start	end	text
11420	16160	Hello, and welcome to the Aerospace Village panel discussion on building communications
16160	21840	across the aviation ecosystem. Hi, let me introduce myself. My name is Katie Trimble-Noble,
21840	26560	and I'm the Director of Product Security Incident Response and Bug Bounty at Intel.
26560	32260	So, I run the Bug Bounty program as well as researcher outreach and engagement,
32700	38540	and I've been really in the ecosystem for many, many years. Prior to coming over to Intel,
38540	42280	I worked for the Department of Homeland Security, where I was the Section Chief for
42280	47280	Vulnerability Management and Coordination. So, I've been doing this for several years.
47300	51760	Throughout my career, I've coordinated and disclosed over 20,000 cybersecurity vulnerabilities.
52060	56500	So, I really want to jump in right now. We don't have a lot of time today, and I want to
56500	61000	go ahead and introduce our panel. So, we're going to ask everybody to go through and introduce
61000	72290	themselves. So, Randy, can we start with you? Yeah. Hi, I'm Randy Talley. I'm a Senior Advisor
72290	77810	with DHS's Cybersecurity and Infrastructure Security Agency. I've been working in aviation
77810	88050	for quite a while as a pilot doing aviation security for DHS and have been on the, excuse me,
88050	97490	the Tri-Chair, the DHS Tri-Chair for the Aviation Cyber Initiative for the last two and a half years.
99230	101250	Awesome. Sid?
102770	111070	Hi, everyone. My name is Sid Geji. I work at FAA. I'm a manager within the
111070	117510	Office of Information Security and Privacy. I've been with the agency about 14 years,
117510	125370	and in a variety of different roles. And I serve as the Tri-Chair for the FAA on the Aviation
125370	132070	Cyber Initiative for the past two and a half years as well. I am glad to be here. It's my first year
132070	139830	at DEF CON. Lots of people in the room, you know, virtually, and I look forward to learning from you
139830	146610	all. So, glad to be here. Yeah, thanks. Welcome, Sid. Welcome to DEF CON. I hope this experience
146610	151550	is awesome for you. You get a little bit of a different flavor this year. So, John?
152310	157850	Hi, my name is John Craig. I'm the Chief Engineer of Cabin Network and Security Systems at the
157850	163370	Boeing Company. I've been there for around 34 years. I've worked in all sorts of systems groups
163370	169930	on commercial airplanes, and my current role has me working all the cabin systems, the networks on
169930	175450	the airplane. I work the development of the connectivity links, and I'm responsible for
175450	181090	product security for commercial airplanes. I'm also the Chairman of the Aviation ISAC,
181090	190030	and really like to encourage people to look up that organization. It provides a great sharing
190970	199450	opportunity in aviation. Thanks. Yeah, welcome. Jen? Hi, I'm Jen Ellis. I'm the VP of Community
199450	207030	and Public Affairs at Rapid7, and I am probably the least of the aviation experts on this panel.
207030	212470	When I say probably, I mean definitely. But I represent the voice of, I think, the security
212470	218970	research community, and my job is to think about how do you leverage security research and insight
218970	228530	and expertise to create social change that makes a more secure, safer world. Awesome, awesome.
228530	235810	Jeff? Hi, I'm Jeff Troy. I'm the President of the Aviation ISAC. I've been in that role for about
235810	241010	three and a half years. I also work for General Electric. I'm on the staff of the CISO at General
241010	246410	Electric Aviation, and I'm on the Board of Directors of the National Defense ISAC, so
246410	254070	very engaged in the information sharing world. Prior to that, I was with the FBI for 25 years and
255190	263270	left there in the cyber division, you know, working the cyber criminal and national security cases.
263930	270630	Glad to be here, thanks. Yeah, happy to have you. Alan? Hi, I'm Al Burke, and I'm an Associate
270630	275210	Deputy Director in the Air Force's Cyberspace Operations and Warfighter Communications,
275210	279370	and I'm also the Department of Defense Chair for the Aviation Cyber Initiative.
279370	282810	I come out of the airspace and missile defense operations community,
282810	287330	and my primary focus in the ACI is on improving cybersecurity
289370	296390	initiatives and resilience of derivative aviation capabilities where the DOD,
296390	303270	interagency, and industry objectives intersect. Awesome, awesome. I'm excited to hear more about
303270	307970	that later. So now that we've all kind of introduced ourselves and we have a good idea
307970	313650	who we are and where we come from, you can see we have a just jam-packed panel full of awesome
313650	318350	aviation cyber and researcher professionals here. So I'm really excited about it. Let's,
318350	322350	let's really just jump right in here. So today, in this panel, we're going to talk a little bit
322350	327430	about some current activities between government, industry, security, the security community,
327430	332190	the responsible disclosure community, some information sharing, and some improved
332190	337570	collaboration and coordination across the aviation sector. So really jam-packed. I want
337570	342310	to step back just a little bit and explain and go through just a little bit of the groundwork
342310	349330	on what the Aviation Cyber Initiative is. And so Randy, can you talk really briefly about what the
349330	355350	Aviation Cyber Initiative is in the tri-chair? You're good. You'd love to. Aviation Cyber
355350	363010	Initiative actually started probably around five years ago, the 2016 timeframe. It was,
363010	368390	it was originally focused on, on aircraft only. There was some testing that our DHS S&T
369370	376590	folks were doing and, and was, was of interest to everyone. And we've, we've taken that,
376590	382430	and a lot of things has happened since that initial surge or testing, if you will.
