- 1 year ago
Christine Gadsby highlights the strategic collaboration between BlackBerry and the Malaysian Communications and Multimedia Commission (MCMC) in establishing the Cybersecurity Centre of Excellence (CCoE). The session explores secure communications, talent development, and national readiness against digital threats.
Category
🗞
NewsTranscript
00:00Thanks for joining us. This is The Economy. I'm your host, Ibrahim Sani.
00:12In my office right now is Christine Gadsby, the Chief Cybersecurity Officer of BlackBerry.
00:21Very recently, BlackBerry, in collaboration with TelenCorp, has launched their Cybersecurity Center of Excellence at CyberJaya
00:27where they are going to partner with cybersecurity experts and trainers like SC2 as well as Comtia
00:37to deliver about 1,000 talents to be trained in the cybersecurity space.
00:42As we have discussed on this show in previous episodes,
00:45cybersecurity roles are one of the more needed roles in the space of technology,
00:50so Christine is perhaps the best person to discuss this with us.
00:53I think the first thing that I want to ask you is why Malaysia as opposed to other markets within the region?
01:00Where do you see Malaysia fit in that whole general idea or general strategy of BlackBerry
01:05in promoting cybersecurity competency in this region?
01:09That's a great question.
01:10Malaysia is really unique in how it leads in the ASEAN region for cybersecurity.
01:15I think you have a really good combination of strong policy with the Malaysian cybersecurity strategy.
01:21You have the need and the want to train, and you see the priority of needing to train skilled people to do cybersecurity work,
01:30and you put that as a priority.
01:32And, you know, you follow that up with things like driving towards digital sovereignty,
01:37a really strong economy when it comes to the needs of digital sovereignty.
01:42You take security just incredibly seriously, and you have had the forefront to think about partnering with enterprise companies
01:51who have the deep, already technical knowledge and are willing to pass that on,
01:56and willing to partner with Canada and have it be part of their own strategy in the Indo-Pacific region.
02:02So I think there's just a combination of really great things absolutely has put Malaysia in the forefront.
02:08We actually have put our Asian headquarters here as well just to help bolster that partnership.
02:13So it's incredibly thought-leading in how to really tackle Malaysia's challenge with cybersecurity talent.
02:21The thing about this part of the world is that we are at the crosshairs of the larger crosshairs of China versus U.S.
02:29And consistent with the ASEAN non-intervention policy, we tend to not take sides and we tend to do business with everyone.
02:37Doesn't this kind of geopolitical element put a bit of a risk or factor at least, something for BlackBerry to think about
02:46when you think about enlarging your business in this part of the world?
02:50Yeah, another great question.
02:52I think any time there is a geopolitical shift or any time there is a geopolitical tension where we feel a change
03:00and you couple that with a digital transformation like this region is going through, you are going to cause a need for incredibly tighter security controls.
03:10Malaysia has done again a great job.
03:12I commend the Malaysian region for really answering that with policy.
03:16You've really stepped up and sort of written the rule books to drive a lot of the needed security changes.
03:22But absolutely, geopolitical wastes heavily on the need to do everything that you're doing.
03:26So geopolitical stability, at least among partners of ASEAN, is indeed something of a high priority.
03:33But not many of these ASEAN leaders who are in town right now to talk about the ASEAN Summit
03:38really discuss cyber security as a top priority.
03:42I would not say or I wouldn't go as far as saying that they wouldn't disagree that cyber security is not an important subject.
03:50It's just that there's so many other things that are put on the table for them to discuss and debate upon,
03:55leading to cyber security being one of the less important items.
03:58How do you see the talent development as well as the infrastructure and policy development of cyber security going to be upskilled
04:05amongst the countries here in this part of the world, considering that there's so many other pressing matters at hand
04:10that the leaders are thinking about right now?
04:12You know, I think one of the things that is interesting in this region
04:17is that even though it tends to somewhat fall on a differing scale of the level of conversation, topic, hours of discussion, it's important to everybody.
04:26So no one will disagree.
04:27When I go around and talk to the different areas and regions of the ASEAN region, no one disagrees as a priority.
