1
00:00:06,980 --> 00:00:15,280
So, hi to everybody at the Aerospace Village and dialing in for our panel, where we're going to be talking about the hacker community and ISACs.

2
00:00:15,280 --> 00:00:20,460
I'm Pete Cooper, the Director of the Aerospace Village, and I'm going to be hosting for the next 50 minutes.

3
00:00:20,860 --> 00:00:29,400
Now, across the aerospace sector, good faith security research has played a hugely key role in highlighting both risks and vulnerabilities.

4
00:00:29,600 --> 00:00:38,920
But if the researcher or hacker can't find a good point of contact, then approaches about potential vulnerabilities hasn't always been potentially welcomed with open arms.

5
00:00:39,380 --> 00:00:53,800
The Aerospace Village really looks to help build bridges and trust between the hacker research community and the aerospace sector so that we can have those pathways to talk about what potential challenges there are and that we can work better and be more safe and secure.

6
00:00:54,120 --> 00:01:05,240
ISACs are seen often as a key point of contact for researchers and hackers who want to reach out if they think they've found an issue, but also struggle potentially with reaching the vendors.

7
00:01:05,660 --> 00:01:12,500
So how best do we create those relationships across hackers and ISACs to learn the lessons of the past and build the trust that we need?

8
00:01:13,080 --> 00:01:19,700
To see what's worked, what hasn't worked, and what we can do going forwards, it's fantastic to have just the right people to talk about this.

9
00:01:19,780 --> 00:01:31,380
So on the panel, we've got Erin Miller, who's VP of Operations for the, I think fair to say, newly minted Space ISAC, and soon reaching IOC this year.

10
00:01:31,380 --> 00:01:35,200
We've got Jeff Troy, who's President and CEO of the Aviation ISAC.

11
00:01:35,380 --> 00:01:40,760
We've got Ken Monroe, partner and founder of Pentest Partners, and also Carpool Karaoke today.

12
00:01:40,960 --> 00:01:48,840
And then Matt Gaffney, who is Managing Director of BSSI, who actually has an aviation backdrop in his photo.

13
00:01:49,600 --> 00:01:53,260
So I'll pass over to you for short introductions, and then we'll get on to the panel.

14
00:01:53,260 --> 00:01:55,140
So Erin, over to you first.

15
00:01:55,940 --> 00:01:57,500
Hey, good day, everyone.

16
00:01:57,500 --> 00:01:58,840
Glad to be here.

17
00:01:59,720 --> 00:02:05,000
As Pete mentioned, and thank you, Pete, for that great intro, we are a new ISAC.

18
00:02:05,000 --> 00:02:09,460
I came to the Space ISAC actually from a public-private partnership background.

19
00:02:09,460 --> 00:02:16,220
So I've been working to bring together the commercial sector and the public sector for some time, several years.

20
00:02:16,580 --> 00:02:27,680
Traditionally, just working in rapid prototype development and ideation brainstorm sessions to generate solutions, in particular for the warfighter, so that's more of my background.

21
00:02:27,680 --> 00:02:40,140
Very excited for the future of the Space ISAC, and I've been working for over a year, about 18 months or so, to stand up the Space ISAC and get it towards the initial operating capability that we need for the sector.

22
00:02:41,140 --> 00:02:44,420
Thanks, Erin, and looking forward to seeing where it goes.

23
00:02:44,420 --> 00:02:46,500
And then over to Jeff.

24
00:02:47,500 --> 00:02:48,640
Thanks, Pete.

25
00:02:48,820 --> 00:02:53,100
So I'm the President of the Aviation ISAC for the last three and a half years.

26
00:02:53,100 --> 00:02:57,240
I've been with the ISAC for five years since its inception.

27
00:02:57,240 --> 00:03:01,120
It's just helping them stand up initially in their project.

28
00:03:01,260 --> 00:03:07,340
I'm also on the Board of Directors of the National Defense ISAC, and I also work for General Electric Aviation.

29
00:03:08,840 --> 00:03:10,940
Fantastic, and then Ken.

30
00:03:11,360 --> 00:03:13,900
Hi, so I'm sorry about the backdrop.

31
00:03:13,900 --> 00:03:18,200
Two days ago, I was sat on the cockpit of a 747, so that would have been better, surely.

32
00:03:18,200 --> 00:03:23,160
Anyway, I work for a firm called Pentest Partners, and usually several of us are pilots.

33
00:03:23,160 --> 00:03:24,260
I'm not a very good pilot.

34
00:03:24,260 --> 00:03:28,560
I'm the guy who landed at the wrong airfield once, but we do have a keen interest in aviation.

35
00:03:28,560 --> 00:03:37,160
And for the last couple of years, we've been working on decommissioned airframes, starting to understand how the networks work and how the security of airplane systems fits together.

36
00:03:38,460 --> 00:03:42,560
Fantastic, and then last but not least, Gaffers or Matt.

37
00:03:42,560 --> 00:03:45,000
Hi everyone, Matthew Gaffney.

38
00:03:45,000 --> 00:03:51,940
I am the Managing Director of BSSI UK, where I work with multiple clients across various sectors.

39
00:03:51,940 --> 00:03:59,520
But I have worked several years at the airline or operator level, working with the entry into service of new e-enabled aircraft.

40
00:03:59,540 --> 00:04:11,180
So, coming across challenges and obstacles in the entry into service of aircraft and basically doing assurance across the whole piece.

41
00:04:12,020 --> 00:04:16,700
Fantastic, and great to have you all, and it's a great spread of experience across the entire panel.

42
00:04:16,740 --> 00:04:25,100
So, I'm going to start off with Ken, and you've been working with ISACs across various sectors for quite a long time now.

43
00:04:25,960 --> 00:04:33,900
So, finding vulnerabilities, potentially not getting much out of a vendor, and then working with the ISAC is fairly common for you.

44
00:04:33,900 --> 00:04:41,740
So, from your perspective, from what you've seen, how do ISACs fit into the picture for researchers and hackers?

45
00:04:42,000 --> 00:04:45,880
Yeah, I find actually ISACs make a really good set of connections for us.

46
00:04:45,880 --> 00:04:52,420
So, if you read our blog many times over, you'll see that when we find a vulnerability, often it's not the vulnerability that's the story.

47
00:04:52,420 --> 00:05:05,520
It's how the vendor actually responds and interfaces with a security researcher that makes a difference between a really smooth, seamless, and straightforward vulnerability disclosure process, through to being a bit of a train wreck, frankly.

48
00:05:05,520 --> 00:05:10,920
And I find that the work we've done with ISACs over the last few years has really smoothed that process.

49
00:05:11,280 --> 00:05:18,460
Typically, when we're working on, I don't know, embedded components, maybe in IoT, you find something, and the vendor just doesn't listen.

50
00:05:18,460 --> 00:05:18,920
They don't get it.

51
00:05:18,920 --> 00:05:20,020
They don't understand.