382430	387130	The National Strategy for Aviation Security was published by the White House
387870	394950	about a year and a half ago. We're getting close to two years ago. And it specifically was a,
394950	401790	was an update. The NSTAS needed to be updated. It was dated back to 2016. It was old and it didn't
401790	406710	include anything about cybersecurity, nor did it include anything about UAS. So that was a big
406710	414790	upgrade, if you will, for, for the NSTAS. It also defined the aviation ecosystem, which,
414790	419950	which really helped us out and kind of defines the swim lanes, if you will, for,
420470	429730	for aviation security. So, so those, those six swim lanes as defined include the aircraft,
429730	436610	obviously, but also talks about airports, talks about airlines, airlift, airlift being the,
436610	443910	the cargo derivative, derivative or equivalent of the airlines, talks about actors, which can
443910	448990	mean anything from training to, to third-party vendors on an airport. It could, it could be
448990	453610	anything has to do with people. And it goes into aviation management, which is all the
453610	458770	infrastructure necessary to run the aviation environment. So, so all of those things are
458770	465850	swim lanes. It's a little easier for us, the Aviation Cyber Initiative, to, to, to talk about
465850	471830	this when you're talking about the various swim lanes as opposed to a big amorphous blob. So
472730	478510	what is the ACI? Well, I've talked a little bit about it initially. A year ago, we were
478510	482930	chartered by the Secretary of Homeland Security, the Secretary of Defense, and the Secretary of
482930	490850	Transportation to, to be a tri-chaired organization. So I have my DOD colleague,
491560	498290	Al, and Sid, my FAA colleague, and we lead this effort across the whole of government
498820	506330	to include industry and to include anybody that's really looking at aviation cybersecurity,
506330	512650	to pull them in and try to reduce our risks and increase our resiliency across,
512650	518090	across aviation. So I'm, I'm very proud to participate in that. That gives you a little
518090	521970	background. I don't want to get too much in, in depth in it, but I think that that should
521970	529550	answer your question. Yeah, really good. Thank you. So I want to talk a little bit about
529950	536670	some, a recent situation that I kind of really feel was a really good example of a watershed
536670	541950	moment within the researcher aviation and public sector communities. So this happened about a year
541950	547870	ago. And Jen, RapidSeven made a pretty, it's a pretty interesting disclosure on civil aviation
548610	553410	last year. Can you walk us through that and kind of give us your perspective on the process?
553410	560430	Yeah, sure. Absolutely. So we have a researcher, Patrick Kiley, who has done a lot around
560430	566530	transportation in the past. He has done a lot specifically with automotive. He's also a pilot
566530	574890	and he's building his plane as one does apparently. And so as part of his sort of, you know,
574890	580110	passion and enthusiasm in this area, he was investigating various things and he heard about
580270	589530	a technology used in small aircraft that is well known in the security community as being
590180	597310	sort of quite trivial to exploit. So the technology is CAN bus. And he heard that it was being used
598130	603250	as a way of sort of connecting avionics. And the avionics, you know, being the parts that control
603250	607590	the plane, he was like, well, that sounds quite dangerous. And he was well aware that a few years
607590	612150	back there had been a lot of noise made around about CAN bus in automotive. And there'd been
612150	616250	very widespread discussion in the automotive industry. And as a result, many automotive
617150	621850	organizations either moved away from using CAN bus or introduced additional mitigations and
621850	628890	protections. He had not heard of such a discussion in the aviation space. And actually on talking to
628890	633630	more people who work in aviation, he found that, you know, generally security people seem to believe
633630	637790	it was an issue, but said that they were having trouble in having this be talked about at the
637790	643810	right levels and get enough attention to really make a change. So he did some research on that.
643810	651150	And our goal with the research from the beginning was never to sort of shame a particular vendor or
651150	657330	embarrass a vendor. This wasn't a, we're going to take a specific vendor system and uncover
657330	662730	new vulnerabilities. It's much more of an architectural issue and a known issue. So the
662730	667930	goal was to look at a few different systems, verify that CAN bus was in fact being used,
667930	672890	and then talk about why that's an issue on a sort of strategic level and try and stimulate some
672890	679490	discussion in the aviation community around it. As a result, and also because we were dealing with
679490	685910	aviation and, you know, we recognize that aviation is a different space. It, you know, there is a
685910	690790	sort of life and death element when you're talking about things to do with aviation. We were very
690790	696590	cautious with how we approached it. Our typical disclosure process, which is documented and on
696590	702530	the internet, is normally a sort of 60-day process, sometimes a bit longer. This process took a year
702530	709130	and a half. And the reason was two things. One, we very much did not want to cause hysteria. You
709130	720770	know, as somebody who flies a lot, I know how easy it is to get spooked on this stuff. And I,
720770	724150	so we wanted to be very thoughtful with the approach that we took and we wanted to be very
724150	727830	balanced and as neutral as possible. And the second thing is that we really did want to try
727830	733770	and stimulate this discussion. That was our goal. So we wanted to try and involve as many people to
733770	739390	participate in that process as possible and really sort of like immerse the community as much as we
739390	749170	could. It was a somewhat mixed process. You know, there's not a lot of tried and true ways of doing
749170	754710	this in aviation, even for an organization like Rapid7, who have done a lot of vulnerability
754710	760470	disclosure, a lot of vulnerability research over the years. Aviation, you know, every sector is a
760470	768230	little different and aviation is certainly also a little different. And what we found was that
768950	774510	generally, people, including many of the people on this call, were very, very generous with their
774510	779650	time and their insight, their expertise. So we had a lot of people who were willing to talk to us,
779650	782530	which was great, because we were worried at the beginning that that wouldn't be the case.
783010	790590	But we also found that there was a bit of a flavor in the discussion that came across of,
790590	796610	you know, people sort of pointing out that we weren't aviation experts and that physical security
796610	802150	would take care of this and that, you know, we weren't understanding how pilots work. Now,
802150	807570	here's the thing, is certainly I'm not an aviation expert and I was very glad to have
807570	812550	input and have expertise from people who really are immersed in the space. It was a great learning
812550	818590	for me. But in general, I think anybody who works in cybersecurity is always going to be a little
818590	825670	leery of any sector that really leans hard on physical security as a response to cybersecurity
825670	832110	challenges. And while we were very aware, always very aware and acknowledged in the report
832110	839410	that physical access was required to exploit this system, we're also very aware that these
839410	843790	systems stay in place for a very long time and that motivated attackers will find ways,
843790	847430	particularly when you're talking about smaller aircraft, which might not have quite the same
847430	853110	degree of physical protection that, you know, sort of larger commercial aircraft might.
853110	859290	And so, there was a little bit of that. And I think Patrick probably felt a little bit
859290	863810	affronted every time he got told that he didn't know how pilots worked, since he may not be a
863810	870150	commercial pilot, but, you know, he has flown planes. So, it was good to get the feedback.
870150	877090	We were super grateful to have the ears and to have the feedback. And we certainly wanted to
877090	882450	challenge our own assumptions. But what we did learn through the way is that, yes, it's always,
882450	886550	with any Coordinated Vulnerability Disclosure, and we are big advocates for Coordinated
886550	892650	Vulnerability Disclosure, it is critical and key to build empathy, to listen actively,
892650	897310	to take on board feedback and to challenge your own assumptions, and to try and build trust. Like,
897310	901910	I think, above all, trust is where you want to get to. But you also have to know when to
901910	905230	hold the line on your, like, yes, challenge your own assumptions, but hold your line
905230	909750	once you've done that and you've verified that your findings are as you think they are.
