. Yep, Jibran it is.

Perfect. And Jibran was one of our top-rated— had one of our top-rated sessions from RSA Conference 2023. It was called Ransomware 101: Get Smart Understanding Real Attacks. And so I want, you know, I know we've talked about in these other livestreams, but I wanna congratulate you, Jibran, because the process of being selected number one is not easy, especially in 2023. We had a record number of submissions. And listeners, I'm sorry if you've heard this too many times now, but over 2,400 submissions.

Wow.

And of those, only about 500 are selected. And of those, only about 20 of them end up being top rated. So this is a really big deal. So congratulations to you. I want to recognize that that really speaks volumes for not only your understanding of the needs of the community, but your ability to convey information clearly and effectively and actionably, really offering guidance to your community. So I love that for you, and I'm super excited. So what do you think it was about your talk that really resonated with folks Yeah, first, well, thank you for the opportunity.

I'm so, so happy to receive this honor of top-rated session. So, and I didn't know that the competition was that tough. So makes me even more happy to be here. But to come back to your question, I feel that the topic first and foremost was very relevant. globally, there's this ransomware outbreak, right? And the impact of ransomware is actually not just like, you know, data theft and, you know, some intrusion in the network, it actually has the availability problem. So a lot of other types of data breaches make the news, but this one is more personal because it impacts organizations' uptime. And, and I think normal organizations, they cope with it just fine, but it has impacted hospitals. So it has affected lives. So that the relevance of this topic is such that, that it's, it's top of mind for everybody. It was also, you know, widely discussed in government circles. And there's like a crackdown there as well. So the relevance of topic, that's number one. But the special thing, or the thing that my talk had an edge for, were the demos of, like, attacks. So I've been doing incident response and forensics for about 15 years now. And I always say that seeing is believing. Like, you could say, hey, do this because this could happen. And that's what a lot of the, you know, compliance frameworks are, a lot of the security guidance is. But RSA gives us an opportunity to actually show that this is happening. So it's a different mindset, right? That, 'cause I get to come there and say, do this because this has happened. And not only, you know, you don't have to trust me, but I'm actually gonna show you a few demos of these attacks in their realest forms. So we basically, I was able to put together demos which showed, like, hey, when somebody receives a spear phishing email and when they click on that attachment, what actually happens? And not just what happens then, but, you know, once the attackers are able to make their way into the network, how easy it is for them, you know? So they're not very, very special coders or very, very technical. They just were lucky enough to get access. And from there on, it's a very, very simple process. And, you know, people see it, not only that they are, you know, understanding the attacks more, but they understand their role more because then they're probably thinking, oh, that HTML attachment that if I click on it without verifying, it could cause my organization $12 million in ransom payment. And so that was one interesting thing. And then, I also covered, you know, what a ransom note looks like, how the negotiations with the threat actors look like. So the note was pretty human. Everybody was pretty surprised that the attackers care about their reputation even though they're in this business. But it makes sense, right? Because they want to get paid all the time, and a bad review for them could mean no ransom payment. So it was, you know, it had a lot of visuals, demos, and then also like the impact, and then what happens when you're talking to other humans that are on the dark side. So those 3 things I—

Yeah, I mean, sometimes they're incredibly polite, right? I mean, it is, at the end of the day, it is a business, right? And they do need to make money. And, you know, I think the other thing that's really important, and we just had this conversation with, we're in conversation with our program committee for 2024, and just thinking about the types of sessions that we want to see. And You know, there was a lot of conversation about this 101, this back to basics, this fundamentals. And I think ransomware 101 really is applicable to everyone, right? It sort of level sets and, you know, gives everyone the opportunity to understand what's going on and to see what's going on. And all of that, all of those different methodologies of learning and engaging are super important to be thinking about because we're not all visual learners. We're not all auditory learners. We're not all kinetic learners, right? And so when we can combine those learning modalities in a presentation, it really reaches a broader audience. So kudos to you for that.

Thank you.

If you haven't seen Jibran's session, it is available in our library at rsaconference.com. You can search for Ransomware 101, or you can search for Jibran's name and find his session there. And I also want to ask what writing your submission— because, you know, our call for speakers is open, and, you know, it is really the details of the submission along with the creativity of, or the relevance of the title that get a session notice. But, you know, what was your process like?