52
00:05:20,140 --> 00:05:26,540
But you tend to find different problems in organizations that are perhaps a member of ISACs, because they're just so big.

53
00:05:26,800 --> 00:05:38,560
And how does a little research operation like ours get through to the very right person within a large, whether it's an auto manufacturer, or a CNI operator, or an airline?

54
00:05:38,560 --> 00:05:42,300
How do you find that right person, and how do you get them to listen to you?

55
00:05:42,300 --> 00:05:48,660
And that's where we found the ISACs have been really, really helpful, is by having a connection, by establishing trust.

56
00:05:48,920 --> 00:05:56,900
It's great to get those connections that mean that it's not just scrabbling around on LinkedIn, or sending emails into some generic mailbox.

57
00:05:56,900 --> 00:06:03,780
It's actually, it's a conversation, and then a private broker discussion, which is where the ISACs have been so unbelievably helpful.

58
00:06:03,780 --> 00:06:05,360
It makes a real difference.

59
00:06:05,920 --> 00:06:07,340
Okay, that sounds great.

60
00:06:07,340 --> 00:06:09,040
And it sounds like it's worked.

61
00:06:09,120 --> 00:06:11,260
It has worked well in the past.

62
00:06:11,260 --> 00:06:26,380
I mean, Jeff, from your perspective, having been at the front of the ISAC for quite a while now, I mean, so you first got introduced to Hacker Summer Camp in Vegas when you came on a panel with me at B-Sides a couple of years ago.

63
00:06:27,080 --> 00:06:36,880
And the conversation we had around that, because you were dealing with some vulnerabilities at the time, it was great to see some of the ideas that you were coming up with about working with the hacker community.

64
00:06:36,880 --> 00:06:44,360
So what's been your experience as the ISAC with starting to work with the hacker community now?

65
00:06:44,700 --> 00:06:48,840
So our experience has actually been a lot like Kent's.

66
00:06:49,360 --> 00:07:04,700
Initially, what we're finding is hackers are coming to us, they're either coming through a friend that they know, they're coming through us because of connections that we've made with government agencies.

67
00:07:04,700 --> 00:07:12,680
Or in some instances, we've actually had some companies call us and say, can you talk to this person first, because we're not sure we even want to talk with them.

68
00:07:13,200 --> 00:07:28,240
So there was a lot of, I think, a couple of years ago, hesitation or just a little skepticism with respect to dealing with people who were just calling in and saying that they had some information about a particular vulnerability.

69
00:07:28,660 --> 00:07:32,340
So that was probably one of the first challenges.

70
00:07:32,340 --> 00:07:42,260
And, you know, in our discussions with these folks, we found, you know, most importantly, that they come with great intentions, just good intentions.

71
00:07:42,260 --> 00:07:45,260
We want to really show you something that we found.

72
00:07:45,420 --> 00:07:56,000
And most importantly, also, they're coming in, they're saying, I'm not telling anybody about this, because one, I'm not really sure what I found, because that's one of the problems, too, that we find.

73
00:07:56,000 --> 00:08:05,620
If someone finds, for example, a vulnerability within a component of a system, they're not really sure how that impacts the whole system.

74
00:08:05,620 --> 00:08:14,640
So really good that people have come in and had, you know, one, good research, two, good intentions.

75
00:08:14,720 --> 00:08:18,740
And then three, you know, Ken highlighted this as well.

76
00:08:18,740 --> 00:08:20,900
We act really as a connector.

77
00:08:20,900 --> 00:08:26,500
I mean, if you come into the Aviation ISAC, we don't have a setup like Matt Gaffney behind him there.

78
00:08:26,500 --> 00:08:27,760
And we don't have any airplanes.

79
00:08:27,760 --> 00:08:29,840
We don't have a lab.

80
00:08:29,840 --> 00:08:34,020
We can't test for this vulnerability, but we do do that connection.

81
00:08:34,220 --> 00:08:42,080
So the ISAC is a community of researchers in product security and network security and threat analysts.

82
00:08:42,080 --> 00:08:49,580
So one thing we do have is just a great, you know, network where most times a researcher will call us.

83
00:08:49,580 --> 00:08:59,260
And within about 24 hours, we've got them in touch with a product security incident response or a similar type person inside that company.

84
00:08:59,260 --> 00:09:03,960
And we're starting to, you know, help that conversation along.

85
00:09:03,960 --> 00:09:18,900
But once that connection is made, actually, we pretty much step to the side and let the people who actually built the technology and the researcher who has, you know, this vulnerability information, let them have that direct conversation.

86
00:09:19,780 --> 00:09:20,700
Thanks, Ken.

87
00:09:20,700 --> 00:09:34,800
And that's actually a nice segue through to chatting to Gaffers, because Gaffers, you've just gone through this process of finding a potential snag or two on some systems.

88
00:09:35,640 --> 00:09:46,460
And actually started working with the ISAC and other organizations to try sort of getting to the bottom of it and closing off.

89
00:09:46,460 --> 00:09:52,860
So what's been your perspective of that journey from finding something to trying to close it off?

90
00:09:53,980 --> 00:09:54,340
Yes.

91
00:09:54,340 --> 00:10:12,460
So I was writing a paper about some of the things I'd seen, and I was curious about how much detail I could go into without causing alarm distress or basically overstepping the boundaries.

92
00:10:12,460 --> 00:10:19,160
So, you know, through the community, I reached out to the Indonesian ISAC to get some advice.

93
00:10:20,340 --> 00:10:27,700
And one thing I noticed was within 24 hours, I noticed the hits on my LinkedIn profile just exploded.

94
00:10:28,200 --> 00:10:32,940
It was just full of people from all sorts of manufacturers.

95
00:10:33,740 --> 00:10:49,500
And it was in stark contrast, really, with similar interactions, which I'd had whilst I was working at the airline, where, you know, maybe a week later you get a response and the response was very, very tepid indeed.

96
00:10:50,820 --> 00:10:57,340
So that was really the first difference I've noticed in going through the aviation ISAC.

97
00:10:58,960 --> 00:11:10,060
The second time around, the official vulnerability disclosure procedure had been developed at manufacturer level, again, I think with help from the aviation ISAC.

98
00:11:10,800 --> 00:11:13,640
So we decided to use that mechanism.

99
00:11:14,240 --> 00:11:24,920
And although the initial holding response was quite quick, it was about a working day in response, the actual full response took four and a half weeks.

100
00:11:24,920 --> 00:11:30,620
And that was because I was chasing, which I thought was a little bit slow myself.

101
00:11:30,820 --> 00:11:33,340
It wasn't a highly technical issue.

102
00:11:33,340 --> 00:11:36,660
It was quite, quite simple.

103
00:11:36,660 --> 00:11:44,820
And the response was no different than the first time I went through disclosing a vulnerability with a manufacturer.

104
00:11:45,420 --> 00:11:56,420
And basically it was the scenarios and the hypothesis are not credible, therefore there's no vulnerability, which is a very strange opinion to have on risk management myself.

