Good morning, Beth. I'm Pete Cooper, Director of the Aerospace Village, and on behalf of the team,
welcome to the Aerospace Village at Virtual DEF CON 28. Not quite what we all thought was
going to be the plan, but let's face it, 2020 is trying to throw as many curveballs at us as
possible. So while we're all trying to stay safe and healthy, we've got an amazing three days of
virtual content lined up for you, irrespective of you being completely new to this or whether
you're a seasoned black badge holder. Aviation is really a cornerstone of the global infrastructure
and economy, and while passenger safety is at an all-time high, the increasing adoption of
connected and digitized technologies is exposing aircraft, airport satellites, and
the interdependent aerospace ecosystem to new types of risks and threats. And the consequences
of a cyber security failure in a ground, air, or space-based system can impact human life,
public safety, and even a crisis of confidence in the trustworthiness of air travel, which
could undermine economic and national security. And as those traditional domains of aviation,
safety, and security increasingly overlap, the more we can collaborate to enable stakeholders
ensures that we're going to be safer and sooner together. The Aerospace Village is a non-profit
set up and led by a volunteer team of hackers, pilots, engineers, policy advisors,
who come from both across the public and private sectors. And why have we done this? Because we
want to build an inclusive community around the topic of aerospace security, inspire you to get
involved in one of the most amazing and growing areas of research that's out there, and promote
and build aerospace cybersecurity knowledge and expertise. And through the Aerospace Village,
the research community really is inviting everybody, be they industry leaders, researchers,
academia, anybody interested in aviation, space security, safety, and resilience, to come in,
understand, learn, and collaborate together. Because empathy and understanding is going to
build common ground. Any sort of acts and words looking to increase division between the communities
is going to undermine the efforts of us working together. So we're looking to welcome anybody and
everybody who's wanting to improve aviation and space security, safety, and resilience through
positive and productive collaboration. This isn't just a cool topic with a huge scope of cool tech.
There's loads of research on the topic already, but it's a global topic and it's only getting
bigger. And there's so much that is out there that is great to look at and explore.
Last year, we had the Aviation Village at DEFCON. That was our first year, and we had great activity
across airports, air traffic management, and aircraft, and great engagement. It's all massively
interconnected and interdependent, and we started building out bridges across the community and
industry. But since then, on the importance of such efforts, there's been some great progress.
For example, international initiatives. The UN body for aviation, which is ICAO,
with 193 member states, published late last year their first cyber security strategy for aviation,
which specifically called out that states should give adequate protection to good faith researchers.
And that's more and more recognition that such research like this is a positive thing,
and it needs to be encouraged as well as protected. And additionally, there's also
industry initiatives. For example, Boeing standing up an industry cyber technical council
that actually incorporates the research and hacking community working with the team there.
So this year, we've evolved into the Aerospace Village. Aviation is critically dependent on
space, and the sector is really the aerospace sector. So yeah, we rolled into space, and we've
now got a security community that's stretching from Earth into orbit. And a big part of that
effort this year is to hack that CTF, which is pretty much the coolest CTF that isn't on the
planet. And more of that later. It's amazing the support that we've got this year to help put on
an amazing event for you over the next three days. And that support stretches from the USAF, DDS,
CESA, Boeing, the American Institute of Aeronautics and Astronautics, both the aviation
and space ISACs, TALIS, Capital Tech University, California Polytechnic, Pentas Partners, I'm the
Cavalry, Rapid Seven, and even astronaut Pam Melroy is here, and more. All looking to try and give you
a great experience and learn as much and play with as much as you want to over the next three days.
We've got everything from topics on aircraft, airports, air traffic management, so air traffic
control, aircraft, and space. Everything from satellites to ground stations. And we've got talks,
panels, workshops, and CTFs, and everything from beginning to advanced. So please find our website
at aerospacevillage.org, which has got the schedule and more content about what's on and what we're
doing both now for DEF CON and as we're going forwards. And subscribe to us on YouTube and
follow us on Twitter at Secure Aerospace. And finally, to really pull together and drive this
amazing event, it takes an amazing team. And it's an honor to be a part of that amazing team. So when
you're pleased floating around the virtual village, look out for the village leads and those team
members. Say hi and thanks. They are the most awesome group of people that pull this together.