909750	915110	So, it was a good learning process for us. And I think, in the end, the disclosure went well. One
915110	919170	thing, just before I wrap, that I'll say is I think part of the reason the disclosure went so well
919170	928670	was because of the role that DHS CISA played. I think that having the Vulnerability Management
928670	935710	Center part of CISA, which Katie was kind of running out of time, having you guys independently
935710	942050	verify the research findings and then decide that it was a significant enough issue to put
942050	947770	out your own alert to coincide with our report, that, to me, was a pretty big deal. It was actually
947770	953250	kind of a game changer, I think. I can't say whether we would have bowed to pressure if that
953250	956330	had not been the case, but I'm certainly very grateful that we didn't have to make that choice.
956330	961210	So, thank you. And thank you to everyone else on the call who helped educate us along the way and
961210	966850	gave us their time and their feedback. Yeah, it's definitely a complicated situation. I think
966970	971470	a lot of times it's difficult when you think about every sector is different and, you know,
971470	976170	your ICS systems, your embedded systems, your safety systems, they're very complex. And doing
976170	980850	that coordination up and down the hardware stack is a little different than you would necessarily
980850	985930	see in, say, a digital services sort of platform or in a general, typical, traditional software
985930	990970	platform. So, it's definitely learning, I think, for everyone. And there are some ups and downs
990970	996470	in that. And I think that when you look at it, you have to take it for... we're going to look at
996470	1001390	climate versus weather. You know, if we look at one each individual disclosure, it's pretty tough.
1001390	1006670	But in the end, we learned a lot. So, Randy, can you talk a little bit about... DHS got involved
1006670	1011030	in this disclosure. Can you talk a little bit about how DHS got involved in this disclosure and
1011530	1019310	what role DHS took? Sure. Yeah, we have the Vulnerability Disclosure Program that DHS runs.
1019310	1023530	Great group of folks. As a matter of fact, I think Jay Angus is going to have a panel at the
1023530	1029370	Aerospace Village on Vulnerability Disclosure. So, I invite you to go and listen to that.
1030090	1035670	Great, great folks. They approached me... great folks, including you, Katie... approached me and
1035670	1042210	said, hey, I've got an aviation thing. I need to get it to you. I need you to understand
1042210	1049910	we need to know kind of where we go from here. So, I was able to get the briefing from Rapid7.
1050250	1057750	Actually got to read their final draft report, if you will. And you have to realize in aviation,
1057750	1064250	aviation is a big thing. So, I've got a big background in aviation, but the CAN bus,
1064250	1072190	where it's installed, you know, different aircraft vendors, it's a huge thing to try to go,
1072190	1079590	yeah, I got this. So, how important is it? Well, it did require physical access. So, I can stand
1079590	1086890	down a little bit from that. I think everybody understood that. But, you know, what... how does
1086890	1095090	it affect commercial aviation? How does it affect small aircraft or the general aviation folks?
1095250	1100390	So, I said, look, we need to get it to two places. We need to get to the FAA. They're
1100390	1104790	the regulator. They should be aware of this because they need to make a risk assessment if
1104790	1112350	it's a big thing. We also need to get it to the Aviation ISAC. Aviation ISAC has their members.
1112350	1119470	They can quickly get it out to aircraft manufacturers and actually the folks who
1119470	1125010	are building systems and determine, hey, what can I do with this? Or what should I be doing with this
1125010	1134530	in the future? I think this was the first time since the ACI has been stood up that we've had
1134650	1140450	a vulnerability disclosure come to me. It's not the last time, but it was the first time.
1140450	1147150	It was handled very well, I think, by Rapid 7. I think they understood going in, you know,
1147150	1154850	the physical access aspect was a big deal, the acknowledgement of that. It wasn't the skies
1154850	1162270	falling. It was, hey, this is an issue and we need to address it. And I love that part of it.
1163190	1169090	I know our VDP folks, the vulnerability disclosure folks, were very interested in, hey, look, we need
1169090	1175470	to send out an advisory. It's going to mirror what we did on the cars years ago. And it's also
1175470	1182530	going to say, hey, it does require physical access. So then once again, not the skies falling,
1182530	1188810	we found a vulnerability, but this is something you should be aware of when you're architecting
1189150	1199790	a system. So it was very good for me. I enjoyed getting involved in it to this level. And then,
1199790	1204710	you know, the focus for that vulnerability disclosure is, can we get, you know,
1204710	1210250	how do we approach a mitigation? If we found a vulnerability, how do we approach a mitigation?
1210470	1216350	How do we close that down and make the system more safe and secure? And I think we achieved
1216350	1224770	that in this particular case. Great. Yeah, we go back to that physical security. And I think
1225270	1228830	overwhelmingly, one of the big things that was very different from, say, this disclosure to
1229390	1232590	a disclosure that we might see somewhere else is that this is more of an architecture
1232590	1237730	into a lot of different things versus, say, one particular product and one particular version.
1237730	1245530	And so just the impact was very awe-inspiring. We didn't know where things were. So we really
1245530	1249550	had to rely on the subject matter experts. And we really had to bring in a lot of different people
1249550	1255430	to ask and find out. And so, Sid, can you really quickly tell us about your work and how you were
1255430	1260270	brought in and talked to some of your colleagues at the FAA and the safety that was involved in
1260270	1271970	that? Yeah, sure. So, Randy brought this up last year. And I think I agree with you, Katie. I think
1271970	1277210	it was a watershed moment. That's a good way to describe it. We had a researcher that came forward
1277210	1285510	with a vulnerability. Rapid7 came to us and they said, hey, look, this is important. You know,
1285510	1293590	this is an issue. And so it really helped kind of spur a set of conversations within the FAA,
1294250	1299370	both from our ABS, which is this aviation safety organization within the agency.
1299670	1306370	The CISO was on the call. And it helped us, I think, you know, really connect different offices.
1306370	1312470	And so, granted, it's a physical security issue. And I believe the other thing that happened also
1312470	1320250	was TSA was notified. That's the agency that's responsible for all of aviation security in the
1320250	1327790	U.S. So it really helped us connect with different stakeholders and really laid the groundwork for a
1327790	1333870	process. There's going to be a lot of back and forth in such situations between the safety
1333870	1341150	engineers, the regulators, the researchers. And that's really, in my mind, very good.