105
00:11:56,420 --> 00:12:05,980
But I rebutted with some comments from the official response and they were left unanswered.

106
00:12:05,980 --> 00:12:09,660
Until eventually I got a this matter is closed email and that was it.

107
00:12:10,760 --> 00:12:29,880
So the difference, I suppose the outcome was very similar, but I would say the response, the initial response was much better because the first time I went through this, it took several months to get to any kind of, any kind of satisfactory resolution,

108
00:12:29,880 --> 00:12:33,320
which it wasn't in the end really, it was only a halfway house.

109
00:12:33,320 --> 00:12:40,160
But with the Aviation ISAC going through the official process, it took weeks instead of months.

110
00:12:41,000 --> 00:12:42,200
Thanks for that.

111
00:12:42,280 --> 00:12:49,760
I want to come to that in a second, but can I just go for a straightaway follow up question to Jeff on that?

112
00:12:49,760 --> 00:13:01,380
Which is, if on one hand you've got a researcher such as Gaffers who's saying, I think I've found something, but the response from the manufacturer, the vendor is, well, actually there's nothing there.

113
00:13:01,380 --> 00:13:03,420
But we can't really tell you there's nothing there.

114
00:13:03,560 --> 00:13:11,420
With the ISAC in the middle, and you're funded by the manufacturers, how do you reconcile that?

115
00:13:11,880 --> 00:13:13,580
That's a great question.

116
00:13:13,580 --> 00:13:20,800
And I think it's kind of like that great abyss that is so hard for us to get across.

117
00:13:20,800 --> 00:13:30,900
So when you have a researcher who has information and they believe that, you know, this is a vulnerability, particularly one that needs to be addressed.

118
00:13:31,400 --> 00:13:33,420
As I said, we can't validate it.

119
00:13:33,420 --> 00:13:34,300
I don't have the equipment.

120
00:13:34,300 --> 00:13:37,480
I don't have the specialists to be able to do that.

121
00:13:37,480 --> 00:13:42,520
The best I can do is get you in touch with the right people who do have it.

122
00:13:42,520 --> 00:13:53,700
And hopefully through the relationship builds that have happened over the years that, you know, there'll be a good exchange there.

123
00:13:54,360 --> 00:14:07,360
When you get to a situation where the process has been completed and the manufacturer is not validating that vulnerability has any impact.

124
00:14:07,360 --> 00:14:17,740
I think it is an extremely difficult situation at that point in time, because you've got someone, you know, like Gaffer's, they've got an incredible mindset, right?

125
00:14:17,740 --> 00:14:21,120
It's, hey, I'm challenging things that people are saying are secure.

126
00:14:21,120 --> 00:14:25,500
And I am not sure, you know, that this is because of something that I've found.

127
00:14:25,500 --> 00:14:32,180
And that is what I think is the treasured trait of every security researcher.

128
00:14:32,240 --> 00:14:41,180
Their ability to dig in and try and find a way around the system that someone said there's no way around is what leads to the great security research that we have.

129
00:14:41,180 --> 00:14:55,440
The unfortunate part is, is that if someone has tested it against that system, and they know why it doesn't work, and they don't want to pass that information over back over to the researcher, then you have this gap.

130
00:14:55,440 --> 00:15:00,680
Because the researcher's mindset is, hey, I think this is great.

131
00:15:00,680 --> 00:15:02,440
You need to show me how come.

132
00:15:02,440 --> 00:15:14,720
And there's a... now you have that question of, well, where does my intellectual property and my security controls stop, you know, in respect to trying to protect them?

133
00:15:14,720 --> 00:15:19,520
And where does the research information, you know, kind of come together?

134
00:15:19,520 --> 00:15:21,840
How do we meet in the middle there?

135
00:15:21,840 --> 00:15:38,260
And that is something that I think is going to take some more time in terms of that conversation and how much people are willing to, manufacturers specifically, are going to be willing to share in that area.

136
00:15:39,420 --> 00:15:41,140
There's been a lot of great work.

137
00:15:41,140 --> 00:15:46,860
Pete, you've done a lot of work trying to bridge the discussions between these communities.

138
00:15:46,860 --> 00:15:59,760
And, you know, we've seen pretty much a community that really wasn't talking to researchers at all really starting to embrace them now and have a lot more conversations, which has been good for both.

139
00:15:59,760 --> 00:16:12,400
I think the researchers are finding out, hey, you know, these are good people trying to secure really high technology, and the companies are saying these are really good people who are trying to make sure that technology is well secured and I haven't found a way.

140
00:16:12,400 --> 00:16:20,860
So this is all good in my mind in that the process of building trust takes a long time.

141
00:16:21,020 --> 00:16:25,000
And I think things are moving in the right direction.

142
00:16:25,000 --> 00:16:39,940
And it's these types of conversations, these environments, the village, these things that are happening that are going to continue to bring together the parties and try and close that gap of when you have these types of situations.

143
00:16:39,940 --> 00:16:48,120
In terms of what the manufacturers will be willing to share in terms of information with the researchers.

144
00:16:48,780 --> 00:16:49,720
Thanks, Jeff.

145
00:16:49,720 --> 00:17:02,300
And yeah, that brings it around nicely to probably the newest ISAC on the block in the aerospace sector, which is Erin and the space team.

146
00:17:02,300 --> 00:17:21,280
I mean, Erin, all of the conversations that have been sort of like going on there with the challenges and the opportunities that the aviation ISAC has gone through and Gaffers and Ken as examples of the researcher and hacker community.

147
00:17:21,280 --> 00:17:36,540
With you sort of being the newly minted IOC later on this year, Space ISAC, what's your sort of vision going forwards for how you want to play this and how you want to take the Space ISAC forwards?

148
00:17:38,500 --> 00:17:39,780
Muted.

149
00:17:42,770 --> 00:17:44,110
Thanks, Pete.

150
00:17:44,370 --> 00:17:52,630
I think since Space ISAC is new and we have sort of a clean slate here, then there's a lot of opportunity to leverage the lessons learned.

151
00:17:52,630 --> 00:18:06,330
There's almost like a legacy of how ISACs operate and some things good, some things bad, and we want to make sure that we fully explore and understand what we can do the best.

152
00:18:06,330 --> 00:18:16,710
So listening to everyone talk, then I think, you know, there's some great takeaways, you know, having that open line of communication available and we have that today.

153
00:18:16,710 --> 00:18:26,250
So we are currently accepting communication, you know, to the Space ISAC at our info at s-isac.org email address from anyone.

154
00:18:26,250 --> 00:18:29,930
So I would say that part of our vision is starts now.

155
00:18:29,930 --> 00:18:40,650
Like I would encourage anyone to contact us with ideas on how Space ISAC can be that broker between the public and private sector, but also that extends to researchers.

156
00:18:41,710 --> 00:18:46,710
Part of the vision of Space ISAC does include that we have universities as members.