So next up are two guest speakers that are going to help us open up the Aerospace Village this
year. Partnerships are going to be really important to help build out this community and
build trust between the hacking and researching community and industry and government. So it's
great to have them here speaking at the opening. So the first is CISA Director Chris Krebs and this
is the conversation that I had with him. Thank you. So welcome everybody to the Aerospace Village
and I'm honored to have Director CISA Chris Krebs with us to help with the opening. So
good morning Chris. Hey Pete, thanks for having me. Good to be here with you and the Aerospace
Village, formerly the Aviation Village. It's a journey. It always is. So you came to the Aviation
Village last year. We've got the Aerospace Village this year and I know that you and the CISA team
are working really, really hard on the aerospace sector. But what's unique do you think about the
aerospace sector when it comes to some of the challenges that we're facing across the security
perspective? Yeah, I think it's representative of almost everything else in the kind of almost the
industrial or life safety space. Things that historically have not been connected or relied
upon overly networked systems, IT systems that either touch the internet or have paths of entry.
That's different than it was 10 plus years ago. You know, when a plane used to
lose the contact with the earth, it also lost contact, generally speaking, with communications
channels. So what we're seeing now though is due to various customer demands, other navigation
requirements, that yeah, there are pathways into a plane. And frankly, what's at stake?
And we're really truly talking about lives here. So, you know, when I look at both aviation but
more broadly aerospace, it's not just about the things that are moving around in the air,
it's the things that are going through the infrastructure itself. You know, look at
what's happened here in the US over the last year or so. It's the establishment of Space Command.
Why? It's because the space-based infrastructure is that critical to just day-to-day operations.
When you talk about PNT, when you talk about satellite-based communications, it really is a
incredibly critical slice of not just our infrastructure, but of frankly our economy.
So do you think that the threat actors are different to the other sectors, or is this
still the same sort of threat environment that we're looking at here? Well, I do think that there
are a couple different things you got to think about with the threat actors. So yes, they're
absolutely threat actors that are focusing in on this aerospace ecosystem. And not that
it's been a steady state thing, I think it's increasing. They're understanding the
ability and the capability, particularly when you talk about functional disruptions.
The future of warfare is not necessarily going to be on the plains of Europe. The first strike
capabilities that you would see launched against our infrastructure are things we need to be
thinking about. And that's from an elections perspective, election infrastructure perspective,
that's what I've been talking about now for years. What was so dramatic or significant about the
2016 interference with the US election was it was almost a Sputnik moment. Take us back to 1957,
and the Russia, the Soviets at the time, put Sputnik into low Earth orbit. It wasn't that
they got to space first, it was that they had an ICBM, they had this capability to overcome
geographic distancing and reach out and touch us. Why was 2016 the same? It was because cyber
could be used as that tool to reach out and touch us and destabilize democracy.
I think the future, again, of conflict is going to be using these infrastructure aspects
against us to undermine our confidence, undermine our ability, or undermine our willingness
to do the things that need to be done. And thanks for that. And so it shows that really,
that this is touching on pretty much all the themes about trust and resilience across all
the other sectors as well. But for those that are sort of new into the aerospace sector, and
we've got loads of researchers and hackers that are now really engaging on the topic,
what's the key challenge for yourselves on trying to look at the safety and security aspects of it?
Because it's a safety critical industry. So we've got the FAA and also CISA in the frame as well.
Can you try and help explain to the audience out there is actually how does that balance work
on working through safety and security with the different partners that are out there?
So, oh, wow. So, you know, they're the technical aspects of it, actually getting access to the
equipment. This is not kit you can typically just find out they're hanging on eBay.