1341190	1346550	And it's healthy. We want to spur those types of conversations. Everybody's not going to agree
1346550	1353650	on what exactly how big the risk is. And so it can get a little difficult to come to
1353650	1358910	get to the same page. But I think having those conversations is really important. And I think
1358910	1366990	this event helped us do that. So thanks to Rapid7, thanks to DHS and the ISAC for taking
1366990	1372790	the lead on this. Yeah, yeah. So that actually leads us right into, Jeff, can you talk about
1372790	1378070	the ISAC? And the ISAC is information sharing. And so if you really want to affect change,
1378070	1381950	you need to get the information out there. You need to make sure that people understand. So can
1381950	1388590	you talk to us about your involvement in this? Thanks, Katie. So first off, we were just really
1388590	1395930	highly appreciative of Rapid7's approach to this and allowing us to be invited in. Similarly to
1395930	1402290	Randy and the rest of the folks at the Aviation Cyber Initiative for being so inclusive, letting
1402290	1409290	us kind of get this information and be able to pass it out to the members. So like has been
1409290	1417470	mentioned earlier, the Aviation ISAC's role in these security disclosures is really a connector.
1417970	1422790	Jen highlighted how important it is for communication to be happening during these
1422790	1428370	events. And typically when they start, it's really hard for a researcher to find the right person in
1428370	1434270	the industry. We also mentioned here, though, that this was a little different. This is a technology
1434270	1439910	that's broadly used across the industry, and it's actually something a lot of other folks plug into.
1440990	1447110	Many times when a researcher has a particular disclosure they want to make, it's about one
1447110	1453470	type of product. There's one vulnerability in some design of a specific component.
1453730	1457690	When researchers want to get a hold of that company, frequently they're calling us because
1457690	1462610	if you want to get a hold of somebody in the industry, it's a lot harder nowadays actually
1462610	1467350	to find the right person. And we just happen to have them all connected in our community.
1467790	1472710	But this one was different, and it was a great learning experience for us all
1472710	1478690	because there was a little bit of a shorter window on the industrial side. But as we look
1478690	1483610	back at the event, it really made a lot of sense because there wasn't somebody that was one
1483610	1487830	particular company to take a look at this. This was more of everybody saying, hey, wait a minute,
1487830	1494030	we're all plugging into this. We really need to take a look at this as a larger issue and as a
1494030	1501270	systems issue. In the end, we did, and it's been mentioned as well, there was a physical security
1501270	1507070	component, that is one component. But in the whole concept of layered security, physical
1507070	1513450	security is just one layer. And when you find that there is an issue inside of any layer,
1513450	1519890	the objective in a really good layered concept is to harden that layer. And this was a really
1519890	1524650	good example of that. It's like, it doesn't matter if it's embedded in a lower layer,
1524650	1530190	let's get every layer as hard as it can possibly be and make it difficult for anyone to make that
1530190	1537210	complete penetration. So I would agree with everyone. I think this was a really good example
1537210	1543750	of how to do it right. And I think what was really impressive for us, too, as the trust
1543750	1549450	gets built across the engagement between the researchers and the industry, it was really good
1549450	1555510	to see what Jen talked about was the perspective right from the start. Hey, we don't want to get
1555510	1561890	people overly excited or hysterical about something. We really need to understand in the
1561890	1567630	whole equation of risk, you know, how big of a risk is this? And, you know, how does that risk
1567630	1573190	get managed? And their approach that they took, that cautious approach of really trying to get
1573190	1583050	that understanding and validation was really critical to the successful outcome. Awesome.
1583050	1590010	So I think this is a great opportunity and it was a great example of pieces that didn't ever,
1590010	1594090	you know, typically work together and who were new to each other and maybe didn't even know that
1594090	1598530	the other existed and were able to really pull together. And there were some ups and downs. And
1598530	1603470	in the end, Rapid7 put out their vulnerability information, DHS put out a complementary
1604290	1609150	security advisory, and I think it sort of laid the groundwork. So now that we kind of talked
1609150	1614350	about that, I really want to pivot to the current. So there are some really awesome progress being
1614350	1620470	made in the aviation and researcher communities. And it's hard to even pull a couple topics. When
1620470	1625610	I sat down to kind of go through and say, what can we talk about here? There were just so many
1625610	1631270	topics out there. The community is moving so rapidly. And I think even the aviation village
1631270	1636510	itself is something that 10 years ago, we wouldn't have even thought of. We could pull together and
1636510	1642070	do that. And so there's so many wonderful things. John, Boeing is getting involved in some really
1642070	1646690	awesome community outreach and community engagement. Can you talk a little bit about the tech council?
1647530	1653730	Yeah, I'll start off with, you know, aviation is a unique space. And we have a very strong safety
1653730	1659890	culture. We have a unique development process. And, you know, to some extent, I think we view
1659890	1666290	ourselves as being special. And, you know, Jen kind of mentioned earlier that when people come
1666290	1671450	from outside that community, the natural antibodies kick in and we find reasons to kind
1671450	1677770	of discount the feedback. I've been working in this space for 10 to 15 years. And, you know,
1677770	1684530	reality kind of kicked in on me when the Stuxnet virus was disclosed. And it broke all my,
1684530	1690670	you know, stereotypes of aviation and how we're unique. You know, and oftentimes I feel like an
1690670	1696590	evangelist out trying to spread the good word. Well, last year was a significant milestone,
1696590	1702290	and I'd say turning point for Boeing. A researcher got a hold of some of our executable code,
1702290	1708170	reversed engineered it, and disclosed things that were actually quite surprising. I think
1708170	1714610	we were surprised with the tools that allowed them to actually go in and, you know, kind of view the
1714610	1722490	code in, you know, in a space where we didn't think was really possible. We actually spent a
1722490	1728310	lot of time, several months, analyzing the code. We were in our lab. We have very extensive labs
1728310	1733710	that replicate the airplane quite accurately. At the end of it, we actually went out onto an
1733710	1739530	airplane. We brought all the systems engineers out to view it. We went through a bunch of scenarios.
1739530	1746190	Some of the claims, we actually went well beyond the claims. We did a pretty thorough test on a 787.
1747670	1754050	And at the end of that, our response, you know, not knowing, you know, it wasn't the real intent,
1754050	1758610	but I think it was viewed as hostile. And I got that feedback from several folks,
1760110	1765870	you know, in the aerospace village. And so after our analysis disclosure, we held a meeting with
1766010	1770230	a lot of key stakeholders. A lot of the airlines had a lot of questions for us. You know, what do
1770230	1775790	you think of this? Is it real? You know, we gave our synopsis. A lot of the government folks and
1775790	1779690	Katie were in one of the meetings with us. We had a spirited discussion with lots of different
1780230	1786330	government people, as you remember. And in that meeting, Katie kind of said, you know, John,
1786330	1791970	you really need to reach out to these folks and I can help you if you'd like. So we took that,
1791970	1797250	went internal to Boeing and we had some spirited discussions because this is really uncomfortable.