04:34So I think it's just getting it into the right place where you can partner with companies like Blackberry
04:39and again, you know, areas of the globe like Canada to have sort of an answer to that where we're strategizing together
04:45so that we can help you worry about it instead of you having to worry about it, et cetera, right?
04:49So I think it is a shared goal.
04:51And the leaders that I've spoken to take it very seriously.
04:54So I do think you'll see, especially as the tensions in the globe continue to increase,
05:01you're going to see the priority increase effectively because it almost has to.
05:05So when you look at the little bit of background is that you've been with Blackberry for close to two decades
05:11and you've seen how it has been transformed from a rather retail company to an enterprise company leading to the cybersecurity world.
05:18You would know the progress of what things have been developing.
05:23Maybe you can give us a little bit of a crystal ball insight into what it's going to look like for the next three to five years
05:29and perhaps what countries and companies must be thinking about right now in order for them to be able to skate where the puck is, so to speak.
05:36Yeah. The biggest shift we are seeing right now is really the challenge around securing communications.
05:42If you think about the geopolitical shift, we are a supply chain.
05:46You know, we as humans are people talking on our phones, we're on our devices, we're entering in things to a computer web browser.
05:52We become a supply chain of information that criminals find very valuable.
05:57And secure communications is definitely being pointed out as a weak link.
06:00We've got four, probably three or four really major areas of that.
06:03And that is one, AI is really, you know, developing a criminal toolkit.
06:08You know, it makes it much easier for them to intercept communications like this and use the data that they're finding.
06:13So that's kind of the first thing. The second thing is you have this really free supply chain.
06:19Everybody is using free applications. You know, we're all using them, whether it's, you know, WhatsApp or Signal.
06:25We're having these government grade conversations on them. We know that we are with classified confidential secret information
06:32that is being passed around in these free applications that we know all of that metadata is available for.
06:37So it is public knowledge that that metadata is collected and sold and attackers have access again through, you know, AI making it much easier.
06:46But it's also the barrier to entry is very low. It's a very low cost for an attacker to go hire a service.
06:52They don't even have to do anything for a cost of, you know, a muffin and a cup of coffee.
06:57An attacker can literally just go pay a service to go get access to all of that data.
07:01It's absolutely mind blowing what we're seeing right now as far as intelligence.
07:05So I think those two things are really what is really going to harness the higher level, as you say, priority conversations,
07:12are going to be when we find more human error, you know, accidentally adding people to conversations that are private.
07:19Sorry, when you said Signal, that's the only thing that I was thinking about.
07:21Right, right. Well, I mean, you know.
07:23I think I just said silent and it was just awesome. The whole thing was just awesome.
07:26But, you know, you see that happening and that's not the first time and it won't be the last time.
07:29It's just the first time you heard about it. So it's happening.
07:32It wasn't even an attacker, so to speak. It was just a guy that was invited in. That's it.
07:36Right. And that is human error. So you've got AI driving the attacker scenario.
07:40You've got human error, right? And there is a place for free, you know, messaging apps.
07:45If I'm going to, you know, I'm stopping by the grocery store and I'm going to pick up dinner, fine, right?
07:50But highly regulated business, banking, government, that is not the place for those conversations.
07:55And we continually see that.
07:56I would like to argue that human nature or psychology actually dictates that it's only natural for one person to just continue on staying on that platform and not migrate to another platform.
08:07And then, you know, you extrapolate this with other actors within the same organization.
08:11They just wouldn't want to leave, say, WhatsApp and move on to other secure channels.
08:16It's just human behavior.
08:18It is. But the one thing when you do the government grade application like we have at BlackBerry, you have the ability to control the administration of it.
08:28So, for example, a WhatsApp application, you can go download that from your app store. Everybody can.
08:33But if I administer a controlled communications platform, I have to invite you from my administration platform.
08:40No. So, you know, you can't add it to have a conversation with me if, you know, the company didn't allow that.
08:45I'm not disputing that. I'm just saying that, you know, just it's just I guess the question now is on enforcement and how does organizations impose on that enforcement to use.
08:56I mean, I can't imagine any government grade organization saying things like, you know, by all means, use a free text message or whatever.
09:04Sure. But it's it's it starts from the top, isn't it?
