start	end	text
5680	11860	Good morning, Beth. I'm Pete Cooper, Director of the Aerospace Village, and on behalf of the team,
11860	17700	welcome to the Aerospace Village at Virtual DEF CON 28. Not quite what we all thought was
17700	23060	going to be the plan, but let's face it, 2020 is trying to throw as many curveballs at us as
23060	29640	possible. So while we're all trying to stay safe and healthy, we've got an amazing three days of
29640	33980	virtual content lined up for you, irrespective of you being completely new to this or whether
33980	39900	you're a seasoned black badge holder. Aviation is really a cornerstone of the global infrastructure
39900	45600	and economy, and while passenger safety is at an all-time high, the increasing adoption of
45600	50760	connected and digitized technologies is exposing aircraft, airport satellites, and
51640	58640	the interdependent aerospace ecosystem to new types of risks and threats. And the consequences
58640	64640	of a cyber security failure in a ground, air, or space-based system can impact human life,
64640	69640	public safety, and even a crisis of confidence in the trustworthiness of air travel, which
69640	75200	could undermine economic and national security. And as those traditional domains of aviation,
75200	80380	safety, and security increasingly overlap, the more we can collaborate to enable stakeholders
80380	86080	ensures that we're going to be safer and sooner together. The Aerospace Village is a non-profit
86080	93340	set up and led by a volunteer team of hackers, pilots, engineers, policy advisors,
93340	99320	who come from both across the public and private sectors. And why have we done this? Because we
99320	105960	want to build an inclusive community around the topic of aerospace security, inspire you to get
105960	111080	involved in one of the most amazing and growing areas of research that's out there, and promote
111080	116730	and build aerospace cybersecurity knowledge and expertise. And through the Aerospace Village,
117140	122440	the research community really is inviting everybody, be they industry leaders, researchers,
122440	128660	academia, anybody interested in aviation, space security, safety, and resilience, to come in,
128660	133440	understand, learn, and collaborate together. Because empathy and understanding is going to
133440	139240	build common ground. Any sort of acts and words looking to increase division between the communities
139240	143700	is going to undermine the efforts of us working together. So we're looking to welcome anybody and
143700	148620	everybody who's wanting to improve aviation and space security, safety, and resilience through
148620	156220	positive and productive collaboration. This isn't just a cool topic with a huge scope of cool tech.
156640	162400	There's loads of research on the topic already, but it's a global topic and it's only getting
162400	168420	bigger. And there's so much that is out there that is great to look at and explore.
168600	176320	Last year, we had the Aviation Village at DEFCON. That was our first year, and we had great activity
176320	182560	across airports, air traffic management, and aircraft, and great engagement. It's all massively
182560	186420	interconnected and interdependent, and we started building out bridges across the community and
186420	192380	industry. But since then, on the importance of such efforts, there's been some great progress.
192400	198980	For example, international initiatives. The UN body for aviation, which is ICAO,
198980	205720	with 193 member states, published late last year their first cyber security strategy for aviation,
206260	210800	which specifically called out that states should give adequate protection to good faith researchers.
211280	214980	And that's more and more recognition that such research like this is a positive thing,
214980	219220	and it needs to be encouraged as well as protected. And additionally, there's also
219220	223720	industry initiatives. For example, Boeing standing up an industry cyber technical council
224420	229180	that actually incorporates the research and hacking community working with the team there.
229860	235240	So this year, we've evolved into the Aerospace Village. Aviation is critically dependent on
235240	241080	space, and the sector is really the aerospace sector. So yeah, we rolled into space, and we've
241080	245060	now got a security community that's stretching from Earth into orbit. And a big part of that
245060	250100	effort this year is to hack that CTF, which is pretty much the coolest CTF that isn't on the
250100	257620	planet. And more of that later. It's amazing the support that we've got this year to help put on
257620	265840	an amazing event for you over the next three days. And that support stretches from the USAF, DDS,
265840	272220	CESA, Boeing, the American Institute of Aeronautics and Astronautics, both the aviation
272220	278600	and space ISACs, TALIS, Capital Tech University, California Polytechnic, Pentas Partners, I'm the
278600	284840	Cavalry, Rapid Seven, and even astronaut Pam Melroy is here, and more. All looking to try and give you
285560	291640	a great experience and learn as much and play with as much as you want to over the next three days.