So there are some proprietary systems that you've got to be able to get access to and
work in an environment that's trusted. I think that's the second aspect. Beyond the technical,
it's the relationship piece and the trust. You know, this is, I think, that constant struggle,
that constant tension between the research community and the owner operators or the
vendors is how do you have an effective, a meaningful conversation about security and trust
when you add life safety? Same things for the medical device community, too. You know, unfettered
access into a piece of equipment that has life safety implications is not something to be toyed
with. And you want to make sure that you've got open lines of communication. You're not just
dropping a ball onto the open market without giving the folks that are maintaining those
systems the appropriate time to control or to implement. But that also, you know, when you talk
about these proprietary systems, there are some DCMA and other issues that really restrict the
ability or the access. So we have looked over the last several years to help really foster those
conversations to bring the security researcher community together with the vendor community.
And it's been a journey. You talk about the journey from the aviation village to the aerospace
village. It's really been a journey. And I am so incredibly, you know, impressed by a number of the
bigger companies out there that, you know, a year and a half ago, weren't particularly interested,
for instance, in participating in the village. But now they're meaningful, full-bore, full-throated
supporters and members because they get the kind of force multiplier aspect. I'd rather have you
on my team than working against me. That sort of mentality has really taken root. And we're,
you know, proud to be a part of that effort to keep driving forward. No, thanks. And it's that
challenge of trying to make sure the dialogue's there because the perspectives are different.
And it feels like trying to fit a really small Venn diagram together and just getting that common
ground in the middle. But what do you think CISA, I mean, and partnering with us on the villages
is great. But what do you think we, the village and the community, and CISA would want to be
doing in the next sort of year? I mean, how do you think that that can work better across all
of those stakeholders? And also as well, what message would you be giving to industry across
that as well? Yeah, so last year, for instance, we were kind of silent partners, helping,
again, facilitate some of the conversations, but not a financial supporter, not a, you know,
really staffing supporter. We had folks there last year in Vegas, this year, much more engaged
in the planning, bringing the partners together, working with the information sharing and analysis
centers, working with the vendors. I think going forward, I really want to see, you know, assuming
we, and hopefully we get through this, this current pandemic where we can get back together
physically, really would love to see more practical environmental environments that
we can bring researchers in to take, you know, start shooting holes in things, figuratively,
not literally. But, you know, we've been working in our industrial control systems initiative
to develop environmental laboratories, so our cellar program, where we've got control systems
environments that folks can mess around with, that they can either conduct research on, we can
tailor them to specific environments like water, but also I think aviation is a great opportunity
going forward where we can continue, you know, it's almost like democratizing security for the
control system space and including the aerospace environment. You know, again, it's just making
these partnerships more accessible to everyone and much, much more open. And again,
you know, the concept here really more than anything is let's democratize this. It does
not happen overnight, so we've all got to be patient, keep plucking away. And yeah, sometimes
various parts of the community raise their voice and get a little frustrated with others, but
keep working on it. And the more we work on it, the more trust we'll build and the more we'll be
able to do in the out years. And is this the same journey that you've seen across the other
sectors as well? I mean, from what we're seeing across the research and hack community and the
dialogue that we've got with industry and regulators and everybody is that actually,
this is a journey that has its ups and downs. And it's not always an easy path because there
are so many different and quite strong perspectives out there. But it sort of feels
like this is a journey that other sectors have gone through as well. Yeah, absolutely. And again,
I'll make second elections. If somebody's got the Chris Krebs bingo card, if I don't mention
election security like six times in any speech, even if it has nothing to do with election security,
I've failed. But election security is a great example. So in 2016, when it first started
becoming apparent what the Russians were trying to do, there wasn't an established, vibrant
community of practice in election security. Yes, there was a security research core team that was
looking at these issues, but it hadn't really gone mainstream. You didn't really have the vendors
on board. You didn't have the operators of the systems, the practical operators of the system.
But over the last three or four years, we really worked hard to bring all those partners together
and again, create that vibrant community of practice. And so as we look into 2020 election,
feel much more comfortable, much better about where things are, the security state of various
systems. Are we where we need to go? Oh, hell no. I mean, there is still work to be done.