09:07Absolutely. A hundred percent. And you have to get into the bigger conversation of what is mobile device management look like.
09:12Yeah. You know, if you're allowing employees to have access to mobile devices, then it needs to start there.
09:16Yeah. And not the conversation. You know, you can have a policy what you're saying and you can say, OK, please don't use these.
09:22It has been there. Right. It's always been there.
09:24But you really do have to start with mobile device management then and somewhat control that.
09:28But we do see when we do control that access that the security flows regularly in it and it is what it's supposed to be.
09:36But what we do see also when there's no control, secrets are everywhere.
09:40And again, you know, it's like five dollars a month.
09:42An attacker can go pay a service. They don't have to do anything.
09:45So I do think it needs to have a deeper conversation.
09:49But when it does have a deeper conversation, the priority does come up.
09:53So it is a good thing. We're seeing it here in Malaysia.
09:56Malaysia is using this currently, the secure services that we have.
09:58And we're seeing much tighter control over, you know, confidential information, whether it's being shared between you and I or enterprise and government.
10:06It's it's it is working. So you just have to again, you just have to kind of prioritize it.
10:10Your local partner here is Talent Corp. Based on the conversation that my organization has had with Talent Corp, they argue that anywhere between 300,000 to 500,000 jobs are going to be displaced because of AI disruption.
10:25Of that, more than half is going to be in the roles or in the aspects of cybersecurity.
10:30How do you tie this with talent management or resource management capability and readiness?
10:35And where do you see us closing that gap even further?
10:39I'm sure that, you know, by launching a cybersecurity center of excellence can actually close that gap somewhat.
10:45But I cannot imagine that one center of excellence can close 300,000 roles in the space, I don't know, of one year or so on.
10:52So how do you see countries or companies close that gap even further?
10:56We have to get creative in how you hire.
10:58This is a big effort. And it's not just in this region. It's an effort globally.
11:01But we have to definitely get creative on where we find the pools of talent.
11:05There are a lot of untapped areas, I think.
11:07When I think of this region, especially, I think of like retired law enforcement who might be ready to go back into the workforce, right?
11:13You know, they've already spent their career maybe investigating criminals.
11:16They're driving Ubers, by the way, right now.
11:18Right. Thank you. Right. So maybe we bring them back in.
11:21You know, there are in where I'm from, a lot of stay at home moms coming back into the workforce that are saying, hey, this is a great area.
11:28How do I how do I learn? Yeah.
11:30Even into I have a daughter who's neurodiverse and she's disabled.
11:35She's autistic, but she reads patterns.
11:38So even going into that community and saying, OK, these people are great at reading patterns.
11:42Maybe they love to do it. And she also actually really does like to sit and kind of have a repetitive task.
11:47Yeah. We haven't yet tapped that market.
11:49We're just starting to tap that market of individuals.
11:51Sorry, I just have to intervene.
11:52So the UASM Raju has worked with PwC, the audit firm, to collaborate a neurodiversity center of excellence to train and hire and appreciate more neurodiverse folks in order for them to see recognized patterns.
12:08But baby steps. Baby steps. It's just five hirees per year or something like that.
12:13But that's OK, because it creates a pattern that can be repeated when it's successful. Right.
12:17Once we have a model for that sort of thing and it can be proven, it will be adopted.
12:21I think it just it's really tough to get stuff like that off the ground.
12:23Like you're saying it has to really want to do that. And strangely enough, it's PwC Texas that taught patroness on creating that neurodiversity center of excellence.
12:33And seeing somebody from, I guess, Texas saying this again is what I'm referring. So, yes, absolutely.
12:38It does work. We are trying to prove the model that it works. I do believe it will be successful.
12:42I've seen it successful in my own life. So we have to get creative.
12:46But I mean, when when HR departments interview people, they look for people that can communicate clearly, can collaborate with teams.
12:55I don't think these are the markers for having strong neurodiversity.
12:59I don't. But I don't agree that every role needs that. Yeah, exactly. I don't. I'm sorry.
13:03We have to be one of the things that we have to change as an industry is we have to stop putting markers on roles like that. Yeah.
13:09Lots of roles. We don't need people to have a degree in this and a degree in this and a degree in this.