291880	297760	We've got everything from topics on aircraft, airports, air traffic management, so air traffic
297760	304620	control, aircraft, and space. Everything from satellites to ground stations. And we've got talks,
304620	311840	panels, workshops, and CTFs, and everything from beginning to advanced. So please find our website
312400	319980	at aerospacevillage.org, which has got the schedule and more content about what's on and what we're
319980	325740	doing both now for DEF CON and as we're going forwards. And subscribe to us on YouTube and
325740	332020	follow us on Twitter at Secure Aerospace. And finally, to really pull together and drive this
332020	336780	amazing event, it takes an amazing team. And it's an honor to be a part of that amazing team. So when
336780	341320	you're pleased floating around the virtual village, look out for the village leads and those team
341320	346200	members. Say hi and thanks. They are the most awesome group of people that pull this together.
348320	353680	So next up are two guest speakers that are going to help us open up the Aerospace Village this
353680	357480	year. Partnerships are going to be really important to help build out this community and
357480	364500	build trust between the hacking and researching community and industry and government. So it's
364500	370980	great to have them here speaking at the opening. So the first is CISA Director Chris Krebs and this
370980	377840	is the conversation that I had with him. Thank you. So welcome everybody to the Aerospace Village
377840	383480	and I'm honored to have Director CISA Chris Krebs with us to help with the opening. So
383480	388640	good morning Chris. Hey Pete, thanks for having me. Good to be here with you and the Aerospace
388640	397680	Village, formerly the Aviation Village. It's a journey. It always is. So you came to the Aviation
397680	402780	Village last year. We've got the Aerospace Village this year and I know that you and the CISA team
402780	408640	are working really, really hard on the aerospace sector. But what's unique do you think about the
408640	413080	aerospace sector when it comes to some of the challenges that we're facing across the security
413080	422640	perspective? Yeah, I think it's representative of almost everything else in the kind of almost the
422640	428380	industrial or life safety space. Things that historically have not been connected or relied
428380	435280	upon overly networked systems, IT systems that either touch the internet or have paths of entry.
435460	440960	That's different than it was 10 plus years ago. You know, when a plane used to
441720	449960	lose the contact with the earth, it also lost contact, generally speaking, with communications
449960	457440	channels. So what we're seeing now though is due to various customer demands, other navigation
457440	465080	requirements, that yeah, there are pathways into a plane. And frankly, what's at stake?
465080	472240	And we're really truly talking about lives here. So, you know, when I look at both aviation but
472240	479580	more broadly aerospace, it's not just about the things that are moving around in the air,
479580	485020	it's the things that are going through the infrastructure itself. You know, look at
485020	489840	what's happened here in the US over the last year or so. It's the establishment of Space Command.
489840	496420	Why? It's because the space-based infrastructure is that critical to just day-to-day operations.
496420	505620	When you talk about PNT, when you talk about satellite-based communications, it really is a
505620	512140	incredibly critical slice of not just our infrastructure, but of frankly our economy.
513360	519640	So do you think that the threat actors are different to the other sectors, or is this
519640	524800	still the same sort of threat environment that we're looking at here? Well, I do think that there
524800	528140	are a couple different things you got to think about with the threat actors. So yes, they're
528140	535600	absolutely threat actors that are focusing in on this aerospace ecosystem. And not that
535600	540800	it's been a steady state thing, I think it's increasing. They're understanding the
540800	545860	ability and the capability, particularly when you talk about functional disruptions.
