Kopi-O with CISO

Welcome to a very special episode of Kopi-O with CISO Podcast. This episode is not just another addition to my series; it's a tribute to Cyber Security Awareness Month, celebrated every October.

My esteemed guest is Raj Kumar, a pioneer in the field of cyber security awareness in Malaysia. With a career spanning nearly two decades, Raj has been instrumental in shaping the

In this episode, we explore:

So, grab your cup of kopi-o, sit back, and join us for a conversation that promises to be as enlightening as it is entertaining!

#CyberSecurityAwarenessMonth #CyberSecurityAwareness #cybersecurity #infosec #CISO #KopiOwithCISO

In this riveting episode of "Kopi-O with CISO," I welcome Firdaus Juhari, the Head of Digital Security at Edotco Group, to delve into the current state of the tech industry and explore why cyber security remains a beacon of stability amidst the turmoil.

Join us for a conversation that's as candid and humorous as it is informative. Whether you're an IT professional considering a career change or someone intrigued by the resilience of the cybersecurity industry, this episode is a must-listen!

#KopiOwithCISO #CISO #cybersecurity #infosec #career #talent

Welcome to a very special episode of the Kopi-O with CISO podcast. In celebration of Independence Day and Malaysia Day, this episode is exclusively recorded in the Malay language.

------------

Dalam episod istimewa ini, sempena sambutan Hari Kebangsaan dan Hari Malaysia, "Kopi-O with CISO" mempersembahkan perbincangan mendalam bersama Fadzril Azhar dalam bahasa kebangsaan. Fadzril adalah seorang tokoh keselamatan siber dengan pengalaman hampir 20 tahun.

Kami akan menjelajah topik riskan siber, memahami keunikan servis risikan siber, serta mendengar wawasan dan pandangan Fadzril mengenai cabaran dan peluang dalam bidang keselamatan siber di Malaysia. Sertailah kami dalam perbincangan ini untuk mendapatkan pemahaman yang lebih mendalam tentang dunia risikan siber dan keselamatan siber secara umum.

Oh ya, satu lagi perkara, Fadzril adalah peminat tegar pasukan Man Utd manakala saya peminat tegar Arsenal. Dia mendakwa dalam episod ini bahawa Man Utd masih dalam fasa pembinaan semula. Malangnya, episod ini dirakam beberapa hari sebelum perlawanan Arsenal berhadapan Man Utd yang berakhir dengan keputusan 3-1 untuk Arsenal dua hari lepas.

#KopiOwithCISO #CISO #cybersecurity #infosec #CTI

Grab a cup of kopi-o!

In this episode of Kopi-O with CISO, I am joined by Dr. Ismamuradi Abdul Kadir a distinguished figure in the Malaysian cyber security domain. Our conversation unravels Dr. Isma's captivating journey into the realm of cyber security, from his early beginnings to his present commitments.

Dr. Isma and I delve into why vulnerability management holds such a personal resonance for him and why software and hardware misconfigurations have found a pivotal place in his vulnerability management strategy. As we traverse the conversation further, he sheds light on the tangible benefits that enterprises can harness by executing effective vulnerability management, juxtaposing it with the challenges that often lurk in its implementation.

Dr. Isma then candidly speaks about the potential pitfalls, emphasizing the significance of 'compensating controls' in risk mitigation and the nuances that often go unnoticed in CVSS scores. His expertise becomes especially evident when discussing the evolution of vulnerability management in the context of cloud computing. Given the shifting landscape, especially within the banking sector, his insights are both timely and invaluable.

Yet, beyond the intricacies of vulnerability management, our dialogue takes a personal turn. What is it that propels him to face another day, brimming with potential vulnerabilities and risks? His answer might surprise you.

Lastly, we catch a rare glimpse of Dr. Isma’s outside the professional sphere, touching upon the equilibrium between demanding professional roles and personal passions.

Join us for a cup of kopi-o and immerse yourself in a conversation where technology, strategy, and human perseverance beautifully intersect.

#KopiOwithCISO #CISO #cybersecurity #infosec #vulnerabilitymanagement #CVE #CVSS

Grab a cup of kopi-o!

In this episode of Kopi-O with CISO Podcast, Raja Azrina and I dive into the fascinating world of cyber security leadership and explore her unique journey to becoming a Chief Information Security Officer (CISO).