1797250	1803190	You know, changing how we've operated for a long time is not the easiest thing. But at the end of
1803190	1808650	the day, we said, you know what, we need to do this because these people are out looking at our
1808650	1813670	designs. They're not, you know, I don't think there's any ill will, but we need to embrace
1813670	1820330	them and we need to learn from them. And so we set up this tech council and we had several meetings
1820330	1825790	trying to level set a little bit. It's a little hard via the phone. And so after the RSA conference
1825790	1831590	in San Francisco in February, we invited them all back to Boeing. And at Boeing, we kind of
1831590	1837050	went over some of our design methodologies and, you know, met face to face. And that's a real,
1837050	1843530	it's real powerful to get to know people at a much more personal level. We took them into our labs,
1843530	1848890	showed them what we're capable of. We even arranged time on a 787 simulator. In fact, one of the
1848890	1854330	gentlemen was a military pilot and we set up kind of a difficult landing for him. High winds and,
1854750	1859390	you know, low light conditions, et cetera. He made it down good, which was positive.
1859510	1865190	But I think it went a long way to mending the adversary relationship. So as part of that, we
1865190	1873050	have part of this team, they have a, some folks have a claim they'd like to investigate with us.
1873050	1877010	And we're in the, we were in the process of bringing them into Boeing, into our lab to kind
1877010	1882510	of evaluate that when, you know, the COVID hit and that kind of slowed us down a little bit. But,
1882510	1887810	you know, I really want to embrace this and I want to expand it. And, you know, at DEF CON,
1887810	1892310	we actually plan on bringing, you know, real hardware, setting up some kind of
1892310	1898610	capture the flag event to kind of embrace this community much more. Another aspect of this,
1898610	1905250	we actually matured our vulnerability disclosure process. It is now very easy to find on the Boeing
1905250	1910030	website. At least I hope it is for folks. I was able to find it. And you can send your
1910030	1916990	vulnerabilities encrypted. We provide that means. And we're starting to receive a lot of stuff in.
1917050	1922770	And a lot of things that come in are shared between all the stakeholders. And as the product
1922770	1928310	guy for the airplane, we see all of it. And we actually evaluated surprising vulnerabilities
1928310	1934370	that are in the IT space. A lot of these systems are used in some form in aerospace. And so we have
1934370	1940970	to evaluate all those and see if we have the same issue that maybe the original claim came in with.
1941270	1944970	So I'll just close, you know, saying we're still crawling here. I'm really hoping to get
1944970	1951310	more engaged. You know, I think it's critical that we interject this into our designs. It's
1951410	1956390	a different view. And, you know, it's always powerful to get diverse opinions and diverse
1956390	1961070	perspectives. And those outside of aviation probably are more powerful at looking at our
1961070	1970270	designs than we may be. So thanks. Yeah, awesome. I know I remember sitting in some of those meetings
1970270	1975850	and I remember thinking to myself, why don't we all just talk? You know, why can't we just,
1975850	1979310	why don't we all just talk? And I can imagine that there were some people in that room who thought
1979310	1986490	that I was just that crazy lady from Homeland Security with these wild dreams of working
1986490	1990710	together. But I'm hopeful that we're going to see more of that and that that has actually worked out
1990710	1998990	really well. So yeah, you know, we're still in steps here. And I would like to, you know,
1998990	2002790	commend Boeing because Boeing did all the hard work on that. You know, the hardest part is
2002790	2008350	getting going and taking all of the steps that needed to happen in order to bring
2008350	2012570	people in and really get down into the labs and get into the weeds. And that takes a
2012570	2016250	lot of effort. And so I commend Boeing for that.
2019070	2022530	So Sid, can you talk a little bit about the FAA structure
2022530	2027670	and the work with the tri-chair and some of the things that you've been working with?
2031470	2039390	Yeah, sure. Thanks, Katie. I agree with everything that has been said on this great panel. I think,
2039390	2047490	let me make a few points. You know, we kind of oversee and regulate civil aviation. So we have a
2047490	2054470	unique role. We are the premier aviation agency in the US. We have authority over all the aircraft
2054470	2061670	that fly in the US and all the airmen, all the pilots, we certify them, we certify all the
2061670	2068170	aircraft. And we also conduct air traffic control, all the airplanes that take off and land are
2068710	2076730	controlled by the FAA. So it's a pretty big role. It's a pretty big responsibility. I think safety
2076730	2087470	is our focus and we are a safety agency. And so the way I see it is that cybersecurity is part
2087470	2096070	of our safety responsibility. And I run into that all the time. As a tri-chair for the ACI,
2096070	2102390	it's really a big task is culture change. We are trying to bring that culture of security
2102390	2109870	and looking at how to improve the security of the whole ecosystem into an agency that's focused
2110470	2117390	primarily on safety. So in terms of vulnerability disclosure, we don't have like a formal program.
2117510	2123870	We don't have like a way that you all the researchers can come forward and directly to us.
2124710	2131510	We rely on DHS, which is our partner through the ACI. But that does not mean that we are not open
2131990	2140490	to all of your ideas. I think the fact that I'm here on a panel, you know, I'd love to hear from
2140490	2148610	you all. And we'd love to have that dialogue about what the risk is and what some of the
2148610	2153470	vulnerabilities are. So I want to echo what has been said earlier. I think trust building
2153470	2159730	is incredibly important. We all should come together. And like Katie said, we need to be
2159730	2167790	talking all the time and exchanging notes and exchanging ideas. Let me share a quick story.
2167790	2175650	About two years ago, I was at the Pentagon. And DoD has this team called Gen5. That's basically
2176150	2181110	a bunch of very smart people, just like you all, that were looking at some of the vulnerabilities
2181710	2188330	within ADSP, which is our system for surveillance-based air traffic control. It's
2188330	2193670	satellite-based, I'm sorry, air traffic control. We are moving away from radar into satellite-based
2193670	2202590	GPS radar control. And so they had worked on this project for about a year to look at some
2202590	2208050	of the vulnerabilities within ADSP, which is a huge investment for the FAA and for the American
2208050	2216410	public. And I was with the CISO at the time and some other executives from FAA. And we just thought
2216410	2222970	it was fantastic. I mean, to invite these researchers into the Pentagon and have them test
2224390	2230670	an aviation system and hear some of their ideas. They actually came out with a report,
2230670	2236450	which was super insightful. And we took it all the way to the National Security Council.