546380	552860	The future of warfare is not necessarily going to be on the plains of Europe. The first strike
552860	558820	capabilities that you would see launched against our infrastructure are things we need to be
558820	564980	thinking about. And that's from an elections perspective, election infrastructure perspective,
564980	569860	that's what I've been talking about now for years. What was so dramatic or significant about the
569860	578300	2016 interference with the US election was it was almost a Sputnik moment. Take us back to 1957,
578300	584880	and the Russia, the Soviets at the time, put Sputnik into low Earth orbit. It wasn't that
584880	589180	they got to space first, it was that they had an ICBM, they had this capability to overcome
589180	596860	geographic distancing and reach out and touch us. Why was 2016 the same? It was because cyber
596860	601620	could be used as that tool to reach out and touch us and destabilize democracy.
601740	608100	I think the future, again, of conflict is going to be using these infrastructure aspects
608100	613620	against us to undermine our confidence, undermine our ability, or undermine our willingness
614880	620160	to do the things that need to be done. And thanks for that. And so it shows that really,
620160	625280	that this is touching on pretty much all the themes about trust and resilience across all
625280	630880	the other sectors as well. But for those that are sort of new into the aerospace sector, and
630880	637520	we've got loads of researchers and hackers that are now really engaging on the topic,
638160	645260	what's the key challenge for yourselves on trying to look at the safety and security aspects of it?
645260	650500	Because it's a safety critical industry. So we've got the FAA and also CISA in the frame as well.
650500	657520	Can you try and help explain to the audience out there is actually how does that balance work
657520	661980	on working through safety and security with the different partners that are out there?
662720	669380	So, oh, wow. So, you know, they're the technical aspects of it, actually getting access to the
669380	674640	equipment. This is not kit you can typically just find out they're hanging on eBay.
674900	679760	So there are some proprietary systems that you've got to be able to get access to and
679760	686980	work in an environment that's trusted. I think that's the second aspect. Beyond the technical,
686980	692040	it's the relationship piece and the trust. You know, this is, I think, that constant struggle,
692040	696420	that constant tension between the research community and the owner operators or the
696420	704920	vendors is how do you have an effective, a meaningful conversation about security and trust
704920	710760	when you add life safety? Same things for the medical device community, too. You know, unfettered
710760	716240	access into a piece of equipment that has life safety implications is not something to be toyed
716240	719960	with. And you want to make sure that you've got open lines of communication. You're not just
719960	725380	dropping a ball onto the open market without giving the folks that are maintaining those
725380	731780	systems the appropriate time to control or to implement. But that also, you know, when you talk
731780	739180	about these proprietary systems, there are some DCMA and other issues that really restrict the
739180	744460	ability or the access. So we have looked over the last several years to help really foster those
744460	748920	conversations to bring the security researcher community together with the vendor community.
748920	753440	And it's been a journey. You talk about the journey from the aviation village to the aerospace
753440	760820	village. It's really been a journey. And I am so incredibly, you know, impressed by a number of the
760820	767080	bigger companies out there that, you know, a year and a half ago, weren't particularly interested,
767080	772580	for instance, in participating in the village. But now they're meaningful, full-bore, full-throated
772580	778300	supporters and members because they get the kind of force multiplier aspect. I'd rather have you
778300	784340	on my team than working against me. That sort of mentality has really taken root. And we're,
784340	789560	you know, proud to be a part of that effort to keep driving forward. No, thanks. And it's that
789560	794420	challenge of trying to make sure the dialogue's there because the perspectives are different.
