How to Build a Cybersecurity Program from Scratch | CISO Transformation Playbook

Prabh Nair

In this episode, Prabh Nair hosts Ilyas Kooliyankal, Group CEO of CyberShelter, for a masterclass on building cybersecurity programs from sc

Key takeaways

• Ilyas Kooliyankal emphasizes that a successful CISO must balance knowledge, understanding, common sense, and aptitude rather than relying solely on technical expertise.
• A primary strategy for new CISOs is prioritizing 'P0' gaps—those with high risk and low effort to remediate using existing tools like firewalls or WAF configurations.

Main topics

• Building cybersecurity from scratch
• Defining and utilizing risk appetite

Notable quotes

Security is about risk management.

Conclusion

The episode serves as a strategic guide for aspiring CISOs to transiti

Transcript preview

Speaker 1 (0:00) How did you overcome the challenge and what is the message you want to give to the aspiring CSOs or GRC professionals? So Speaker 2 (0:06) there are a few things. One is knowledge and understanding and common sense and aptitude. All of these are important. Speaker 1 (0:13) Today I'm joined by Mr. Ilyas, a group CEO of Cyber Shelter, a cybersecurity leader with nearly three decades of cybersecurity leadership, enterprise technology and more important, the financial services, which is handled by another critical project. What should be the formula we should consider to prioritize the security gaps? We have 10 to 15 security gaps are there management have a limited budget how can we prioritize security gaps so Speaker 2 (0:34) that is the first thing about any security program is about your risk appetite an organization most organization will not have an information security risk appetite in Speaker 1 (0:45) the era of this middle east war happening and budget constraints their power by ai is coming also How can you convey the management on the budgets? Speaker 2 (0:53) This is actually the million dollar question. Budget is a problem and partly due to probably how IT and security managed the budget in the past. Speaker 1 (1:03) How to assess the organization before buying a tool? Speaker 1 (1:11) Hi team, welcome to the session on Coffee with Prabh and today coffee is very special. Today I am joined by Mr. Ilyas, a group CEO of CyberShelter, a cybersecurity leader with nearly three decades of cybersecurity, cybersecurity leadership, enterprise technology and more important, the financial services which is handled by another critical project. And today we are going to discuss one of the most important topics on this masterclass is building cybersecurity from zero. as a CISO, when you join any organization, how to build cybersecurity from scratch, how to build the information security program from scratch. And what is the best thing, you know, it will be given by and it will be mentored by Mr. Elias, who spent 26 years experience in UAE itself. Okay, when I was in a school, he was ruling the... Dubai with cyber defense centers and all that. I still can't believe today I'm sitting with Ilyas and the person I'm following from 2016 onwards and seeing his wisdom thoughts about cybersecurity and a good poet also, okay, one of his hobby. And yeah, today we're going to deep dive into the practical aspect of the masterclass, how to build cybersecurity program from scratch. Hi, sir, how are you? Hey, hi Prabh. Speaker 2 (2:27) Thank you so much for that great welcome. I'm doing great and it's my honor to be with you for this coffee with Prabh. Although maybe it's a mutual respect and love and affection, I was hearing about you a lot and I was just wondering what is so special about Prabh. and finally even my wife was following you and she was even doing her casp by watching your videos so i was so impressed and uh i found that you know i was excited to be frank coming for this session uh looking forward uh thank Speaker 1 (3:09) you so much sir for the kind words i know it's it's your it's your nature you know how humble you are and today i will be your student sir okay i bring a notebook i'm going to write a lot of notes so please bear with my questions because i'm going to ask the person who have practically implement cyber security when it was a new concept in the industry and i want to take out that wisdom and thoughts from your perspective and i want to create my own version of notes which can be useful for the aspiring student because this video will be watched by the students ceasos aspiring ceasos which can give direct indirect benefits Speaker 2 (3:50) It's again, it's my pleasure to share as we discuss, you know, sharing knowledge and teaching students and making building leaders and building cybersecurity professional like you. I mean, I also enjoy that. Very, very happy to share and use this platform because this is something which was always in my mind. I never get time. But since you took this initiative, I'm very happy to share whatever knowledge. whatever skills i have learned for the wider audience thank Speaker 1 (4:21) you masha thank you so much and and you know who are new to this podcast who new to this profile if i want to welcome you to that those people can you just share your experience about who is ilyas who new to you because those who are in new york is a big name but might be some people from india or the part of the country they don't know about ilia so if i want to introduce ilyas to them who is ilyas Speaker 2 (4:48) okay that's a long story but i'll try to make it very short yeah so uh see i finished my engineering uh you know i i did my engineering 1994 batch from karnoor engineering college government college in kerala um immediately after that there's there was not enough jobs in kerala during those days so we had to find ways to get into something i got into a walk-in interview in cochin and i got selected to a job in