Raja Azrina shares her personal experiences, key decisions, challenges, and milestones that have paved the way to her current role as a CISO and we discuss the integration of the CISO position into existing organizational structures.

We also delve into the transition from a technical hands-on role to a business-oriented CISO position and uncover the strategies employed by her to bridge this gap successfully. We also candidly discuss about a typical day as a CISO, including the top three tasks she engages in regularly.

Raja Azrina also offers guidance and prioritization strategies for CISOs facing the challenge of building a team from scratch and kickstarting a security program.

Staying current with the rapidly evolving cybersecurity landscape is essential for CISOs. Raja Azrina provides valuable advice on maintaining a learning curve and staying up to date with the latest developments in cyber security, ensuring that a CISO can effectively tackle emerging threats and technologies.

You will also learn the strategies and approaches that have proven effective for Raja Azrina, enabling her to bridge the technical gap and convey the importance of cybersecurity in a language that resonates with the broader business.

Tune in to this insightful episode of Kopi-O with CISO to gain exclusive insights and guidance from a seasoned professional who has successfully navigated the evolving landscape of the CISO role in Malaysia.

#KopiOwithCISO #cybersecurity #CISO #infosec

In this episode of Kopi-O with CISO, Datuk Alan See and I are taking a deep dive into the future of Managed Security Services Providers (MSSPs), the industry trends shaping this landscape, and the growing call for consolidation. Datuk Alan, the Co-founder and CEO of FIRMUS, a leading MSSP, who joins us to shed light on the critical role of these providers in today's complex cyber security environment.

We begin by exploring the fundamentals of MSSPs, their key functions, and the significant challenges they face in delivering effective security services. We then shift focus to the current era of escalating cyber threats, discussing how MSSPs can adapt, and the role technology plays in enhancing their capabilities. Datuk Alan also shares valuable insights into how FIRMUS and other MSSPs communicate their value and ROI to potential clients, alongside the benefits for organizations in outsourcing their security needs.

We also examine the trade-offs of choosing between an in-house security team and outsourcing to an MSSP, discussing how providers like FIRMUS adapt their services to cater to unique industry needs. We delve into the critical considerations for organizations evaluating potential MSSP partnerships and how this potential consolidation impacts competition, innovation, and benefits or risks for client companies.

As we navigate the influence of AI and ML on the security landscape, Datuk Alan elucidates the emerging trends MSSPs need to be cognizant of to stay ahead. We then tackle the question of how MSSPs can maintain a competitive edge in a consolidating market and strategies smaller or newer MSSPs could employ.

Don't miss this enlightening conversation that delves into the heart of MSSP operations, their evolving roles, and the changing dynamics of this critical industry.

#KopiOwithCISO #CISO #cybersecurity #infosec #MSSP

Grab a cup of kopi-o!

Welcome to a very special episode of the Kopi-O with CISO Podcast. This time, I’m bringing you an insightful conversation recorded live on stage at the CYDES 2023 event, organized by the National Cyber Security Agency (NACSA).

In this episode, I’m joined by the esteemed Abid Adam, the Group Chief Risk & Compliance Officer of Axiata Berhad. With his profound expertise and experience, Abid illuminates the world of Cyber Threat Intelligence (CTI) and its vital role in creating a robust cyber security program.

We explore the concept of CTI, its importance, and the critical decisions made within a CTI program. Abid provides valuable insights into the practical application of CTI, guiding us through its strategic, operational, and tactical use in shaping a cyber security program.

Further delving into risk management, Abid shares his experience on how CTI enhances the process by identifying, assessing, and responding to cyber risks effectively. We also get an insider's perspective on the unique challenges and strategies of managing cyber threats in a multinational telecom company, from the viewpoint of a Group CRO.

For organizations stepping into the CTI realm, Abid shares his thoughts on where to begin and how to gradually build a comprehensive CTI program.

Finally, we take a slight detour from professional matters as Abid shares a glimpse into his personal life, offering his tips on maintaining a balance between demanding roles and personal life.

Listen in for an enlightening discussion that merges high-level strategies with on-the-ground realities of cyber security. This episode is a must-listen for cyber security enthusiasts, professionals, and anyone interested in understanding the importance and practical application of CTI.

Please note, due to the live recording nature of this episode, you might need to adjust your audio levels occasionally.

#KopiOwithCISO #CISO #infosec #cybersecurity #cti

Grab a cup of kopi-o for this bonus episode.