795560	800580	And it feels like trying to fit a really small Venn diagram together and just getting that common
800580	807740	ground in the middle. But what do you think CISA, I mean, and partnering with us on the villages
807740	815620	is great. But what do you think we, the village and the community, and CISA would want to be
815620	822440	doing in the next sort of year? I mean, how do you think that that can work better across all
822440	826540	of those stakeholders? And also as well, what message would you be giving to industry across
826540	833580	that as well? Yeah, so last year, for instance, we were kind of silent partners, helping,
833580	840480	again, facilitate some of the conversations, but not a financial supporter, not a, you know,
840480	846900	really staffing supporter. We had folks there last year in Vegas, this year, much more engaged
846900	851480	in the planning, bringing the partners together, working with the information sharing and analysis
851480	856780	centers, working with the vendors. I think going forward, I really want to see, you know, assuming
856780	862420	we, and hopefully we get through this, this current pandemic where we can get back together
862420	870520	physically, really would love to see more practical environmental environments that
870520	875720	we can bring researchers in to take, you know, start shooting holes in things, figuratively,
875720	880320	not literally. But, you know, we've been working in our industrial control systems initiative
880320	887480	to develop environmental laboratories, so our cellar program, where we've got control systems
887480	893320	environments that folks can mess around with, that they can either conduct research on, we can
893320	897800	tailor them to specific environments like water, but also I think aviation is a great opportunity
897800	904900	going forward where we can continue, you know, it's almost like democratizing security for the
904900	910660	control system space and including the aerospace environment. You know, again, it's just making
910660	918200	these partnerships more accessible to everyone and much, much more open. And again,
918200	923080	you know, the concept here really more than anything is let's democratize this. It does
923080	928740	not happen overnight, so we've all got to be patient, keep plucking away. And yeah, sometimes
929460	933800	various parts of the community raise their voice and get a little frustrated with others, but
933800	937740	keep working on it. And the more we work on it, the more trust we'll build and the more we'll be
937740	942940	able to do in the out years. And is this the same journey that you've seen across the other
942940	948640	sectors as well? I mean, from what we're seeing across the research and hack community and the
948640	955560	dialogue that we've got with industry and regulators and everybody is that actually,
955560	961880	this is a journey that has its ups and downs. And it's not always an easy path because there
961880	969080	are so many different and quite strong perspectives out there. But it sort of feels
969080	974660	like this is a journey that other sectors have gone through as well. Yeah, absolutely. And again,
974660	980160	I'll make second elections. If somebody's got the Chris Krebs bingo card, if I don't mention
980160	985240	election security like six times in any speech, even if it has nothing to do with election security,
985240	993400	I've failed. But election security is a great example. So in 2016, when it first started
993400	999120	becoming apparent what the Russians were trying to do, there wasn't an established, vibrant
999720	1007520	community of practice in election security. Yes, there was a security research core team that was
1007520	1012180	looking at these issues, but it hadn't really gone mainstream. You didn't really have the vendors
1012180	1018240	on board. You didn't have the operators of the systems, the practical operators of the system.
1018240	1022560	But over the last three or four years, we really worked hard to bring all those partners together
1022560	1028320	and again, create that vibrant community of practice. And so as we look into 2020 election,
1028320	1033620	feel much more comfortable, much better about where things are, the security state of various
1033620	1039520	systems. Are we where we need to go? Oh, hell no. I mean, there is still work to be done.
1039520	1046120	Absolutely. But by coming together all aspects of the community, we have ensured, or at least
1046120	1050700	we're working towards that additional level of assurance that we're doing the right thing. We're
1050700	1058720	defending democracy. And again, the 2020 should be the most secure election in history. So again,
1058720	1064480	you got to break it down. Why did we get there? What led or what contributed to
1065180	1069920	the progress we've made over the last four years? I kind of, you know, I've stolen this from
1069920	1075340	General Mattis, who I think adapted his leadership style from General Washington,
1076280	1083640	President Washington. And it's basically four things. Listen, learn, help, lead. So we're still,
1083640	1090040	I think, in that learning phase of leadership and understanding the community and transitioning
1090040	1097100	well, I think, into the help space. But here in the aviation airspace world, there's opportunities
1097100	1102500	for leadership. And so we're looking at those, seeing what we can do, again, to bring this
1102500	1109560	community together, bring this practical research and sharing of ideas and information. Last thing
1109560	1117460	I think I'll mention is, you know, I think it goes in just about any other discipline within
1117460	1124580	the security research community is vulnerability coordination. And how do you do that in a way
1124580	1131920	that gives the defender an opportunity to close out any gaps before the bad guys have
1132660	1138200	proof of concept? We've seen it in the election space. We've seen it here.