Sure. So I actually put myself in the shoes of the audience, and I really wanted to understand, like, what would be good for them. You know, ransomware is a huge topic. So I think the point that you made earlier, that you try to attract the lowest common denominator, or you go to the fundamentals and you cater to the audiences who have heard of ransomware, and they might have read a lot about ransomware, but the reading that they might have done are It's probably like filtered through a marketing lens, legal lens. So by the time they read it, it's not the real thing or, you know, close to the crime scene. So my preference was just that if I was new or I was like, you know, maybe like 1 to 5 years of experience, like what would attract me? And I, you know, I'm a visual learner, so I wanted to see a lot. And when you see evil, then you know, then you have a higher chance of detecting evil, protecting against evil. So that was my priority when I was writing the abstract and the title that, you know, I really, really, you know, I have a huge passion of sharing knowledge, right? So when I learn something, I really want to share it with the industry because that's how I learned and I want to give it back. So I feel blessed to be in this position of giving back. So my goal was like whatever 4 or 5 lines I'm writing, it should come across that This guy really wants to share. And if you come to the session, you will get his whole brain dump and insights of, you know, 15 years of experience and 10 years specifically in ransomware battles. So I've been battling them to the point that they actually put a bounty on me for $100K. Yeah.

Wow.

Yeah, it was at RSA last year where they said Jibran and his company Mendiant have been involved in unacceptable practices. And that unacceptable practice was us protecting our clients. So yeah, a little scary at the start, but, you know, our mission is our mission. We are going to protect against evil. And that's, that's, that's, that's our mission in life. So after the initial shock, I felt actually proud that, hey, we're causing that much damage to them. So we must be doing something right. Right.

Yeah. Oh my gosh, that's great. A little bit scary, but great.

Yeah, scary and funny too, after all, right? Because then, you know, the $100,000 bounty, like, I was getting some really weird kind of spam, like lots of people trying to attack me because they all wanted to win $100K. And, um, my wife was like, you know, that's easy, I'll, I'll get the $100K. I know a lot about you.

I was gonna say, none of your family took them up on it?

We took a nice trip together. Oh, that's great.

So do Do you have any tips for our listeners today who might be thinking like, huh, do I have something to share? You know, what is it that— how many times have you submitted to RSA Conference?

I've submitted twice, but I've submitted twice, so I've gotten lucky. Yeah.

Wow. So I mean, that there is a really important tip to share, right? Because I think people have this mixed misconception that like I've got to submit 20 times before I ever get selected. And, um, a lot of our top-rated session speakers were, you know, first or second time submissions. So that's great.

Yeah, but yeah, no, I'll tell you this. So even though I've submitted, uh, only twice, um, I have thought about submitting maybe 20 times. So there you go. So I mean, I've, I've been a huge fan of RSA conference. It's a top conference, if not the top conference. I mean, very well attended. Like, where else are you gonna get like 40,000 people in one conference, right? So I have not submitted if I didn't think like my talk was good enough or unique enough. Um, so, you know, I've read hundreds of, um, abstracts on RSS site. So I've seen past submissions and, you know, past acceptances. And based on that, I always like start writing my CFP, uh, coffee paper write-up. And when I finish it, if I compare it to the ones that were accepted the year before or previous years, and if I don't think mine is on par, I don't submit because, you know, I'd save myself the disappointment, or at least know that, hey, I need to do this, this, and this before I feel that I deserve it. And then I have something to share. So that's one thing that I'm really— I really work hard on. But the tips to the people who are planning to submit this year, I would say that choose something that you're really passionate about because, you know, you can write a deck, you can create the write-up, but, you know, for the top-rated session, I think your passion has to come across and your you're urged to transfer that knowledge, that will come across. People are very, very smart. They, they are a very good judge of, uh, this sort of thing. And, you know, you want to have fun element in, uh, in the talk as well. Like, um, so I would say, like, if you, uh, just present very, very, uh, like, very high on technical details, um, that might be good for some audience. But if you do a lot of storytelling Uh, that will attract the audiences, that will get you some really, really good reviews because people learn, um, by stories, you know, as even as a little kid, right? You learn your lessons and you hear stories from your parents or when you're reading. So, so that element, the storytelling element, has to be there and something that you're passionate about but something that is unique to you too, right? So I have 10 years of ransomware battling experience to the point that getting threatened these days. So, so that, um, you know, um, is, is pretty key. And, um, one thing that I would say, like, when you're submitting, your title needs to be very catchy, your abstract needs to be on point, um, right? And then, uh, you know, if you do, like, if you're releasing a tool, if you are presenting a demo, that just puts you one notch above, um, you know, some of the other submitters. Like you said, there are 2,400 submitters, right, any given year. So You want to have some edge there. So by creating a tool, releasing a tool, by creating a demo, you are able to have— be one notch above.

That's awesome. Thank you so much for that. Listeners, thank you so much for tuning in. To learn more about ransomware, be sure to visit marketplace.rsaconference.com/marketplace. You'll find an entire ecosystem of cybersecurity vendors. And thank you so much for joining us, Jibran. Can't wait to read your submissions for this year and hope to see you again on the stage in 2024.

Thank you.