2236890	2242310	And that has formed a basis for a lot of the follow-on work that's going on within ACI
2242830	2249310	for ADSP. So, you know, I told my boss, this is something we need at FAA, too. We need a
2249310	2254610	team like this to come in and test our systems and bring a completely different perspective
2255390	2262910	than what the agency is used to. So that coming together of the researchers,
2262910	2270370	of the research community, of the safety folks, you know, of the air traffic controllers and
2270990	2276290	the IT people, all that has to happen because it's really about bringing all those disciplines
2276290	2282310	together to tackle what is a very difficult sort of problem. I mean, we are looking at risks
2282310	2288670	across the ecosystem. And so that conversation needs to happen between the different disciplines.
2288710	2295050	I just did an online cyber course through Harvard a month or so ago. I finished it.
2295050	2299830	It was like an eight-week class. Let me just share a couple of things. Every organization,
2300750	2305670	including aviation, has operational risks, reputational risks, and legal risks when it
2305670	2313190	comes to cybersecurity. So a cyber breach can cause huge damage, millions of dollars in terms
2313190	2319710	of your operations, in terms of your reputation. Something to think about. Second is that we need
2319830	2325550	a culture within cybersecurity where we reward people for being skeptical. You know, you don't
2325550	2332650	want to just kind of reward people who are sort of agreeing with what's going on. You want people
2332650	2337650	to look skeptically at what's going on and tell you a different way to do things. We want to reward
2337650	2343910	people who want to break things because that can lead to a more cyber secure posture. And a lot of
2343910	2352490	the challenge that we face today as organizations has to do with information sharing, has to do with
2352490	2358430	culture change, and trust building. And so those are the tasks that we are all involved with.
2359870	2363990	So information sharing should be happening all the time. And that's what the ACI is
2363990	2369570	designed to do within the government, between our three big departments and with industry.
2370210	2376350	I want to... the last thing I want to say is also the fact that the aviation ecosystem faces
2377610	2382950	a lot of state and non-state cyber threats. The threats are very real.
2383530	2387890	There are known vulnerabilities within this ecosystem. We all recognize that.
2388430	2395330	So that can impact the operations within the national airspace and civil flights.
2395930	2401290	And the fact is we got to tackle those threats and risks together.
2401670	2410830	And so the FAA issues cyber situation reports today which address specific equities across
2410830	2417610	this ecosystem. And some of those are externally tailored to partners outside of FAA. So those
2417610	2428250	include other federal agencies and industry partners. And that's what I have. So thanks, Katie.
2429090	2435210	Yeah, awesome. It's really exciting to kind of hear some of the things that get passed around
2435210	2439470	and just really are exciting initiatives. The Pentagon has, I know, been deeply involved in
2439470	2445630	aviation for, you know, I was in the Air Force, so, you know, since forever. And so it's really
2445630	2452670	great to see these very, very established organizations get excited about working with
2452670	2459070	research and breaking things. That just makes my day. So these are really awesome initiatives and
2459070	2463230	I'm really excited about them. I want to move to the future for a little while. We kind of talked
2463230	2467050	about the past and we talked about the current and then I want to kind of talk about the future
2467050	2473410	really quick. And so I think the DOD's got kind of a really fun new initiative that I'd love to
2473410	2478530	hear more about. I think it's called the INFACTOR. So Al, can you talk to us about the INFACTOR?
2479090	2483350	Hey, sure, Katie. Hey, just as a little background before we dive right into the
2483350	2488270	INFACTOR. So we talked a lot about identifying and sharing cyber vulnerabilities, sharing
2488270	2493950	information. But going forward, the future is that we need to work together to close those
2493950	2500210	vulnerabilities using a threat-informed, risk-based approach. And that points us to two trends
2500210	2506830	the aviation ecosystem must address. You know, like Sid said, the first trend is the cyber threat
2506830	2512930	to aviation is real and growing. So it's highly likely that advanced nefarious cyber actors, to
2512930	2518810	include adversary nation states, will use cyberspace to steal our aviation intellectual property
2518810	2524870	and to conduct cyber operations to damage the reputation of U.S. and allied aircraft and
2524870	2529970	aviation industries, to gain a competitive advantage for their own industries. And so from
2530110	2534890	a national security perspective, improving the cybersecurity and resilience of our own
2534890	2540790	nation's aviation ecosystem to counter this threat is key. And for the Department of Defense, we have
2540790	2545970	to be able to project power, defend the homeland, and protecting critical aviation infrastructure
2545970	2551150	is part of that. But there's one thing we acknowledge. This challenge is not something
2551150	2557810	the Department of Defense or the government can do on its own. So recognizing these two trends,
2557810	2562370	recognizing that trend, you know, requires an increase in a public and private sector
2562370	2568130	collaboration or whole-of-nation approach. I don't know if you're aware, but Congress recently
2568770	2574890	chartered the Cyberspace Solarium Commission. And in this commission report, it identified
2575330	2580970	the need to increase public and private sector collaboration. And the goal is to improve our
2580970	2588490	speed and agility in addressing cybersecurity and resilience threats. And so the N-FACTOR that you
2588490	2594170	referred to, which stands for the National Federation of Aviation Cyber Test Organizations
2594170	2600670	and Researchers, the N-FACTOR, is a great example how the Aviation Cyber Initiative is pushing to
2600670	2605950	work on this. And so the thing that the Aviation Cyber Initiative does is, you know, we bring
2605950	2612390	together that whole-of-nation approach, bring together the cyber experts from federal agencies,
2612390	2620110	state agencies, industry, our federally funded research and development centers, our university
2620110	2628310	affiliated research centers, our national labs, all working together in the N-FACTOR to achieve
2628310	2634950	three lines of effort. Those lines of effort are, one, is catalog, collaborate, and connect.