157
00:18:46,710 --> 00:18:51,130
So that makes us a little bit different than some other ISACs, not all.

158
00:18:51,130 --> 00:18:53,770
We also have international members.

159
00:18:53,770 --> 00:18:56,090
So that makes us a little different too.

160
00:18:56,090 --> 00:19:00,010
I think it's really cool to think about space as a global community.

161
00:19:00,010 --> 00:19:07,390
And so other ISACs have done and we intend to expand out and have members from all across the globe.

162
00:19:09,170 --> 00:19:14,230
Since not everyone here is familiar with Space ISAC, just a little bit of history.

163
00:19:14,230 --> 00:19:16,130
It was launched by the White House.

164
00:19:16,130 --> 00:19:18,970
So that's interesting in and of itself.

165
00:19:18,970 --> 00:19:32,190
The White House for representing the US government came forward and said, you know, we really want to see the public private sector come together and share information about threats and vulnerabilities about regarding the space community.

166
00:19:32,190 --> 00:19:39,230
And after they made that announcement, then we were able to start going out and asking members to join the board.

167
00:19:39,230 --> 00:19:46,310
So we're still very new and that we just opened our general membership on May 1 of this year.

168
00:19:46,310 --> 00:19:54,330
And when we hit our IOC, that will mean that we have the ability to actively share threat intel through an intel platform.

169
00:19:54,330 --> 00:20:00,750
We'll also have workshops and events that are available to the space community published at that time.

170
00:20:00,750 --> 00:20:02,730
And that's coming later this summer.

171
00:20:02,730 --> 00:20:08,870
So now is the time definitely for us to open that line of communication.

172
00:20:09,030 --> 00:20:16,290
And we would invite, you know, like I said, anyone's perspective on how to stand up the best vulnerability disclosure program.

173
00:20:16,290 --> 00:20:19,590
I've already talked to some of our board members about doing that.

174
00:20:19,590 --> 00:20:24,590
So really looking forward to the opportunities that we can bring to the space community.

175
00:20:24,790 --> 00:20:27,450
This one will make us even better.

176
00:20:27,670 --> 00:20:37,190
I believe that an ISAC really is the prime organization to be able to have this type of dialogue and to engage in this way.

177
00:20:37,190 --> 00:20:38,910
So thank you.

178
00:20:38,910 --> 00:20:39,950
And that's great.

179
00:20:39,950 --> 00:20:42,830
And it's great to hear all the work that's going on in the background.

180
00:20:42,970 --> 00:20:48,990
I mean, have you... so with space, I mean, a lot of the focus is on mission critical.

181
00:20:49,730 --> 00:20:56,490
So that's the mantra that always gets talked about with space ops.

182
00:20:56,490 --> 00:21:01,350
I mean, a lot of the discussion for aviation will be safety and security.

183
00:21:01,350 --> 00:21:07,550
So driving risk as low as reasonably practicable.

184
00:21:08,830 --> 00:21:19,950
With the space sector and your members and what you're hearing from your side of it, is there still this... what's the general feeling at the moment when it comes to cyber security?

185
00:21:20,510 --> 00:21:30,390
Because people tend to banter that cyber security of space assets is generally... I mean, I think the expression I heard the other day was in the 80s.

186
00:21:32,070 --> 00:21:38,870
But obviously, that is going to be something which is openly debatable.

187
00:21:38,870 --> 00:21:46,990
But what's the general feeling about the maintaining that mission critical status and having cyber security upfront and focused on that?

188
00:21:47,510 --> 00:21:51,990
And then looking for the vulnerabilities and working and open to working with researchers?

189
00:21:51,990 --> 00:21:55,110
Are you getting that feeling from your members and the people you're speaking to?

190
00:21:55,790 --> 00:21:59,690
The feeling I get is that more information is better.

191
00:21:59,930 --> 00:22:09,410
So if information comes to the ISAC, then it's our job to get it shared with the members that it is most relevant to.

192
00:22:09,410 --> 00:22:13,530
So we are already operating in that role right now.

193
00:22:13,530 --> 00:22:19,130
Cyber security for space or security for space is very broad.

194
00:22:19,130 --> 00:22:26,050
And the general feeling is that we should have stood up a space ISAC two decades ago.

195
00:22:26,050 --> 00:22:28,690
Maybe that's what your comments were indicating.

196
00:22:28,690 --> 00:22:34,590
Because there's a lot of vulnerabilities that hit cyber security, hit the business system.

197
00:22:34,590 --> 00:22:39,150
And they actually have a lot of relevance specifically to space applications.

198
00:22:39,150 --> 00:22:42,090
And other entities might view them differently.

199
00:22:42,090 --> 00:22:49,390
But if you're a space company, then you really need to know the direct implications of that threat to the space mission.

200
00:22:49,390 --> 00:22:54,830
So it is definitely all about space mission and protecting the space critical infrastructure.

201
00:22:54,910 --> 00:22:58,050
And that's where our entire focus will be.

202
00:22:58,050 --> 00:23:14,170
So if somebody has access to information that is related to a threat to space critical infrastructure, which will eventually publish what that means to our members, what is space critical infrastructure, and that'll help scope some of that discussion.

203
00:23:14,170 --> 00:23:25,510
But I mean, if you define it as space critical infrastructure, and you think that the space ISAC should know about it, then I would say that's what our members are going to care about, from what I can tell.

204
00:23:25,630 --> 00:23:36,550
We've actually also engaged in a partnership, I should mention, with the Air Force Research Lab that runs that hack-a-sack that's happening this year right now.

205
00:23:36,550 --> 00:23:49,430
And so just even that step forward shows me that the members are really excited about partnering on challenges or developing our own challenges that will be open to the broader researcher community.

206
00:23:49,430 --> 00:23:50,470
Thanks, Aaron.

207
00:23:50,470 --> 00:24:07,850
Yeah, and to be honest, it's just nice talking about aerospace cybersecurity and having hackers and researchers working together because it felt like three years ago that talking about vulnerabilities in aerospace systems is something that we didn't really want to do.

208
00:24:07,850 --> 00:24:14,070
So actually, part of this is building up this dialogue so we can have that as an informed dialogue.

209
00:24:14,290 --> 00:24:23,390
But as we go forwards, I think, I mean, we've all had conversations in the past about trying to make sure we learn from what's happened in the past.

210
00:24:23,390 --> 00:24:29,130
So really trying to dig into some of these challenges is...

211
00:24:29,130 --> 00:24:43,350
What's been, and I'll pass it over to Ken, what's been the standout sort of examples of where things have really worked well and made a difference and where things really haven't worked well?

212
00:24:44,050 --> 00:24:45,310
Gosh, there's a few of those.

213
00:24:45,310 --> 00:24:50,410
I want to pick up on a point that Jeff made, and you used the word new, which I think is actually really important here.

214
00:24:51,770 --> 00:24:55,090
Because cybersecurity research in aviation is pretty new.