Absolutely. But by coming together all aspects of the community, we have ensured, or at least
we're working towards that additional level of assurance that we're doing the right thing. We're
defending democracy. And again, the 2020 should be the most secure election in history. So again,
you got to break it down. Why did we get there? What led or what contributed to
the progress we've made over the last four years? I kind of, you know, I've stolen this from
General Mattis, who I think adapted his leadership style from General Washington,
President Washington. And it's basically four things. Listen, learn, help, lead. So we're still,
I think, in that learning phase of leadership and understanding the community and transitioning
well, I think, into the help space. But here in the aviation airspace world, there's opportunities
for leadership. And so we're looking at those, seeing what we can do, again, to bring this
community together, bring this practical research and sharing of ideas and information. Last thing
I think I'll mention is, you know, I think it goes in just about any other discipline within
the security research community is vulnerability coordination. And how do you do that in a way
that gives the defender an opportunity to close out any gaps before the bad guys have
proof of concept? We've seen it in the election space. We've seen it here.
You know, there are opportunities to help the defender before advantaging the offensive
security side of the offense, the threat actor. So to the extent that we can continue to build
those partnerships between the security research community and the vendors, I think we're going to,
again, we're going to continue advancing towards a defensive advantage position.
Thanks. And that touches on so many different areas. I think one of the things that you've
been talking about there from the democratization of it, from the amount of research and hackers
that we've got contributing to the village through either breakers yards or buying stuff
off the internet and things like that. And actually, they're doing some really great
research on what they're finding. And it's trying to make sure that those pathways exist to be able
to talk about some of those findings and go through it. Because that then sparks a dialogue
that actually allows engagement to happen and actually that progress to be made. So yeah,
there's loads of lessons across all of that. To be perfectly clear here, I'm not casting
any aspersions or judgment on any part of the community right now. Whether you're on the vendor
side of the security research community, I think everybody's got... you talk about ups and downs.
Everybody, I think, has made some good strides forward over the last couple of years and we want
to continue making those. But it's got to be an open conversation. It's got to be forward-thinking
and progressive. That's the only way we're going to get where we need to be.
Yeah, and actually... and look at the scale of the challenge. I mean, you touched upon the elections
on... if you just sort of sat back and said, let's just protect the elections. I mean, that's a massive
task. If we look across the aerospace sector, with everything from airports, the air traffic
management aspects, the aircraft, and then space, be that ground stations or all the on-orbit assets,
the scale of that is huge. And it's a massively interdependent sector as well. How do we scale
this, from your perspective, looking at this nationally and also internationally, with all of
the international work you and the team are involved in? But how do we make sure that we
do this in lily pads of excellence? I think that's exactly what we've been doing
over the last couple years. Everybody's got their normal partners that they work with.
And that really became clear to me last year. We were going through a process, working with the
Department of Commerce, trying to understand across the telecommunications sector, the ICT folks,
where really the most risk lies in terms of supply chain vulnerabilities. Not vulnerabilities,
but risks, really, more than anything. And what we found is we didn't have a really strong
relationship with the satellite communities in the industry. And it was an area that I think
they realized as well, that they didn't really know what we were doing, what our role was. So
to get to those elements of scale, I think it's got to be these broader conversations,
talking both within government, but also within industry, and understanding what the respective
lanes in the road are. And, you know, something I've said a couple times now, but, you know,
you really, you know, it goes back to that, the mantra of, you know, to improve something,
you've got to be able to measure it. Well, to really scope the problem, you have to understand
who the players are, and what their roles are, and how we can all work together. So that's what
we've really been focusing on, in part through an effort that we have called the National Critical
Function. So it's moving away from a 16 sector based understanding of US critical infrastructure,
but instead distilling it down to what are the actual services, what are the functions,
really a systemic risk approach to the economy, and then identifying who the key providers of
services are. And in doing so, we'll get that better understanding of risk, better partnerships
built, and then better solutions against the risks that we need to manage. And against those risks,
would you be expecting those critical service providers to be working with the research
community and actively engaging with that community as well? I, yeah, I mean, look, this is,
part of our force multiplier here as defenders. The security research community has proven time
and time again, that it can help. I am, you know, I'm in a similar situation, honestly,
to the security research community, in a lot of respects. All the things we do here at CISA
tend to be voluntary, public private partnerships. And the security research community working with
is similar, it's a partnership. So you do that by building trust, by understanding what the
kind of the needs are, and then putting up a capability or putting a resource or service
against that need. And both sides benefit. That's how we operate. And I think that's again,
going forward, that's that culture, that community, that we really look forward to
being a part of, but also fostering. No, thanks. And I think that everyone's actually,
I mean, the momentum that we're building up on all of the dialogue across the aerospace,
security research and hack community is building in a really nice way. And actually,
the engagement we've got from the vendors is great as well. And I think it's from dialogues
such as that from yourselves, and the other industry leads really, is making a huge difference.