katar okay Speaker 1 (5:23) so Speaker 2 (5:23) that was cutter cgis center for geographical information system where this google maps and the ways is now which was not there during those days and it was actually converting the geographical you know coordinates to you know digital forms and making those digital maps so that was something i started with and in 1996 i moved to uae uh at the slot the isp so those days internet just started to come up and around 5000 plus internet users in in uae So I was lucky to join the ISP in the internet section. Speaker 1 (6:06) So Speaker 2 (6:06) which was very kind of a turning point of my career. Speaker 1 (6:11) And Speaker 2 (6:12) I was involved in internet support and supporting people to connect and solve troubleshoot internet problems. And that actually went on for three and a half years. And then I was slowly was able to move to the network security network, actually, network and IT operations. and then i moved to security so i was configuring the firewalls and the ipss during 2000 period you know that was as you said not many people were aware of cyber security or it security then suddenly i got interested into a standard called bs7799 b7799 so that was the origin of iso 27001 know bs7799 so that was around 2005 2006 period uh so i got into that for certifying one of the subsidiary of uh etisalat to be certified bs7799 that actually really opened up the the whole information security field and whatever you know what i was able to achieve over a period of time uh in 2000 um uh seven i moved to abu dhabi stock exchange which was a shift to the financial industry the Speaker 1 (7:28) first Speaker 2 (7:29) finance so the ability to Speaker 1 (7:32) integrity yeah Speaker 2 (7:34) everything not only integrity even you know it was like you know confidentiality integrity availability everything Speaker 1 (7:41) so Speaker 2 (7:42) the the key point of my decision which was uh primarily because those days ethasalat was a big name and then people were asking alias are you want to shift from ethasalat and and avadavi stock exchange was very pretty new name not many people knows but then that was my intuitive decision that i feel like security will be more important in financial sector and i want to get into that financial sector domain and there will be more prominence and because money is involved and security will be very critical so it's somehow i felt that you know this is going to be the field for the future which i still believe in ai age also you know cyber security is something which is going to be staying there uh forever uh so uh then i uh finally i moved to abu dhabi islamic bank as uh group c so in 2016 i think which is the period probably you we you maybe we seen each other um uh that was very very uh big move because i was the first sizzle and all these places last three jobs before the cyber shelter journey i was the first sizzle in those places i had to build everything from scratch so in abu dhabi islamic bank i was the first sizzle for the bank and i had to build everything uh from scratch you know the full uh information security management system organization structure and and a lot i think we will probably discuss those little later but that is the story and over over this period i was uh parallelly getting myself updated with certifications whatever certifications available those days I was getting up to date with those I was training, getting trained, certified, and I was speaking in conferences. So, you know, probably in public forums, social media. So that actually helped me to build a community, build a kind of, you know, network around cybersecurity professionals. I was able to establish a cybersecurity career group. gcscp global cyber security carrier uh platform uh to help is this is this still Speaker 1 (9:55) active Speaker 2 (9:55) it is it is so can i still land there is it is Speaker 1 (9:59) it open for all or it's for the yes Speaker 2 (10:01) gcscp is open for all and we have almost like thousand four hundred members and we connect uh although probably more members from gcc but it is a global i mean okay so from india can i update that link Speaker 1 (10:15) in the youtube viewers if so if any fresher watching this video you can yes definitely Speaker 2 (10:19) yeah yeah definitely so there is another group uh which i built is for uh you know budding scissors which is called caesar factory which is primarily for either new CISOs or one downs of CISOs. So CISO factory was built for mentoring and training without any and all these groups are very non-commercial, non-marketing, no sales, purely from very much community centric. We have a very clear policy. There's no sales, no contacts for marketing, and it is purely helping people to build their cybersecurity career and find opportunities and share those opportunities help people to find jobs so this is two of my initiative and another initiative what i have built is a portal called secure reading uh dot com uh which is again for sharing news and articles uh yeah threats uh threat intelligence this is almost like great i Speaker 1 (11:19) think Speaker 2 (11:19) we we need you to probably contribute and associate with that Because that is something I have established almost like 2015 period, you know, those days, yeah, as a non-profit, you know. Speaker 1 (11:33) I got to know that in 2019 and all that when Jazil also shared that. Speaker 2 (11:37) Oh, okay, okay. So, Speaker 1 (11:39) have you ever thought that, okay, you will be moving to cyber security? Sorry, guys, this is not a part of a series. I'm asking him very random question right now because it is out of curiosity because starting a journey from... 1994 and implementing a standard getting into technical so i think this is a very important question for all the freshers also know you know uh have you ever