215
00:24:55,090 --> 00:24:58,830
I mean, we've been working on airframes for two, two and a half years now.

216
00:24:59,070 --> 00:25:03,150
And you've got to remember, this is an industry that perhaps is very heavily regulated.

217
00:25:03,190 --> 00:25:11,230
It believes it has safety well in hand, so it's extremely open to inspection, but also fiercely protective of intellectual property, rightly so too.

218
00:25:11,230 --> 00:25:13,430
So this is a new thing.

219
00:25:13,430 --> 00:25:24,050
The industry is also hurting at the moment with the COVID-19 issues, and also smarting at it from some of perhaps less helpful coverage in the past around aviation cyber.

220
00:25:24,050 --> 00:25:27,810
So I think it's really important we talk about building trust in this community.

221
00:25:27,810 --> 00:25:34,430
And what's often raised as a subject when you're doing vulnerability disclosure of non-disclosure.

222
00:25:34,430 --> 00:25:36,450
And that's a really sensitive area.

223
00:25:36,450 --> 00:25:41,210
So it's pretty rare outside this space that you'd be asked to sign a non-disclosure agreement.

224
00:25:41,210 --> 00:25:45,310
But also, you have to balance that with, as a researcher, do you want to know more?

225
00:25:45,310 --> 00:25:46,790
Do you want to understand in detail?

226
00:25:46,790 --> 00:25:59,250
But at that point, you might consider signing a non-disclosure agreement in certain areas that allow the manufacturer to talk to you in more detail, feel more like they've got more trust in you, that you're not going to take everything that they've told you and splatter it across the press.

227
00:25:59,250 --> 00:26:01,330
And I think that's a really, really important point.

228
00:26:01,330 --> 00:26:04,810
So I think many researchers should think carefully about that.

229
00:26:04,810 --> 00:26:08,550
Or maybe we should consider actually NDAs for certain areas.

230
00:26:08,650 --> 00:26:15,250
Perhaps certain bits of discussion do need to be covered by non-disclosure and certain, well, maybe not so.

231
00:26:15,250 --> 00:26:17,230
And I think that's a really important learning point.

232
00:26:17,290 --> 00:26:24,070
And I think that also leads us back into some examples of where things have gone really well, and some examples of where things have gone really badly.

233
00:26:24,070 --> 00:26:31,470
I can think of the biggest issue just being generally where there's no communication.

234
00:26:31,710 --> 00:26:39,510
So where the researcher does what they believe to be the right thing, makes communication, establishes, discloses everything they've got, and then things go quiet for a while.

235
00:26:39,510 --> 00:26:47,990
And it may be that the vendor in that case is actually working really diligently exploring every option and trying to add some detail, but they don't communicate.

236
00:26:48,030 --> 00:26:51,910
And I think in Gaffer's case, that's potentially what went wrong there.

237
00:26:51,910 --> 00:26:57,690
Perhaps if there'd been a more regular dialogue with the vendor reaching out and going, hey, I know we haven't spoken to you for a while.

238
00:26:59,770 --> 00:27:03,550
I think that would have made you feel a lot happier about things, hey Matt?

239
00:27:03,550 --> 00:27:04,790
Yeah, absolutely.

240
00:27:05,370 --> 00:27:11,030
I just felt that the communication was a bit cut, in general.

241
00:27:11,710 --> 00:27:14,270
And it wasn't an open flowing dialogue at all.

242
00:27:14,270 --> 00:27:17,550
It was very much, yep, thank you for your submission, we'll look at it.

243
00:27:17,710 --> 00:27:19,190
And then nothing else.

244
00:27:19,670 --> 00:27:27,250
There was no questioning of what I had proposed, no questioning of what I'd submitted.

245
00:27:27,730 --> 00:27:30,330
It was just that, yeah, we'll take it away and look at it.

246
00:27:30,330 --> 00:27:31,610
And that was it.

247
00:27:31,610 --> 00:27:36,430
It was just, and then when I chased them for an update, it was like, oh, here's the response.

248
00:27:37,370 --> 00:27:38,870
There it is, that's it.

249
00:27:39,930 --> 00:27:45,410
And, you know, annoyingly, with my work at the operator level, I actually knew a lot of these people.

250
00:27:45,970 --> 00:27:49,470
Anyway, you know, it's not like I've never actually met them in person.

251
00:27:49,470 --> 00:27:50,410
I have.

252
00:27:50,710 --> 00:27:57,410
So to not have that level of trust, I think, is really disappointing.

253
00:27:57,410 --> 00:28:05,410
And it is something where I think, you know, the whole industry, researchers and the manufacturers could really improve.

254
00:28:05,730 --> 00:28:07,070
A good example of that.

255
00:28:07,070 --> 00:28:16,290
So, you know, compare us to where we were perhaps a year ago with DEF CON and Black Hat in 2019, which was perhaps partly a difficult time for the aviation cyberspace.

256
00:28:16,290 --> 00:28:18,550
But yeah, here we are a year later.

257
00:28:18,550 --> 00:28:24,790
And for example, Boeing is going to set up a Cyber Technical Advisory Council, actually inviting researchers onto the inside.

258
00:28:24,790 --> 00:28:28,010
I mean, what a huge win that is, both for researchers and for the industry.

259
00:28:28,010 --> 00:28:29,890
It's fantastic progress.

260
00:28:29,890 --> 00:28:42,430
And I think it's amazing that a vendor who was perhaps really hurting from some difficult coverage last year and a difficult interaction with researchers has now completely come around and engaged practically.

261
00:28:42,430 --> 00:28:43,830
And I think that's a huge step forward.

262
00:28:43,830 --> 00:28:45,610
So it is new.

263
00:28:45,610 --> 00:28:47,110
It is new to the industry.

264
00:28:47,310 --> 00:28:48,750
But yes, it will take time.

265
00:28:48,750 --> 00:28:50,350
But trust is being established.

266
00:28:52,330 --> 00:28:53,970
Jeff, do you want to come back on that?

267
00:28:55,290 --> 00:29:01,550
Yeah, I just actually took down a note here because I want to make sure I share it with all the members across the ISAC.

268
00:29:01,910 --> 00:29:07,890
And what I wrote down basically is a vulnerability disclosure program does not equal a link on a website.

269
00:29:07,890 --> 00:29:11,550
And I think that's a really important point here, right?

270
00:29:11,550 --> 00:29:20,610
I mean, we've got all these companies out there who are now making it easier for them to be contacted, but it doesn't end there, right?

271
00:29:20,610 --> 00:29:22,070
So I got your submission.

272
00:29:22,070 --> 00:29:23,930
I need to have that conversation.

273
00:29:23,930 --> 00:29:27,210
I need to engage with this researcher.

274
00:29:27,550 --> 00:29:30,890
And I think that's just a really important point.

275
00:29:30,890 --> 00:29:35,290
I'm really glad you brought that up because that's a part of the maturation process.