1138820	1146360	You know, there are opportunities to help the defender before advantaging the offensive
1146360	1152160	security side of the offense, the threat actor. So to the extent that we can continue to build
1152160	1157520	those partnerships between the security research community and the vendors, I think we're going to,
1157520	1162220	again, we're going to continue advancing towards a defensive advantage position.
1163040	1170220	Thanks. And that touches on so many different areas. I think one of the things that you've
1170220	1173580	been talking about there from the democratization of it, from the amount of research and hackers
1173580	1180120	that we've got contributing to the village through either breakers yards or buying stuff
1180120	1183200	off the internet and things like that. And actually, they're doing some really great
1183200	1188460	research on what they're finding. And it's trying to make sure that those pathways exist to be able
1188460	1193780	to talk about some of those findings and go through it. Because that then sparks a dialogue
1193780	1200580	that actually allows engagement to happen and actually that progress to be made. So yeah,
1200580	1207000	there's loads of lessons across all of that. To be perfectly clear here, I'm not casting
1207000	1213660	any aspersions or judgment on any part of the community right now. Whether you're on the vendor
1213660	1221600	side of the security research community, I think everybody's got... you talk about ups and downs.
1221840	1226920	Everybody, I think, has made some good strides forward over the last couple of years and we want
1226920	1232820	to continue making those. But it's got to be an open conversation. It's got to be forward-thinking
1232820	1239380	and progressive. That's the only way we're going to get where we need to be.
1240200	1245320	Yeah, and actually... and look at the scale of the challenge. I mean, you touched upon the elections
1245320	1249920	on... if you just sort of sat back and said, let's just protect the elections. I mean, that's a massive
1249920	1255000	task. If we look across the aerospace sector, with everything from airports, the air traffic
1255000	1261900	management aspects, the aircraft, and then space, be that ground stations or all the on-orbit assets,
1263280	1270740	the scale of that is huge. And it's a massively interdependent sector as well. How do we scale
1270740	1275100	this, from your perspective, looking at this nationally and also internationally, with all of
1275100	1280180	the international work you and the team are involved in? But how do we make sure that we
1280180	1285840	do this in lily pads of excellence? I think that's exactly what we've been doing
1285840	1291920	over the last couple years. Everybody's got their normal partners that they work with.
1291920	1297100	And that really became clear to me last year. We were going through a process, working with the
1297100	1305220	Department of Commerce, trying to understand across the telecommunications sector, the ICT folks,
1305220	1313000	where really the most risk lies in terms of supply chain vulnerabilities. Not vulnerabilities,
1313000	1317780	but risks, really, more than anything. And what we found is we didn't have a really strong
1317780	1325460	relationship with the satellite communities in the industry. And it was an area that I think
1325460	1329080	they realized as well, that they didn't really know what we were doing, what our role was. So
1329080	1335200	to get to those elements of scale, I think it's got to be these broader conversations,
1335200	1341700	talking both within government, but also within industry, and understanding what the respective
1341700	1346480	lanes in the road are. And, you know, something I've said a couple times now, but, you know,
1346480	1352980	you really, you know, it goes back to that, the mantra of, you know, to improve something,
1352980	1357520	you've got to be able to measure it. Well, to really scope the problem, you have to understand
1357520	1362460	who the players are, and what their roles are, and how we can all work together. So that's what
1362460	1367860	we've really been focusing on, in part through an effort that we have called the National Critical
1367860	1373760	Function. So it's moving away from a 16 sector based understanding of US critical infrastructure,
1373760	1378100	but instead distilling it down to what are the actual services, what are the functions,