thought that you will do cyber security that's what i'm telling you because you deserve that Speaker 2 (12:09) So that is a very special... Masha means, those who are new to this world, they call it teacher. Speaker 1 (12:12) Those who don't know about Masha, it's called teacher. And I am proud to say that. I do not feel bad for that. I feel proud for that. So have you ever thought that, okay, you will be moving to cybersecurity? Speaker 2 (12:26) Very, very frankly saying, when I started my career, I did not have any idea. Speaker 1 (12:32) When Speaker 2 (12:32) I started my first job, it was just the first time it was just getting a job. That was objective. Speaker 1 (12:40) Then Speaker 2 (12:41) when I felt that this was my career is when I was in Etisalat and when I started getting into the BS 779 standard. So I started, I got a training on that and I started enjoying that whole information security management system, the process and the people, the people process technology stuff, which I love always. Because I believe as you are. you must be really enjoying that because I say like technology only cannot solve any problems. It has to be people and process. That's Speaker 1 (13:16) why Speaker 2 (13:16) we say in cybersecurity, Speaker 1 (13:16) technology failure is never be there because security please never happen because of technology failure. It's always because of process failure. Speaker 2 (13:22) Process. And that process is actually many organization misses and thinking that it is only IT process or security process. Yes. It is actually even business processes. Speaker 1 (13:34) Yes. Speaker 2 (13:35) So then only if you have the right business processes, it complements the technology controls, complements the people control. And that combination is the best option to have effective security. And that when I that spark came to me when I started learning and getting trained and getting getting certified in a B779. And then I felt that this is going to be my field and I want to learn. but more than all of that i would say always and which i probably if somebody following me knows that i believe in what is passion what passion you have you know so i was like really enjoying and putting my best Speaker 1 (14:15) and everything getting results you know what i was Speaker 2 (14:17) doing and that doesn't help me to be better in whatever i was doing and that kind of moved me to information security or cyber security okay Speaker 1 (14:26) but mashe that time there was no chat gpt there is no ai okay you attend the training and then next day company has told you implement okay the reason of asking this question is i want to just just it will be only hardly take two minutes okay not we will not extend more than that what is the one message you want to give to the aspiring jrc professionals or caesars who watching this podcast you know in the air of ai you enter the prompt you get a policy you enter the prompt of risk assessment template you get a risk assessment template How did you handle these things? Because training is a different concept, what you attend, but practicality when you're getting into the production, the scenario is completely different. You have attended might be a five days program or weekend program, but now it's time you need to execute. Just want to know from you, how did you overcome the challenge and what is the message you want to give to the aspiring CISOs or GRC professionals? Speaker 2 (15:22) so there are a few things one is knowledge and understanding and common sense and aptitude all of this are important okay so we need to have that you know now for example even if you charge your pt or on if you don't know what prompt to put Speaker 1 (15:37) then Speaker 2 (15:38) you are no no use of anything whatever tools you have so that common sense and that aptitude needs to be there and we need to be able to translate those theoretical you know uh policies theoretical standards and training material into practical elements you know when it comes to your business those needs to be customized your business challenges business actual business scenarios to make sure it is working it is workable and it is customized okay Speaker 1 (16:08) for Speaker 2 (16:09) example if you are drafting a policy with for example even in chachapiti in in your in reality that may be not practically workable you know there may be you know actual challenge to apply that and there are certain other ways the same objectives can be achieved true Speaker 1 (16:24) because Speaker 2 (16:25) you don't have to be having a policy that it password should be 10 character and then you stick any system 10 character and the system doesn't have any support for 10 character or the system has an option for multi-factor authentication or its system has a passwordless uh process passwordless control which you can implement then going for 10 character itself as a you know return policy doesn't make sense you know so the the thing is that we need to achieve the objective you know security is about risk management yeah Speaker 1 (16:59) risk Speaker 2 (17:00) reduction as much as your risk appetite how to bring that risk to your appetite and what is best possible to do in our business environment we need to find that control how to customize how to tailor the control Speaker 1 (17:17) rather Speaker 2 (17:18) than just blindly say okay in my policy i have written this statement so we have to comply with that statement Speaker 1 (17:25) then Speaker 2 (17:26) we are going to be a policy road blocker for business and they will start faith us and then you will be not successful as a caesar as a security leader you need to find how you can tailor customize the controls Speaker 2 (17:46) by achieving the objective but at the same time supporting the business Speaker 1 (17:48) and that that's remind me to