276
00:29:35,290 --> 00:29:43,190
You know, okay, the door's there, but if you don't answer the door and welcome the people in for the conversation, then, you know, it's kind of an odd relationship.

277
00:29:43,190 --> 00:29:44,930
They're just standing on the front step, right?

278
00:29:44,930 --> 00:29:50,550
And so we need to bring them in the living room and sit down and have the conversation.

279
00:29:52,390 --> 00:29:56,890
Researchers spend their own time, their own money, their own efforts doing this.

280
00:29:56,890 --> 00:29:59,610
And it's great when we feel valued.

281
00:29:59,850 --> 00:30:04,030
And, you know, we can help, you know, the aviation industry can benefit from what we do.

282
00:30:04,030 --> 00:30:07,630
It's just that level of value and interaction makes such a difference.

283
00:30:07,850 --> 00:30:22,370
And actually, if you look at the... if a researcher and a hacker find something and then tries to approach and do the right thing in talking through good faith research and saying, I think there's an issue here, a lot of the risk is really on the researcher.

284
00:30:22,570 --> 00:30:24,170
It's not really on the manufacturer.

285
00:30:24,170 --> 00:30:32,050
So a lot of that effort, I think, really has got to come from the vendor to say, we're open and we're willing to engage in all of this.

286
00:30:32,050 --> 00:30:37,690
Geoff, one of the areas I think is quite contentious in security research in aviation is the subject of non-disclosure.

287
00:30:37,690 --> 00:30:39,750
I mean, where does the ISAC sit on that?

288
00:30:40,510 --> 00:30:42,230
So, great question.

289
00:30:42,870 --> 00:30:52,950
Really, the issue with the non-disclosure is that if you sign a non-disclosure agreement with someone, there's still a risk that they're going to violate the non-disclosure agreement.

290
00:30:52,950 --> 00:31:03,910
And although there's recourse if someone violates a non-disclosure agreement, what you wanted to keep protected from being publicly disclosed ends up getting out there.

291
00:31:03,910 --> 00:31:06,710
So this is, again, a matter of trust.

292
00:31:06,710 --> 00:31:12,550
And you've seen this, Ken, because you have a company that does pen testing, right?

293
00:31:12,550 --> 00:31:16,150
Not every company wants to hire every pen tester.

294
00:31:16,250 --> 00:31:18,350
And, you know, that's one of the problems.

295
00:31:18,350 --> 00:31:24,750
It's like they're looking a lot of times for companies that, hey, have you worked with these guys before?

296
00:31:24,750 --> 00:31:26,150
Have you worked with these pen testers?

297
00:31:26,150 --> 00:31:28,410
Do you think they do a good job?

298
00:31:28,410 --> 00:31:33,150
Do they, you know, actually hold your intellectual property close?

299
00:31:33,150 --> 00:31:41,110
Those are the types of questions that I'm sure you've had grilled, right, as you walk into different engagements.

300
00:31:41,170 --> 00:31:49,210
And that is one of the problems, particularly for newer researchers, because it's like, well, what if you don't know me, right?

301
00:31:49,210 --> 00:31:50,650
I've still got great research.

302
00:31:50,650 --> 00:31:54,290
I'm a very trustable person, but we just don't have a history yet.

303
00:31:54,290 --> 00:32:03,930
And that is a situation where I think it may be solved by the community building itself up.

304
00:32:03,930 --> 00:32:16,010
As the community builds itself up, other researchers who do have, let's call it street cred, right, out there, they're able to vouch for people who have come in and say, well, I've worked with that person.

305
00:32:16,010 --> 00:32:17,290
I know that person.

306
00:32:17,290 --> 00:32:30,410
You know, those types of trust building activities, I think, are going to have to happen to support the idea of entering into an NDA with a new researcher.

307
00:32:57,890 --> 00:33:13,570
I mean, can I just... we've got to be... I just want to unpick some of the language, because when we talk about building up and using street cred and things like that, I mean, surely we need to get to a position where, irrespective of who is bringing it up,

308
00:33:13,570 --> 00:33:17,270
if it's being brought up in good faith, and being engaged on good faith, then it's going to work.

309
00:33:17,270 --> 00:33:24,510
But if it's being brought up in bad faith, whether somebody's got street cred or not, we've got to make sure that they are listened to.

310
00:33:24,510 --> 00:33:41,750
Because if we go to the safety critical aspect, or from the space perspective with Erin and her team from a mission critical aspect, if anybody brings up a potential safety issue, then the safety management team are behoven to listen to it, irrespective of who it is.

311
00:33:41,750 --> 00:33:48,250
So surely we've got to go for the same perspective when it comes to researchers and them trying to flag issues.

312
00:33:48,770 --> 00:33:53,770
It shouldn't be... I don't feel there should be a gate of entry of credibility or not.

313
00:33:53,770 --> 00:33:57,890
It should be, we've just got to have that dialogue, and they've got to be able to reach people.

314
00:33:58,230 --> 00:34:00,070
Gaffer, you're nodding a lot.

315
00:34:00,070 --> 00:34:08,910
Well, yeah, because I mean, I get a lot of, you know, imposter syndrome in this industry, because I'm not a pen test.

316
00:34:08,910 --> 00:34:09,950
I'm not like Ken.

317
00:34:09,950 --> 00:34:13,990
I don't spend my life, you know, reverse engineering IoT and doing all this kind of stuff.

318
00:34:13,990 --> 00:34:18,810
I was just doing information assurance on behalf of my client and found these things.

319
00:34:18,950 --> 00:34:22,330
And, yeah, like I said, I'm not a pen test.

320
00:34:22,330 --> 00:34:35,230
I haven't really called myself a researcher until recently when I kind of thought to myself, well, yeah, I'm actually doing things in my spare time, looking at things, using open source documentation, et cetera, et cetera.

321
00:34:35,850 --> 00:34:42,170
And, yeah, I suppose I am a researcher, but I never really thought of myself that way, especially when I did these disclosures.

322
00:34:42,170 --> 00:34:46,890
So, yeah, the bar has to be not your cred.

323
00:34:46,890 --> 00:34:53,050
It has to be, you know, you're coming in with an issue and, like I said, we're doing it in good faith.

324
00:34:53,430 --> 00:35:09,830
I mean, Erin, from your perspective and how you're building out the space ISAC team, are you looking at the structures and processes of how you can potentially engage in this way to try and make sure these doors are fully open?

325
00:35:13,480 --> 00:35:14,160
Yes.

326
00:35:14,160 --> 00:35:18,940
So I've started the conversation with the current members of the space ISAC.

327
00:35:19,180 --> 00:35:36,460
And as the space ISAC grows, then I think this will be a conversation that we have with everyone who joins the organization to ask them about having a vulnerability disclosure program, what their experience is with that, and making sure that we can shepherd the conversation from the point,

328
00:35:36,460 --> 00:35:44,840
you know, where someone knocks on the door to us opening it to us having the conversation to then brokering the conversation with the member.