1378100	1384680	really a systemic risk approach to the economy, and then identifying who the key providers of
1384680	1390960	services are. And in doing so, we'll get that better understanding of risk, better partnerships
1390960	1398320	built, and then better solutions against the risks that we need to manage. And against those risks,
1399440	1406660	would you be expecting those critical service providers to be working with the research
1406660	1414660	community and actively engaging with that community as well? I, yeah, I mean, look, this is,
1414660	1421080	part of our force multiplier here as defenders. The security research community has proven time
1421080	1428760	and time again, that it can help. I am, you know, I'm in a similar situation, honestly,
1429120	1433140	to the security research community, in a lot of respects. All the things we do here at CISA
1433800	1439040	tend to be voluntary, public private partnerships. And the security research community working with
1439040	1446140	is similar, it's a partnership. So you do that by building trust, by understanding what the
1446140	1451380	kind of the needs are, and then putting up a capability or putting a resource or service
1451380	1457600	against that need. And both sides benefit. That's how we operate. And I think that's again,
1457600	1462880	going forward, that's that culture, that community, that we really look forward to
1463520	1469780	being a part of, but also fostering. No, thanks. And I think that everyone's actually,
1469780	1474980	I mean, the momentum that we're building up on all of the dialogue across the aerospace,
1474980	1480480	security research and hack community is building in a really nice way. And actually,
1480480	1484640	the engagement we've got from the vendors is great as well. And I think it's from dialogues
1484640	1491440	such as that from yourselves, and the other industry leads really, is making a huge difference.
1492420	1497880	And when we're talking about sort of all of the challenges and the scale of it,
1498580	1504120	how do we try to sort of not see that necessarily through a work, partly through a workforce lens,
1504120	1508500	but there's a lot of organizations now that are really throwing a lot of effort now on to
1509860	1515740	securing or putting more bandwidth on their security. Therefore, how do we spin up the
1515740	1520600	workforce on this from a national perspective, because getting that getting that crossover
1520600	1524600	between aerospace and cyber security and security is really hard. Getting those people
1524600	1533580	that can understand both worlds is a challenge. Right. You know, I think the ongoing conversations
1533580	1543260	about the gap in cybersecurity workforce is ultimately a little bit, it's almost nihilistic,
1543260	1548380	right? It's like, we're always going to fail in secure code and secure deployment.
1548380	1552480	And I think you've already touched on it a little bit. But, you know, I think the more
1552480	1561880	opportunities for STEM, steam, or whatever you want to call it, at the K through 12 level is
1561880	1568440	going to generate a workforce that's more technically savvy. And if we can start folding in
1568440	1574480	rather than bolting cybersecurity expertise on to the after the fact and start building it in
1574480	1581620	whether it's DevSecOps or a security development or software development life cycle, those sorts
1581620	1587320	of approaches, I think, are what we're going to have to adapt. So it's not about building a
1587320	1593600	cybersecurity workforce in the future. It's a security minded engineering and technical
1594020	1598160	workforce to the future. Let's close out these issues before we even get to them. And that's
1598160	1605320	really kind of the mantra that we've got here at the agency. It's defend today, secure tomorrow.
1605320	1611160	What does that mean? So today, we're dealing with patching yesterday's vaults, the stuff that,
1611160	1616640	you know, whatever company dropped. Let's learn from all these examples and figure out how for
1616640	1622100	the next generation, the next iteration of infrastructure deployments, we just don't make
1622100	1626420	things better by design, better by deployment. Let's make our lives a little bit easier. And I
1626420	1630460	frankly, it'd be great if we could put ourselves out of business. That's never going to happen.