Typically, I release two episodes each month. However, in light of the significant MOVEit hack, I felt compelled to create an additional special episode to thoroughly cover the topic.

In this special episode, Azril Rahim and I deep dive into the aftermath of the recent MOVEit Transfer hack—an incident that has shaken the cyber security landscape. Azril, an experienced Management Consultant with a distinguished background in the cyber security industry, joins us to provide invaluable insights and expertise on the subject.

We begin by exploring Azril's journey in the field of cyber security and his current role at TNB, gaining a deeper understanding of their unique perspective. As we delve into the specifics of the MOVEit Transfer attack, we examine how this incident resonated with him, highlighting the vulnerability of even secure file-transferring software to hacking.

Drawing on his vast knowledge, our Azril provides context on the reported SQL injection vulnerability in MOVEit, explaining how hackers exploited it to gain unauthorized access to database structure and content. We unravel the far-reaching impact on major organizations, analyzing the immediate and long-term implications of such widespread data breaches.

Our discussion takes an intriguing turn as we shed light on threat actors like Lace Tempest and Cl0p, dissecting their strategies and exploring what makes them particularly effective. Azril shares insights into the shift in strategy employed by the Cl0p ransomware gang, as they ask affected companies to initiate contact, signaling the magnitude of the attack and the attackers' modus operandi.

Moving forward, we examine the proactive measures that security teams can adopt to enhance their cyber hygiene, ensuring the secure transferability of sensitive data. Azril discusses policy-level actions and the role of organizations, regulators, and customers in deterring similar cyber attacks.

Looking towards the future, we delve into the potential of AI-driven cyber-attacks, discussing the real threat they pose and the steps organizations should take to prepare and protect themselves.

Grab a cup of kopi-o!

In this episode. Khairelnaim and I delve into the intricate world of cyber security. Naim, a seasoned professional from the National Cyber Security Agency (NACSA) in Malaysia, narrates his path to becoming the Head of Incident Response & Cyber Threat Intelligence at National Cyber Coordination & Command Centre (NC4) and provides insight into his daily responsibilities.

We unpack the pivotal role NACSA plays in Malaysia's cyber security landscape, its collaborations with other agencies, and the private sector. Our guest also sheds light on the workings and significance of the NC4 in Malaysia's cyber security framework.

Addressing current cyber threats, we discuss the evolution of these threats in Malaysia, the country's preparedness for cyber attacks, and the strategies deployed by NACSA.

The conversation then shifts to international cooperation through the the likes of UN Cyber Norm, and our guest shares his role in its implementation. We tackle why cyber incidents in Malaysian entities aren't often publicly discussed and the implications for the broader ecosystem and country.

In addressing the concerns of small and medium enterprises (SMEs), we explore the threats they face and the possible solutions. Our guest further shares insights about small-scale cyber security programs initiated by NACSA and their impact compared to larger vendor-sponsored conferences.

Looking towards the future, our guest shares his aspirations for Malaysia's cyber security landscape and offers advice for businesses and individuals to fortify their defenses against cyber threats. We also discuss the differences between cyber threats and online scams and whether they should all fall under the term "cybercrime."

Finally, we explore hypothetical changes in the national cyber incident response strategy, and our guest shares a glimpse of his life outside the professional sphere, detailing how he balances his demanding role with his personal life.

Join us for an engaging and enlightening discussion that takes you behind the scenes of cybersecurity in Malaysia.

#KopiOwithCISO #cybersecurity #CISO #infosec #CNI

Grab a cup of kopi-o!

In this enlightening episode of 'Kopi-O with CISO', we delve into the fascinating world of Security Operations Centers (SOCs) with our esteemed guest, a seasoned cyber security expert. Our conversation begins with a personal journey into the cyber security field and an introduction to his current role and company.

We then explore the intricacies of SOCs, discussing their primary functions and potential shortcomings in today's dynamic cyber landscape. The episode poses thought-provoking questions about the relevance of traditional SOCs, given the emergence of distributed incident response tools, and discusses

Further, the episode probes the relationship between on-prem IT setups, cloud environments, and the SOC's role. It stimulates a dialogue on how SOC operations might be impacted by the shift to cloud, especially for modern, cloud-native companies.

The conversation also touches upon the need for more proactive action in SIEM or SOAR systems beyond mere alert generation, hinting at the future

Lastly, our guest shares some invaluable advice for enterprises looking to implement a SOC and thoughts on how they would reimagine SOC operations if