329
00:35:45,520 --> 00:36:00,140
And I think the only way to really do that is to, like I said, talk to members when they join the organization about their perspectives on this, because otherwise you don't have a cultural adoption of it.

330
00:36:00,140 --> 00:36:05,620
Because that's really, from what I'm hearing from everyone, then that's what this is all about.

331
00:36:05,620 --> 00:36:08,560
And that's great for me, because that's the kind of stuff that I love.

332
00:36:08,560 --> 00:36:15,700
Like when I did design sprints with the private sector and the government, then that was all about changing culture.

333
00:36:15,700 --> 00:36:23,180
And so shaping culture is mostly driven by conversations and introducing new ideas and then kind of testing them.

334
00:36:23,180 --> 00:36:34,080
So I think that's what we'll be doing in the space, Isaac, is if someone knocks on our door, then they, people, someone has to realize that if they knock on our door right now, then it's the first time it's ever happened.

335
00:36:34,080 --> 00:36:46,240
But we're willing and open to taking, walking the path with them and having the conversation with the company or the member that has the vulnerability that they're approaching us with.

336
00:36:46,240 --> 00:36:57,320
And I'm just going to pick up though, because culture, yeah, massively important, but with both aviation and space, as have been previously mentioned, it's massively highly regulated.

337
00:36:57,320 --> 00:37:00,260
So regulators are there for both safety and security.

338
00:37:01,740 --> 00:37:19,160
And last year, there was a massive step forwards where, for example, ICAO, which is the UN body for aviation, actually has a line in their cyber strategy now, which says that states must give adequate protection to good faith security researchers, which is great.

339
00:37:19,160 --> 00:37:25,840
So from a very top level at ICAO and the UN, this is sort of being recognized and hopefully will filter down.

340
00:37:26,900 --> 00:37:32,980
But what's the relationship like with, for example, the regulators in this space?

341
00:37:33,660 --> 00:37:36,280
Because this is a safety critical industry.

342
00:37:36,400 --> 00:37:44,580
If a researcher is flagging potentially a safety critical issue, who really gets to decide whether it's safety critical or not?

343
00:37:44,580 --> 00:37:52,780
And from Erin, from your perspective, is there that structure yet, whereas you would see in the space sector?

344
00:37:54,220 --> 00:38:03,340
So obviously the space sector is regulated, but it's not as regulated as it could be, and maybe will be in the future in terms of cybersecurity.

345
00:38:03,720 --> 00:38:13,240
So I think the Space ISAC, part of the intention of standing it up is to promote dialogue with prospective regulators.

346
00:38:13,240 --> 00:38:19,560
So, you know, in the future, there will be agencies that are responsible for managing space traffic management.

347
00:38:19,560 --> 00:38:24,060
They could send regulation down as a result of that designation.

348
00:38:24,100 --> 00:38:30,820
And the communication between the private sector and that agency is critical.

349
00:38:30,820 --> 00:38:32,900
And that's what the Space ISAC is for.

350
00:38:32,900 --> 00:38:42,200
So we have at least 18 different agencies that we're partnered with informally right now, and we're working on formalizing those partnerships.

351
00:38:42,500 --> 00:38:46,500
So I believe there's a lot of opportunity for the interactive dialogue.

352
00:38:46,500 --> 00:38:54,160
We are seeing it today with certain agencies contacting us and asking for information to be shared in both ways.

353
00:38:54,160 --> 00:38:59,620
So they share information with us, and as we're able to, we share information with them.

354
00:38:59,620 --> 00:39:15,400
And hopefully, and you can tell us how this goes, potentially, whether yourselves can be an advocate of why good faith security research and working with the research community would be good across the space sector.

355
00:39:15,400 --> 00:39:22,600
I mean, the work from what you're talking about there, it sounds like that you're going to be quite well at the forefront of that as the Space ISAC.

356
00:39:23,500 --> 00:39:41,840
Going back to the regulator's perspective from an aviation side, Jeff, from the Aviation ISAC perspective, if somebody comes to you with something that you think could be a safety-critical issue, do you deal with that differently compared to if it was an issue on a non-safety-critical system?

357
00:39:42,880 --> 00:39:44,640
No, we really don't.

358
00:39:44,640 --> 00:39:53,540
So what we do is, again, we don't have the capacity to validate whether or not it is a safety-critical issue or not.

359
00:39:53,540 --> 00:40:00,300
I mean, there may be an assertion from the researcher that it is, but we don't have the ability to make that conclusion.

360
00:40:00,300 --> 00:40:11,360
So we're going to be providing the information by linking the researcher up to the manufacturer and letting them go through that process.

361
00:40:11,500 --> 00:40:30,280
If it's a safety-critical issue, the manufacturer may be required under their regulatory requirements to actually make a report to their regulator as to what the particular issue is and then how that's going to be resolved.

362
00:40:30,300 --> 00:40:41,960
So there's a whole body of governance over the manufacturers to have to make those types of notifications.

363
00:40:42,220 --> 00:40:47,520
And there are also lots of other front doors that the researchers can use, for example.

364
00:40:47,520 --> 00:40:51,420
So DHS has a front door for researchers.

365
00:40:51,600 --> 00:40:55,560
I don't think the FAA has a front door for researchers.

366
00:40:56,580 --> 00:41:02,300
But, I mean, Ken, have you seen the different pathways that have been used?

367
00:41:03,220 --> 00:41:06,160
Yes, so we haven't struggled so much recently.

368
00:41:06,160 --> 00:41:12,720
And I think that's partly because we've had access to ISAC, who know who to ask or can make a subtle introduction if required.

369
00:41:12,840 --> 00:41:18,980
But I have seen other researchers publishing on Twitter saying, has anyone got a security contact at X?

370
00:41:18,980 --> 00:41:25,300
And that's a really difficult way of... I think sometimes it draws attention, sometimes it's unhelpful.

371
00:41:25,400 --> 00:41:33,860
And I don't know if that's the most constructive way, but it does reflect a lack of ability of the industry to receive researchers.

372
00:41:33,920 --> 00:41:40,040
So I'd say to researchers, try a bit harder, but I'd also say to the industry, listen a bit harder and make it a bit easier.

373
00:41:40,900 --> 00:41:45,280
Well, that sounds like quite a good segue to start wrapping up.

374
00:41:45,760 --> 00:41:57,300
So , Gaffers, have you got a sort of like final thoughts that you want to sort of, having been talking about this for a while now and having gone through it yourself, have you got some wrap up thoughts for yourself?

375
00:41:57,300 --> 00:42:10,080
Yeah, I mean, so from an airline perspective, a lot of the cyber security controls come down to the airline as recommendations.

376
00:42:10,180 --> 00:42:17,160
You know, so when you look at all the documentation and the regulation paperwork, there's nothing that says you have to do this.

377
00:42:17,160 --> 00:42:18,560
They're all recommendations.