13:13And we have to stop asking for it because we also not only do we not need it, we discourage people from applying.
13:18Yeah. Because then people look at it and they think, well, I can't do that.
13:21And then, of course, there's an exclusion risk because the people that you need would be in the neurodiversity background.
13:27Exactly. And if we want to really have inclusion built into that, you're limiting those people right out of the get go.
13:33So now we're leaving cybersecurity. We're now talking about hiring, managing, trying to understand.
13:40Of course, you know, HR departments only react towards what the top thinks.
13:46And if the top doesn't think this way, it's very hard for organizations to adopt.
13:51Do you feel that a lot needs to be done in terms of training the C-suiters and the government policymakers and so on?
13:57A hundred percent. And this, you know, I did a couple of years ago.
14:00I went around and I did a bunch of with my own friends, friendly CEOs.
14:04I know quite a few people who run companies and I started asking them and it was to prepare for a conference that I was presenting on this topic, a talk on.
14:12And I asked them, you know, how many of you have this, you know, a priority of hiring neurodiverse, more women, you know, a more differently abled.
14:20Yeah. How how much a priority in every one of them without, you know, without a doubt.
14:24Oh, it's so important. Right. So then I followed up with the question, OK, well, what are you doing?
14:28You know, and it was crickets, you know, because they realized that, yeah, it's so important.
14:33Well, what are you actually doing, though, to change the dynamic?
14:36They're not doing anything. I mean, most of them, a couple of them had to like, well, I do these really tiny things.
14:40But what I realized in that was that we lack implementation and actually dedication of time, resources, ability to be intentional.
14:50It has to be intentional. You can just say you want to do it. You then have to turn around and go do something about it.
14:55And so my follow up question to all these leaders, do you know how to do any of this?
15:01Hands down, no. Hands down, no. None of them knew and none of their HR people were training them in their own leadership development
15:08and their own leadership development courses. There weren't any. They didn't know what to do.
15:12So I started with some basics with some of them, but it really hit me hard that it isn't that they don't want to be intentional.
15:19They just don't know how to be intentional. And so we really have to change the dynamic and have the C-suite be more intentional to realize this skill gap is going to get closed.
15:28Yeah, but BlackBerry is having a strong competency in the training aspect, but I don't know whether you have the competencies or the will with all to move into this whole changing the culture of how business should be.
15:43How do you bridge that gap between the things that you're good at and the things that needs to be done? Is there a middling gap there?
15:48Well, that's why we partner with others, right? We aren't the answer for everything. We want to be a part of the dynamic of changing the culture.
15:55And so we have to partner with other people. And so that's why we've done this.
15:58You know, we're here partnering internally with Malaysia. We're partnering with other training partners.
16:02You know, what we're really good at is delivering 40 years of security excellence and products that do security really well and thought leadership.
16:08We have been training in security for a very long time. So we can bring the thought leadership, but we definitely for scalability have to have partners. We can't do it alone.
16:16The next stage of conversation I would like to explore is in terms of the technical trainings that is currently being done, either in the center of excellence that you have here or somewhere that you've done globally.
16:28What will be some of the areas of concerns that needs to be addressed, particularly in the aspect of the technical training aspect of it?
16:35So I think training is interesting. It's sort of end to end. There's this really lower level basic cyber hygiene pool that just needs to happen.
16:44And that we can talk about just that pool of I need to understand the basics of security. I see in the future at some point where companies will probably have to require that of all their employees.
16:54It won't just be I want a career in cybersecurity. It will be really to work for this company. You need to understand password resets and, you know, just basic cyber hygiene.
17:03Don't put your credentials into this web thing that you clicked on. You know, that kind of thing, I believe, will have to be table stakes. Right.
17:10So we've got that all the way into really tough practitioner. You know, we just launched a CISSP program, things like that.
17:17We're really going into some of the more certification roles and the more technical roles. But I don't see anything off the table for education.
17:24It's all got to have to be there because security is changing so much.
17:27I'm sorry. I have a 73 year old mom and an 11 year old daughter.
17:31I was going to bring that up to my parents and my kids.
17:35Yeah. And the millennials are bridging the gaps of these two worlds. It's just bizarre.