And when we're talking about sort of all of the challenges and the scale of it,
how do we try to sort of not see that necessarily through a work, partly through a workforce lens,
but there's a lot of organizations now that are really throwing a lot of effort now on to
securing or putting more bandwidth on their security. Therefore, how do we spin up the
workforce on this from a national perspective, because getting that getting that crossover
between aerospace and cyber security and security is really hard. Getting those people
that can understand both worlds is a challenge. Right. You know, I think the ongoing conversations
about the gap in cybersecurity workforce is ultimately a little bit, it's almost nihilistic,
right? It's like, we're always going to fail in secure code and secure deployment.
And I think you've already touched on it a little bit. But, you know, I think the more
opportunities for STEM, steam, or whatever you want to call it, at the K through 12 level is
going to generate a workforce that's more technically savvy. And if we can start folding in
rather than bolting cybersecurity expertise on to the after the fact and start building it in
whether it's DevSecOps or a security development or software development life cycle, those sorts
of approaches, I think, are what we're going to have to adapt. So it's not about building a
cybersecurity workforce in the future. It's a security minded engineering and technical
workforce to the future. Let's close out these issues before we even get to them. And that's
really kind of the mantra that we've got here at the agency. It's defend today, secure tomorrow.
What does that mean? So today, we're dealing with patching yesterday's vaults, the stuff that,
you know, whatever company dropped. Let's learn from all these examples and figure out how for
the next generation, the next iteration of infrastructure deployments, we just don't make
things better by design, better by deployment. Let's make our lives a little bit easier. And I
frankly, it'd be great if we could put ourselves out of business. That's never going to happen.
But it's not a bad thing to shoot for. So I tell you what, this is an issue,
workforce, education, that's personal to me. I have five kids here in DC that are in the
public education system. And I just see day in, day out, the kind of dearth of, as I see it,
appropriate technical education. We've got to overcome that. So there are a number of
initiatives that we're working here at CISA that are intended and designed to, again, overcome those
shortfalls. And it's not going to be about universities. It's not going to be about
colleges. I don't think that's the solution. I think, again, we've got to have better K-12,
have better trade school-type education at institutes. Again, it's about putting the
tools into the hands of the future workforce and not four-year or post-grad programs.
Last thing I'll say on this front is we also need to be smarter about the way that we
bring people into the workforce. And in part, that's through our hiring practices. It's through
how we advertise for jobs. The Aspen Institute cyber program last summer announced a couple
different ways to approach hiring. One is don't over-spec your PDs. Don't over-spec them. Not
everybody needs 15 different certifications and 10 years of experience for coding language that's
been around for four. You saw that advert as well, then. Yeah, I did. That was a good one.
And then also use un-gendered or gender-neutral terms. Unconscious bias is a thing. And how do
we get away from that? How can we have a more diverse and inclusive workforce that diversity
and lack thereof in cybersecurity and technical fields is absolutely a thing. And I think it's
on us as leaders and voices in the community to drive for change.
And hopefully that'll be the way as we go forward. And again, it's something that we're
seeing through the village is actually just trying to bring on that next generation to
really get engaged on it. And a lot of the activity that we've got in the villages is
that crawl-walk type activity to really have that on ramp for not necessarily
any sort of specific demographic, but anybody who wants to get involved and start engaging and
learning about this sort of stuff. It's an open and engaging community, and that's what makes it
so great. So just to kind of rip on this for a second, I think about the way that the federal
government here in the U.S. hires. And it's a college degree and three years of experience,
and you too can qualify for a GS-9 position. But that sort of experience, I see kids going
into college at 18 having six, seven years of coding experience, of in some cases development
experience, certainly of research experience. So how do we bring those types and reward them
for their experience and recognize that experience and not just say, oh, you don't have a CISSP, so
you're not qualified. It's absolutely wrongheaded and backwards, but we have to change that. And so
there are a few things, again, that we're doing here in the government. We're trying to change
that. There's one hiring regime that we're putting the final touches on, the cyber talent
management system that'll do just that. It'll look for experience, practical experience,
and reward that through the hiring process, rather than saying you need that four-year degree and you
need three years of working in a call center. So we've got a couple of things I think we can do
here. It's just a matter of implementation. That sounds really great. Now, before we move on,
is there anything that, from your perspective, we haven't touched upon, but you'd want us to
pitch out or engage with on the community around the aerospace cybersecurity?