378
00:42:18,600 --> 00:42:27,440
And a lot of the documentation, they will, you know, dedicate 95% or more of the words towards non-cyber stuff.

379
00:42:27,440 --> 00:42:30,700
And there's a tiny little bit at the end about, well, think about doing this.

380
00:42:31,620 --> 00:42:40,280
And I think that the manufacturers as well, they will provide their own recommendations of security controls to put in place.

381
00:42:40,280 --> 00:42:44,960
But then there's a disconnect because the manufacturer will have done their risk assessment.

382
00:42:44,960 --> 00:42:52,680
They will know what the risks are, produce recommendations for the operator to implement.

383
00:42:53,100 --> 00:43:05,520
But then the operator implements them with no way of assessing their quality because there's that disconnect between the risk assessment, which the manufacturer has done, which is obviously secret, and the work that the operator does.

384
00:43:05,520 --> 00:43:07,840
And I think that there's something in the middle there that's missing.

385
00:43:07,840 --> 00:43:09,220
And it could be the regulator.

386
00:43:09,220 --> 00:43:10,580
It could be the ISACs.

387
00:43:11,040 --> 00:43:13,280
I don't know, but I think there's a better way we can do this.

388
00:43:14,580 --> 00:43:24,380
Really from the, although there might be one front door for the researchers, it's all of the network of communications and information sharing behind that that also challenges remain.

389
00:43:24,860 --> 00:43:25,520
Yeah.

390
00:43:25,660 --> 00:43:26,640
OK.

391
00:43:27,260 --> 00:43:31,740
Ken, you were very pithy earlier, so I'll give you one last chance.

392
00:43:32,080 --> 00:43:38,520
So I think one key point is security research is happening in aviation more and more.

393
00:43:38,560 --> 00:43:41,660
Partly on the back of COVID-19, airframes are being retired.

394
00:43:41,660 --> 00:43:49,280
I was offered an entire operational 747-400 that last flew a month ago for 200,000 bucks just this week.

395
00:43:49,280 --> 00:43:51,680
OK, I didn't have engines, but everything else was intact.

396
00:43:51,680 --> 00:43:53,800
Plug it into ground power, the whole thing works.

397
00:43:53,800 --> 00:44:00,360
So yeah, 200Gs is a lot of cash, but it's starting to come into the price range of research firms.

398
00:44:00,360 --> 00:44:02,480
So more and more research is going to happen.

399
00:44:02,480 --> 00:44:07,680
So now's the time to take the opportunity, engage with researchers, make it easy to interact with them.

400
00:44:07,680 --> 00:44:09,500
And let's step up.

401
00:44:10,340 --> 00:44:11,420
Fantastic.

402
00:44:11,420 --> 00:44:15,260
And then I'll come across to Erin for yourself next.

403
00:44:17,400 --> 00:44:27,720
Yeah, so I think the way forward for the Space ISAC is to take the advice and the lessons learned from this group in particular and others.

404
00:44:27,800 --> 00:44:35,520
I've talked to some other ISACs as well out there to get insights and perspectives on how to do this the best.

405
00:44:35,520 --> 00:44:40,940
Space ISAC does have some interesting things in its future.

406
00:44:40,940 --> 00:44:44,820
We will, in 2022, have a vulnerability lab.

407
00:44:44,820 --> 00:44:53,840
So that may bring in a different dynamic to the Space ISAC and open some great opportunities to do testing of vulnerabilities.

408
00:44:54,280 --> 00:45:01,500
Definitely don't want to have anyone leave thinking that just because it's in space doesn't mean it can't be hacked.

409
00:45:01,500 --> 00:45:08,820
So we're really looking forward to the future and engaging the researcher community.

410
00:45:09,280 --> 00:45:15,900
And hope that someone actually reaches out and shares their ideas because I really want to read them and follow up.

411
00:45:15,900 --> 00:45:22,680
So I'll drop the address that I gave before, info, I-N-F-O at s-isac.org.

412
00:45:22,680 --> 00:45:24,160
Feel free to hit me up.

413
00:45:24,160 --> 00:45:24,920
Thanks.

414
00:45:24,920 --> 00:45:36,520
And I think we all look forward to hearing about your IOC coming up and look forward to how you take it forward and being there to help you and the community as it goes forward.

415
00:45:36,520 --> 00:45:40,500
And then, Jeff, you and I have had these conversations a lot.

416
00:45:40,780 --> 00:45:42,920
So it's great to have you here.

417
00:45:44,020 --> 00:45:46,480
Wrap up thoughts from yourself, please.

418
00:45:47,040 --> 00:45:52,080
So I think something that Ken highlighted is just critically important.

419
00:45:52,080 --> 00:46:06,520
I mean, the fact that people, particularly because of COVID-19, can now get more access to equipment, that is going to absolutely open up more research being done on planes.

420
00:46:06,520 --> 00:46:10,300
So that fact is critically important.

421
00:46:10,300 --> 00:46:21,120
The other thing, I think it's been a theme through the whole conversation we've been having here, is that communication and building bridges is just critically important between the community and the industry.

422
00:46:21,120 --> 00:46:41,220
And so as we continue to strengthen that bridge and have more of those conversations and good exchanges, again, I think people are just going to continue to see that on both sides of the equation here, there's just really good, smart people who have common ground with respect to safety in the industry.

423
00:46:41,380 --> 00:46:52,800
And keeping that conversation open and that mindset open is going to help these great ideas get passed back and forth and just make the whole industry more secure.

424
00:46:53,480 --> 00:46:54,340
Thanks, Jeff.

425
00:46:54,340 --> 00:46:55,380
And thanks to all of you.

426
00:46:55,380 --> 00:47:05,900
I think it really shows from all of the themes that have been picked up that actually there is no straight path to building trust across such a diverse group of stakeholders.

427
00:47:06,680 --> 00:47:15,120
There is no one right answer for how best we can help the researcher and hacker community work with industry.

428
00:47:15,120 --> 00:47:35,960
But the one thing we do know that will help is conversations like this, learning from each other and actually trying to positively engage across all of those different stakeholders and have a good drumbeat of communication so that when people are flagging things up,

429
00:47:35,960 --> 00:47:38,880
then it's actually a good positive engagement all the way through.

430
00:47:39,120 --> 00:47:42,160
And that's the way we learn all of us together.

431
00:47:42,360 --> 00:47:47,580
And that's the way that we can help the industry be safer and more secure.

432
00:47:47,720 --> 00:47:50,780
So I just want to make a huge thanks out to all of you.

433
00:47:51,320 --> 00:47:59,180
This is in the heart of the envelope of exactly what the Aerospace Village is about to try and help build bridges and the community around such a great topic.

434
00:48:00,460 --> 00:48:08,800
Please stay safe and look forward to chatting with everybody on Discord straight after this for about an hour.

435
00:48:08,800 --> 00:48:09,760
Thank you very much.