2635010	2641210	And so, you know, just at a top level, we talk about catalog, our big push is to create a
2641210	2647770	national-level aviation cyber resource guide. And the goal of this resource guide is to be
2647770	2654270	an online, accessible, and searchable database of aviation cyber research, development, test,
2654270	2661510	and evaluation resources, expertise, facilities, and capabilities. And so, if you're part of the
2661510	2667830	N-FACTOR and you're working on initiative to counter, to look at cyber fuzzing or any of
2667830	2674570	these other kind of cyber trends, you could go to the resource guide and it'll give you a list of
2674570	2679830	who's working in that space, what kind of capabilities they have to test, and what, and
2679830	2686030	more importantly, how you can get to hold, get a hold of them to further collaborate. And so, the
2686030	2692370	collaboration is our second line of effort. You know, the goal of the collaboration is to create
2692770	2698470	a persistent collaboration forum where these cyber experts, this whole nation approach, can get
2698470	2706030	together and be able to spotlight or showcase capabilities, share information on projects,
2706030	2711790	and more importantly, if a, like, let's say, for example, you're working a project on intrusion
2711790	2717110	detection, cyber anomaly and intrusion detection, you can come to the N-FACTOR and present your
2717110	2726190	project and give us asks. And in the ask, the goal for the ask is that the N-FACTOR try to close
2726190	2731930	those gaps. And when we talk about closing those gaps, we call that a connect. And that's the third
2731930	2739030	line of effort, to connect projects, efforts, research papers with resources to do things like
2739030	2745730	test, validate, and move forward projects. And just a couple examples. You know, on the
2745730	2750930	collaboration side, Johns Hopkins APL did a presentation on how they were doing cyber
2750930	2758310	modeling on various aircraft. And the aircraft they were doing the modeling on, it so happened,
2758310	2763790	since John Craig was on, they were Boeing aircraft. And so, you know, after the meeting,
2763790	2768190	John and his team got together and said, hey, we probably need to know more about this modeling
2768190	2773610	effort. And oh, by the way, maybe we can work with Johns Hopkins to make it better. And so right now,
2773610	2778930	that's what we call a connect. We're working to bring those Johns Hopkins APL and Boeing together
2778930	2784510	to talk about how they can enhance that cyber modeling. And then on the resource sharing side,
2784510	2788850	we had a project come forward that was working on a cyber anomaly and intrusion detection
2788850	2796230	capability with AI machine learning based. And they needed a data tap to pull data from 1553 bus.
2796230	2800370	They didn't have it. And they also needed large quantities of data to support,
2800370	2805870	you know, training a machine learning and AI capable tool. And so we connected them with
2805870	2812050	the Air Force Research Lab and provided a tool called Vampire, which is a aviation bus tap,
2812050	2816510	and shipped that to them. And then Johns Hopkins APL again came through,
2816510	2823270	and they've been working on a data sharing effort that's been fantastic in terms of connecting. So
2823270	2828310	those are the kind of things that the end factor is trying to do. And we're trying to do it at
2828310	2834050	scale. And so that leads us to the, I'm sure people are saying, so how do you participate
2834050	2840230	in the end factor? Well, we got a couple asks. You know, first off, we're focused right now on US
2840230	2846690	organizations. So if you want to be a part of the end factor, what we ask you to do is three things.
2846690	2854590	First, we want you to one, agree to populate our aviation cyber resource guide with your
2854590	2862670	company's capabilities and resources. So that's one. The second one is, we want you to participate
2862670	2870170	in our tight 90-minute monthly forum. It's the end factor collaboration forum. And our goal is
2870170	2876570	to be able to showcase all our major participants as we go forward. And to participate in follow-on
2876570	2882170	meetings, you know, should those connects happen. And the third one is, that is the connect part.
2882170	2888330	That if you have capacity, and if you have resources, we would like for you to help connect
2888330	2895790	others to serve as a mechanism to accelerate our cyber innovation in the aviation ecosystem.
2895790	2902370	And so that's the kind of the three asks. I'll tell you, just yesterday, we had nearly 100
2902370	2909170	participants from across more than 60 organizations participate in the end factor forum. Our FAA tech
2909170	2916930	center and DoD guides are working to deliver the aviation cyber resource guide by the end of August,
2916930	2922310	at least the first instantiation of it. It's based on the FAA's technical capabilities library.
2922550	2928990	And I would say, you know, in fact is growing. And I think it's exceeding many of our expectations.
2929350	2935010	And what we want to do is get more people to work with us. So we can do what I like to say,
2935010	2940670	collaborate with effect. And so that's, that's the end factor going forward,
2940670	2945470	working to address the threat, and to increase our public and private sector cooperation
2945470	2951210	across the aviation ecosystem. So Al, let me ask you really quickly, is that,
2951210	2955970	is this initiative specific to military aviation, or is it open to civil aviation as well?
2955970	2961970	No, it's, it's, it's not limited to military aviation. In fact, it's not a DoD initiative.
2962190	2969170	It's an aviation cyber initiative, initiative. And so, you know, we have a charter to engage
2969170	2974450	industry. And so we're, we're working to do that in spades. And, you know, at least a couple
2974450	2980310	times a week, we're reaching out to bring our industry partners and really small businesses,
2980310	2986110	you know, which we think the small business, businesses are real powerhouses in innovation.
2986150	2990410	And, you know, when we can connect them with the larger big companies like the Raytheons and
2990410	2995110	Boeings of the world, then we can, we believe that we'll be able to accelerate aviation
2995110	2997830	cybersecurity capabilities.
3000240	3009040	Awesome, awesome. So we have about eight minutes or so left. And so I really want to
3009940	3017160	close up with some of our closing thoughts, and some just kind of words of wisdom and
3017160	3022780	things that we've learned from each one of the participants. So Randy, can we start with you?
3022780	3027240	What are your, what are your words of wisdom, things to take away, closing thoughts?
3028200	3034220	Things to take away? Well, I'll tell you what, Katie, I'm super proud of what we're doing under
3034220	3041380	ACI. I think it's, I think, I think it's time that we reach out across the entire ecosystem
3041380	3047360	and try to pull people together and have those conversations, address those vulnerabilities.
3047360	3053960	And, and I think, frankly, I think this is beginning to work. You know, working for DHS
3053960	3060100	CISA, you know, I've got that, that outward look. I'm looking to industry. I can pick up the phone
3060100	3065660	and call virtually anybody on this panel at any time. And if they're not in a meeting, which they
3065660	3071400	always are, they'll answer the phone and we'll have a conversation. This is, this is collaboration
3071400	3077840	at its finest. And, and I gotta say, you know, and I know we're limited on time, so I'll, I'll
3077840	3084340	stop it here. I love my job. And that, and these are the reasons why I love my job. The people on
3084340	3088720	the panel, the things that we're trying to accomplish and what we're trying to do through
3088720	3096440	ACI. I'm very proud of that. Yeah, it's wonderful. It's something that I think is really going to
3096440	3100140	make a difference. And that's, that's very exciting. I'm excited to be proud of it or to
3100140	3110780	be part of it. Sid, what are your, what are your thoughts? Well, I, I want to say that COVID-19
3111240	3114760	obviously has affected the aviation industry. It's transforming,
3115320	3120260	it's going to transform how we travel. It's going to change so many things. And
3121960	3125380	we're, you know, we're going through a change right now as an aviation industry,
3125980	3131520	but that does not mean we ignore the cyber threats. The work we are doing here
3132840	3139260	on this panel and the work I do through the ACI is incredibly important.