Well, just to kind of do a self-serving promo here, just on the last piece, we are hiring CISA.
There are a lot of positions that we have that don't require top secret clearances.
Either the secret or the no security clearance level. I am looking for practitioners. I'm
looking for people that know the community, that can work with the community. I think we have a
unique offering and a unique place within the federal government that's really the closest
thing to the private sector, the closest thing to the security research community. So check us out
at cisa.gov slash careers. We are always hiring. Okay, well, we don't normally do commercial
pitches, but I think I'll let you have that one. Chris, many thanks for your time. Thank you for
joining us at the kickoff for the Aerospace Village. And hopefully once we get through
COVID, then look forward to seeing you again in person. Thank you very much.
Hey, thanks, Pete. It's great to be with you. If I was on Room Raider, I'd probably give you about
a four out of 10. You'd get probably five or six for all your badges, but your lack of art
and any potted plants probably set you back a few. Yeah, I made sure I kicked the cats out,
so I thought I'd get a few extra points. Thanks very much. So our next guest speaker is Dr. Will
Roper, and I'm honored to have him here this morning. So Dr. Will Roper is the Assistant
Secretary of the U.S. Air Force for Acquisition Technology and Logistics. And he and his team,
along with DDS, were great supporters of the village last year and have been again this year
as well. And as you can see from the efforts that we've got through the HACSAT CTF and also
the workshops that they've brought along to the village to support us this year, they've shown a
huge amount of passion in the topic, and it's great to have him here. So, Dr. Will Roper.
Hello, everyone, and welcome to the Aerospace Village at DEFCON 28, safe mode. I'm Will Roper,
the Head of Air Force and Space Force Programs, and it is a privilege to be at DEFCON for my
second year. Last year, I came and was blown away by the technical talent that DEFCON has in this
community of creative, inquisitive investigators of all things software-driven. We brought a live
hacking opportunity with one of our F-15 fighters, and yes, this community was able to get in.
We were left with a lot of great understanding about how to be better in the cyber domain,
and we're back this year with an amazing opportunity that's going to teach the community
and us how to take good cyber practices into space. Orbiting overhead right now is a satellite
that hackers are going to have access to to see if they can apply their skills to get in.
They're going to have to understand complicated physics, how satellites communicate with the
ground, and how we communicate back in order to overcome this capture the flag challenge.
But seeing the talent that's here, my money is on that they will succeed. Now, how cool is that,
that winning teams are going to get to have their code run live in space? And what we'll learn is
how to make this new area of defense and commercial innovation more cyber secure in the long run.
You know, if you back up and you look at how the Air Force engaged, we really sat behind our high
walls and fence lines, and we used secrecy as a way to keep our military systems safe. That doesn't
make sense in today's world. With so much technology happening commercially, we've got to get outside
of our bases and fence lines and be part of this community that continues to push innovation
forward. So we are here to share, we are here to learn, and to make openness and transparency
part of our equation for being secure. Thank you for being here as part of the Aerospace Village.
Thank you for being here to participate in HackASAT. And next year, when we're back with
the next round of the thing we bring to expose to the community, I hope you'll share your thoughts
about what opportunity would inspire you to help us learn how to be a better cyber warrior.
For the 60 billion dollars of airplanes and satellites and cyber technology that we produce
each year, the cutting edge comes from software. Everything we learn about making that cutting
edge more secure makes our men and women in uniform, this nation, and our allies and partners
and all who work with us safer. So we are proud to be part of this community and can't wait to see
what's ahead.