17:41It is. But even them. Right. There is a need. And I was thinking about this on the flight on the way over.
17:47How do we make education programs? I mean, you know, how does anybody make education programs?
17:52I'm not concerned about my 11 year old daughter. It's my parents, my parents.
17:55I don't want them to lose their fortune. Right. So. But how do we do that?
17:58We have to go lean in with the people that understand that group.
18:00And so that's kind of the thing is I could tell you all day that it's really important to train your 73 year old mom.
18:05Yeah. But I'm not the one to put that training together.
18:07Yeah. Who is the you know, probably that needs a working group of like, you know, doctors that understand that.
18:12Yeah. You know, psychologists that understand how they think. Yeah.
18:17You know, maybe the memory care people that understand what they can patterns they can remember.
18:20It needs a think tank. And that's where I think we're having to think differently about it is going to be key.
18:25So Malaysia as a government initiative has organized various structures possible.
18:32We have the digital national digital department. We have the Ministry of Digital.
18:38We have a few others, including the MCMC. And I do believe that many of them are coming up, including the national AI office.
18:48I'm sure that many of these kind of initiatives are there. I'm not too sure whether you're open to critique, providing critique on how we do things.
18:57Perhaps a better way of asking is the best practices across the markets that you operate in.
19:05Where do you see them work well and in markets where they do poorly? And how do we stack up against against that kind of benchmarks?
19:14Great question. I will tell you this region is absolutely hands down leading and how they're delivering.
19:20I know this is the truth. You can look at and I invite you to go look at globally how how things like this are being implemented.
19:27Because I do this all over. I mean, yeah, I'm sure.
19:29Everybody all over the world. Yeah, I spent I'm here once a quarter or so for a reason.
19:33And that's because the ASEAN region, particularly Malaysia, is the only place that I go where you have all hands working together towards the same goal.
19:42You go to other regions of the world and they're happy to write policy, but then they can't implement anything or it takes forever to implement something because they're all arguing about it.
19:49Here it's a lot more synergy as far as you're going to be, you know, leading in the ASEAN region alone, but also in Malaysia in particular.
19:57Every time I come here, the conversation is always driven to the same goal.
20:01There isn't an influence of something that doesn't matter. It just seems to flow like that.
20:05So I do think it's critically important for Malaysia to keep going to prove that you can partner with enterprise.
20:11You can partner with other governments. You can lead in the region because it is it is working.
20:16But of course, ASEAN has markets where we are at different levels.
20:21And it's very hard to find a unifying factor or at least across across the board to find a uniform policy that can be implemented as a whole, as a region.
20:31Do you see this as a as a crippling factor?
20:34That's a global challenge. I call that what I call that watermarking and crosswalking of security control.
20:41So this is because it gets really complicated. And if you think about this, every security control ever written around the globe might require something like people need to have background checks if they work in a company.
20:52We'll just take that because that would be everything. Right.
20:54We've got to keep track of that level of those background checks.
20:57Maybe they're looking for a criminal background or maybe the next one is looking for how long have you lived at your address?
21:02Maybe the next one is looking for, you know, what citizen are you of a country of with the watermark those and then crossmark crosswalk those across.
21:10That covers this policy that covers this framework that cover, you know, how many of those.
21:15So it does get complicated very quickly and it is messy because regions want different things.
21:23Nobody comes into this saying, you know, hey, my shop that makes tires, rubber tires, has a way different set of security requirements than a bank.
21:33The tire company wants to make the cheapest, best tire they can.
21:36The bank has a whole different level. So how do you make those relative?
21:40So in reality, when you think about things like that, they'll never be the same.
21:43They shouldn't be the same, but they have to work together.
21:46So there should be a low level watermark of everybody should just have background checks. Right.
21:50And then you can ratchet it up for how intense those get, you know, based on the need of a tire manufacturer or a bank.
21:56Right. So it is messy by design, but you harmonize well.
22:00And that's the critical point. You do a great job in this region of harmonizing that by industry where I've seen that happen.
22:08And it works well for you. It hasn't worked well in other parts of the globe.
22:11So, again, hats off to you for at least having the wherewithal to think about how to crosswalk those controls.