3140220	3147120	The cyber threats are real from both state and non-state actors. It's a combination of physical
3147120	3153280	security and cybersecurity and the information technology and operational technology,
3153280	3160220	safety, security, all of that. And the ecosystem is a vast complex network. So
3161120	3166960	there's a lot of vulnerabilities to it. A cyber breach can happen anytime.
3167260	3172740	There are threats out there and an attack can cause millions of dollars of damage
3172740	3180180	and a loss of reputation. So it can shake public confidence. It can change again,
3180180	3185740	the nature of flying. So we cannot ignore it. I think the work we're doing is super important
3185740	3191160	and I'm privileged and I feel lucky to be part of this team of so many smart people
3191660	3197040	who are doing such incredible work. So thank you for having me. You have my contact information,
3197040	3205240	so I urge you all to reach out to me anytime. Awesome. John?
3210260	3219140	So, you know, the last year has been interesting and we have got much more of a focus at Boeing on this.
3219440	3224020	We do daily report outs to the board of directors. In fact, we have a champion on our board.
3224060	3230960	We are leveraging our enterprise to not only help us with incident response, but helping
3230960	3237120	to beef up our design guides. We have expanded our product
3238500	3244460	cert team and we're being much more proactive at looking at things.
3245360	3251340	And then we're looking at things across board. How do you create a process to evaluate threats
3251340	3257160	and risks? And we're looking into that. We're actually working with industry and the government
3257660	3263640	on, you know, how do we do that effectively? But key is we're really starting to engage outside
3263640	3269340	of aerospace. And I think that's going to be the thing that really helps us the most. You know,
3269340	3274980	the tech council is one, but participation at DEF CON so we can build those relationships,
3274980	3279760	RSA conferences, et cetera. So it's pretty exciting. It's really exciting right now
3279760	3286920	and a little uncomfortable, but it's good. So thanks. Yeah. Embrace the uncomfort.
3288100	3294520	Jen? Katie, I'm honestly kind of blown away. You know, I think the whole purpose of the
3294520	3300940	Aerospace Village is to increase understanding and appreciation of the importance of cyber
3300940	3307800	security in aviation and to do so in a way that builds trust between the security community,
3307800	3314100	the aviation industry and the government, which all play a very, very important role in advancing
3314100	3319080	cyber security in aviation. And when I sit and I listen to my panel of panelists talking about
3319080	3322920	some of the amazing initiatives they've got going on and hear their attitudes and their responses
3322920	3328220	to the research and that kind of stuff, I just, I feel like we're in such a dramatically different
3328220	3334180	position to where we were a couple of years ago. And I hear people saying that they want to hear
3334180	3337060	from the research community. They want to hear from the security community. They want to partner
3337060	3343100	and collaborate. And that is, that's an incredible opportunity. And I hope that anybody listening,
3343100	3348000	particularly people who are participating in security research in some way, that they get a lot
3348000	3352380	of hope and optimism from this and feel that they can engage and that they can build trust,
3352380	3362820	they can build empathy and they can get involved. Yeah, it's very exciting. The trust and the
3362820	3367080	relationships, I think, are some of the most important factors in all of this. It's
3367080	3373520	getting involved. So yeah, getting involved. Jeff, information sharing, what have you got?
3374060	3378800	Oh, thanks a lot. I think this has been a great discussion. And, you know, we only went through
3378800	3385820	one example. But at the Aviation ISAC, we've had several of these events happen over the last
3385820	3391160	couple of years. And each one of them pretty much follows this pattern of building a great
3391160	3397080	relationship with a security researcher, finding out, you know, what a vulnerability is that
3397080	3402200	they've discovered, and then going through that validation process of, you know, is it really
3402200	3408120	an issue? Or isn't it an issue? And then, you know, working through the remediations and
3408120	3413380	disclosures when those have to happen. And, you know, likewise, we have found this to be
3413920	3421180	incredibly eye opening. And, I mean, so much so with the researchers, we've even hired one, which
3421800	3428380	helps us tremendously, particularly in the work that we're doing now. So I am glad that
3429120	3434760	there's been kind of this breakthrough and that we're seeing, you know, the bridge is being built,
3434760	3443240	and I only think it's going to get better. Awesome. Al, what are your closing remarks,
3443240	3448520	closing thoughts? Okay, hey, Katie. So kind of echoing across the board, I think the most
3448520	3453720	important thing is one is we have to recognize that the threat is real. And we should learn
3453720	3458780	from the maritime sector's NoPetya attack. We shouldn't have to wait until a serious cyber
3458780	3466100	attack of our own on the aviation ecosystem occurs. And the key to preventing that is to embrace the
3466100	3472120	idea that there's safety in the herd. You know, we need to strengthen the aviation herd, you know,
3472120	3477440	by continuing to share information, vulnerabilities, and work together to address those
3477440	3482540	vulnerabilities to improve our aviation cybersecurity and resilience. And so threats
3482540	3490000	real, and there's safety in the herd. Terribly true. Very true. So I guess my closing remarks,
3490000	3496340	then, I will say that the thing that I take away from all of these things is that I go back to
3496340	3500900	coordinated vulnerability disclosure. And I say that coordinated vulnerability disclosure is an
3500900	3506320	essential part of any security research. I think that everyone here and everyone that I've met,
3506320	3510580	from varying backgrounds all over the world, everyone has the same goal. We may not all speak
3510580	3515640	the same language. We may talk past each other. But I think ultimately, we have the same goal.
3515640	3519660	And that goal is protecting the end user. It's reducing risk and making people safer.
3519820	3525260	And so I think the last thing that anybody wants is to inadvertently put countless people's lives
3525260	3531140	at risk, economic situation at risk, because we published a roadmap that if that fell into the
3531140	3536620	wrong hands could just wreak havoc. So I go for coordinated vulnerability disclosure because it
3536620	3543900	really is a balancing act. It's a process that allows us to mitigate or to balance while we're
3543900	3552820	trying to mitigate. So that's my closing advice. I feel like all of the progress that we've made
3552820	3559280	is so wonderful. We have a long way to go. I love the fact that we're all talking to each other
3559280	3565140	and we're working together. But I want to make sure we know that there is a road ahead of us.
3565140	3573320	That road to me, the future looks bright and I'm excited for it. So thank you guys for coming to
3573320	3579300	the panel and listening to us. And if you have any questions, our contact information is up.
3579320	3583200	I think there's going to be an opportunity for some live chat later at some point. So
3583200	3587180	you'll be able to find out more information about that. If you have any questions or want to talk
3587180	3592480	more to us, please feel free to reach out. I think everyone here would invite a conversation.
3592480	3601380	It was great talking to everybody today. Thank you.