1630460	1637280	But it's not a bad thing to shoot for. So I tell you what, this is an issue,
1637280	1644540	workforce, education, that's personal to me. I have five kids here in DC that are in the
1644540	1651600	public education system. And I just see day in, day out, the kind of dearth of, as I see it,
1651600	1657320	appropriate technical education. We've got to overcome that. So there are a number of
1657320	1664740	initiatives that we're working here at CISA that are intended and designed to, again, overcome those
1665460	1670960	shortfalls. And it's not going to be about universities. It's not going to be about
1670960	1676120	colleges. I don't think that's the solution. I think, again, we've got to have better K-12,
1676120	1684860	have better trade school-type education at institutes. Again, it's about putting the
1684860	1692600	tools into the hands of the future workforce and not four-year or post-grad programs.
1692700	1698200	Last thing I'll say on this front is we also need to be smarter about the way that we
1699040	1705780	bring people into the workforce. And in part, that's through our hiring practices. It's through
1705780	1713340	how we advertise for jobs. The Aspen Institute cyber program last summer announced a couple
1713340	1719540	different ways to approach hiring. One is don't over-spec your PDs. Don't over-spec them. Not
1719540	1727500	everybody needs 15 different certifications and 10 years of experience for coding language that's
1727500	1734380	been around for four. You saw that advert as well, then. Yeah, I did. That was a good one.
1735080	1743920	And then also use un-gendered or gender-neutral terms. Unconscious bias is a thing. And how do
1743920	1748340	we get away from that? How can we have a more diverse and inclusive workforce that diversity
1748340	1754040	and lack thereof in cybersecurity and technical fields is absolutely a thing. And I think it's
1754040	1760820	on us as leaders and voices in the community to drive for change.
1761840	1766020	And hopefully that'll be the way as we go forward. And again, it's something that we're
1766020	1770440	seeing through the village is actually just trying to bring on that next generation to
1770440	1774880	really get engaged on it. And a lot of the activity that we've got in the villages is
1774880	1782260	that crawl-walk type activity to really have that on ramp for not necessarily
1785200	1789680	any sort of specific demographic, but anybody who wants to get involved and start engaging and
1789680	1795720	learning about this sort of stuff. It's an open and engaging community, and that's what makes it
1795720	1801300	so great. So just to kind of rip on this for a second, I think about the way that the federal
1801300	1809780	government here in the U.S. hires. And it's a college degree and three years of experience,
1809780	1817320	and you too can qualify for a GS-9 position. But that sort of experience, I see kids going
1817320	1826580	into college at 18 having six, seven years of coding experience, of in some cases development
1826580	1833940	experience, certainly of research experience. So how do we bring those types and reward them
1833940	1839120	for their experience and recognize that experience and not just say, oh, you don't have a CISSP, so
1839120	1844480	you're not qualified. It's absolutely wrongheaded and backwards, but we have to change that. And so
1844480	1848520	there are a few things, again, that we're doing here in the government. We're trying to change
1848520	1854780	that. There's one hiring regime that we're putting the final touches on, the cyber talent
1854780	1860440	management system that'll do just that. It'll look for experience, practical experience,
1860440	1865260	and reward that through the hiring process, rather than saying you need that four-year degree and you
1865260	1870820	need three years of working in a call center. So we've got a couple of things I think we can do
1870820	1877800	here. It's just a matter of implementation. That sounds really great. Now, before we move on,
1877800	1885580	is there anything that, from your perspective, we haven't touched upon, but you'd want us to
1886120	1891920	pitch out or engage with on the community around the aerospace cybersecurity?
1892820	1900940	Well, just to kind of do a self-serving promo here, just on the last piece, we are hiring CISA.
1901200	1905800	There are a lot of positions that we have that don't require top secret clearances.
1906390	1912380	Either the secret or the no security clearance level. I am looking for practitioners. I'm
1912380	1917000	looking for people that know the community, that can work with the community. I think we have a
1917000	1921680	unique offering and a unique place within the federal government that's really the closest
1921680	1927080	thing to the private sector, the closest thing to the security research community. So check us out
1927080	1933960	at cisa.gov slash careers. We are always hiring. Okay, well, we don't normally do commercial
1933960	1941460	pitches, but I think I'll let you have that one. Chris, many thanks for your time. Thank you for
1941460	1946380	joining us at the kickoff for the Aerospace Village. And hopefully once we get through
1947140	1950740	COVID, then look forward to seeing you again in person. Thank you very much.