22:17Working with China, does that does that add, you know, I don't know, risk in terms of how companies should approach things?
22:25The big thing with working anywhere in the globe is we have to pay attention to what's happening with security risk altogether.
22:32It doesn't matter who you're working with as far as where the doors are open, because honestly, the bigger crime that we're seeing right now is borderless.
22:40It really it's it's borderless. It doesn't really matter where it comes from.
22:44The impact is the same. You know what they're stealing is the same.
22:48The risk is the same. You don't want your conversations.
22:52You don't want espionage anywhere, let alone where it comes from.
22:55So, you know, it isn't really a regional barrier for me.
22:57It's just kind of looking at the whole risk of espionage.
23:00We're seeing it. So it's a big thing.
23:02Finally, maybe the next three to four minutes, I want to ask you about BlackBerry itself as a company.
23:10It's awesome. I love BlackBerry.
23:13I think I got my first BlackBerry Bowl when I first started working.
23:16So that gives you a hint on how old I am.
23:20BlackBerry Storm as well. My God.
23:23But yeah, how is BlackBerry today? And how will BlackBerry be?
23:28Or what will BlackBerry be in the next decade to come?
23:32So BlackBerry is...
23:33And I watched the movie. I don't know whether...
23:34Oh, absolutely. Absolutely.
23:36So BlackBerry is a fascinating story to me still.
23:39And I've been, you know, with BlackBerry for a very long time.
23:42But, you know, we have we do have 40 years of securing communications, which is amazing.
23:46And it's been awesome to see the transformation.
23:48I just can't believe it. It's 40 years.
23:50It's 40 years, right?
23:51And to see the transformation that this company has done, it's just...
23:54It's incredible to watch.
23:56But it just goes to show the power of...
23:58That handset had a lot of stuff running inside of it, right?
24:00It had... It was the mobile device.
24:02But it had all that security software.
24:04And that's what people really wanted to keep.
24:06Aside from the keyboard, which I can't comment on.
24:08But, you know, what really people...
24:10But it was an enterprise-ready device.
24:12Yes. People really wanted that level of maturity.
24:14And so what we did as a company is we took out all of that and made it available for everything.
24:19Rather than just you had to have this phone.
24:22You know, we still have all the platforms that were in the phone.
24:24They're just now software-based.
24:26So you can still use our, you know, our unified endpoint management, which is what, you know, controlled the handset itself.
24:32You know, you've got, you know, our SecuSuite, which is the secure communications platform, which allows you to send encrypted.
24:39You know, this is, again, government-grade encryption, not handing out ciphers at Starbucks encryption.
24:45Because, you know, if it's not certified, you don't know what it is.
24:48Yeah.
24:49Allows that for voice and for text messages and file sharing.
24:53So that's the second thing.
24:54And then we have ad hoc, which is critical events management.
24:57So natural disasters, which has been a big, you know, a big global issue has been, you know, the typhoons, earthquakes, bridge collapses.
25:07We've seen it.
25:08That's a person management system where you can account for all of your employees.
25:12So, you know, and then we still have the IoT side of the business, which is the, you know, secure operating system that is in most of the vehicles that you drive.
25:19We secure stuff for all G7 governments and most of the G20 and NATO.
25:24So we're still that security company.
25:27It's just now it's software, which has been a fascinating ride to watch just kind of that happen over the years.
25:35Yeah, the ebb and flow and the transformation.
25:37Yeah.
25:38And I predict that BlackBerry, you know, over the next five years, will just continue to deepen and getting back to that route of we are the secure communications company, like we've always been.
25:48So I do.
25:49I just I think we'll just kind of continue on that.
25:53And especially with regions like this that really want data sovereignty.
25:56It's very important.
25:57Great way to end, I suppose.
25:59That was Christine Gatsby, the vice president, as well as the chief information security officer of BlackBerry.
26:04You can learn more about the security work that BlackBerry does on their website.
26:09Or you can find out more with what's happening at the the Cybersecurity Center of Excellence at Cyberjaya at Talent Corp, as well as with us.
26:20Yes.
26:21Until then, thanks very much for watching.
26:22Catch you in the next one.
Comments