1951140	1954940	Hey, thanks, Pete. It's great to be with you. If I was on Room Raider, I'd probably give you about
1955080	1960220	a four out of 10. You'd get probably five or six for all your badges, but your lack of art
1960220	1965460	and any potted plants probably set you back a few. Yeah, I made sure I kicked the cats out,
1965460	1973660	so I thought I'd get a few extra points. Thanks very much. So our next guest speaker is Dr. Will
1973660	1978220	Roper, and I'm honored to have him here this morning. So Dr. Will Roper is the Assistant
1978220	1984540	Secretary of the U.S. Air Force for Acquisition Technology and Logistics. And he and his team,
1984540	1988180	along with DDS, were great supporters of the village last year and have been again this year
1988180	1996060	as well. And as you can see from the efforts that we've got through the HACSAT CTF and also
1996060	2001980	the workshops that they've brought along to the village to support us this year, they've shown a
2001980	2010220	huge amount of passion in the topic, and it's great to have him here. So, Dr. Will Roper.
2010220	2017400	Hello, everyone, and welcome to the Aerospace Village at DEFCON 28, safe mode. I'm Will Roper,
2017400	2023220	the Head of Air Force and Space Force Programs, and it is a privilege to be at DEFCON for my
2023220	2030620	second year. Last year, I came and was blown away by the technical talent that DEFCON has in this
2030620	2037960	community of creative, inquisitive investigators of all things software-driven. We brought a live
2037960	2044840	hacking opportunity with one of our F-15 fighters, and yes, this community was able to get in.
2044840	2050480	We were left with a lot of great understanding about how to be better in the cyber domain,
2050480	2055720	and we're back this year with an amazing opportunity that's going to teach the community
2055720	2063880	and us how to take good cyber practices into space. Orbiting overhead right now is a satellite
2063880	2070120	that hackers are going to have access to to see if they can apply their skills to get in.
2070120	2075080	They're going to have to understand complicated physics, how satellites communicate with the
2075080	2081160	ground, and how we communicate back in order to overcome this capture the flag challenge.
2081160	2088180	But seeing the talent that's here, my money is on that they will succeed. Now, how cool is that,
2088180	2095120	that winning teams are going to get to have their code run live in space? And what we'll learn is
2095120	2102600	how to make this new area of defense and commercial innovation more cyber secure in the long run.
2102600	2108360	You know, if you back up and you look at how the Air Force engaged, we really sat behind our high
2108360	2114600	walls and fence lines, and we used secrecy as a way to keep our military systems safe. That doesn't
2114600	2120940	make sense in today's world. With so much technology happening commercially, we've got to get outside
2120940	2127180	of our bases and fence lines and be part of this community that continues to push innovation
2127180	2134020	forward. So we are here to share, we are here to learn, and to make openness and transparency
2134020	2140780	part of our equation for being secure. Thank you for being here as part of the Aerospace Village.
2140780	2145820	Thank you for being here to participate in HackASAT. And next year, when we're back with
2145820	2151620	the next round of the thing we bring to expose to the community, I hope you'll share your thoughts
2151620	2158580	about what opportunity would inspire you to help us learn how to be a better cyber warrior.
2158580	2164500	For the 60 billion dollars of airplanes and satellites and cyber technology that we produce
2164500	2171340	each year, the cutting edge comes from software. Everything we learn about making that cutting
2171340	2177900	edge more secure makes our men and women in uniform, this nation, and our allies and partners
2177900	2183940	and all who work with us safer. So we are proud to be part of this community and can't wait to see
2183940	2184980	what's ahead.