WEBVTT 00:05.680 --> 00:06.940 Good morning, Beth. 00:07.320 --> 00:15.740 I'm Pete Cooper, Director of the Aerospace Village, and on behalf of the team, welcome to the Aerospace Village at Virtual DEF CON 28. 00:16.300 --> 00:23.960 Not quite what we all thought was going to be the plan, but let's face it, 2020 is trying to throw as many curveballs at us as possible. 00:24.100 --> 00:36.100 So while we're all trying to stay safe and healthy, we've got an amazing three days of virtual content lined up for you, irrespective of you being completely new to this or whether you're a seasoned black badge holder. 00:36.580 --> 00:56.880 Aviation is really a cornerstone of the global infrastructure and economy, and while passenger safety is at an all-time high, the increasing adoption of connected and digitized technologies is exposing aircraft, airport satellites, and the interdependent aerospace ecosystem to new types of risks and threats. 00:57.240 --> 01:12.280 And the consequences of a cyber security failure in a ground, air, or space-based system can impact human life, public safety, and even a crisis of confidence in the trustworthiness of air travel, which could undermine economic and national security. 01:12.480 --> 01:22.880 And as those traditional domains of aviation, safety, and security increasingly overlap, the more we can collaborate to enable stakeholders ensures that we're going to be safer and sooner together. 01:23.740 --> 01:36.820 The Aerospace Village is a non-profit set up and led by a volunteer team of hackers, pilots, engineers, policy advisors, who come from both across the public and private sectors. 01:37.340 --> 01:38.700 And why have we done this? 01:38.700 --> 01:54.300 Because we want to build an inclusive community around the topic of aerospace security, inspire you to get involved in one of the most amazing and growing areas of research that's out there, and promote and build aerospace cybersecurity knowledge and expertise. 01:55.040 --> 02:11.140 And through the Aerospace Village, the research community really is inviting everybody, be they industry leaders, researchers, academia, anybody interested in aviation, space security, safety, and resilience, to come in, understand, learn, and collaborate together. 02:11.380 --> 02:14.840 Because empathy and understanding is going to build common ground. 02:15.160 --> 02:21.380 Any sort of acts and words looking to increase division between the communities is going to undermine the efforts of us working together. 02:21.380 --> 02:30.760 So we're looking to welcome anybody and everybody who's wanting to improve aviation and space security, safety, and resilience through positive and productive collaboration. 02:31.660 --> 02:36.220 This isn't just a cool topic with a huge scope of cool tech. 02:36.640 --> 02:43.120 There's loads of research on the topic already, but it's a global topic and it's only getting bigger. 02:43.120 --> 02:48.420 And there's so much that is out there that is great to look at and explore. 02:48.600 --> 02:52.380 Last year, we had the Aviation Village at DEFCON. 02:52.660 --> 03:01.020 That was our first year, and we had great activity across airports, air traffic management, and aircraft, and great engagement. 03:01.480 --> 03:07.400 It's all massively interconnected and interdependent, and we started building out bridges across the community and industry. 03:07.800 --> 03:12.380 But since then, on the importance of such efforts, there's been some great progress. 03:12.400 --> 03:15.080 For example, international initiatives. 03:15.260 --> 03:30.800 The UN body for aviation, which is ICAO, with 193 member states, published late last year their first cyber security strategy for aviation, which specifically called out that states should give adequate protection to good faith researchers. 03:31.280 --> 03:37.280 And that's more and more recognition that such research like this is a positive thing, and it needs to be encouraged as well as protected. 03:38.120 --> 03:40.440 And additionally, there's also industry initiatives. 03:40.440 --> 03:49.180 For example, Boeing standing up an industry cyber technical council that actually incorporates the research and hacking community working with the team there. 03:49.860 --> 03:53.200 So this year, we've evolved into the Aerospace Village. 03:53.440 --> 03:59.060 Aviation is critically dependent on space, and the sector is really the aerospace sector. 03:59.060 --> 04:04.080 So yeah, we rolled into space, and we've now got a security community that's stretching from Earth into orbit. 04:04.240 --> 04:10.820 And a big part of that effort this year is to hack that CTF, which is pretty much the coolest CTF that isn't on the planet. 04:11.240 --> 04:13.020 And more of that later. 04:13.920 --> 04:20.680 It's amazing the support that we've got this year to help put on an amazing event for you over the next three days. 04:20.680 --> 04:39.860 And that support stretches from the USAF, DDS, CESA, Boeing, the American Institute of Aeronautics and Astronautics, both the aviation and space ISACs, TALIS, Capital Tech University, California Polytechnic, Pentas Partners, I'm the Cavalry, Rapid Seven, 04:39.860 --> 04:42.960 and even astronaut Pam Melroy is here, and more. 04:43.160 --> 04:51.640 All looking to try and give you a great experience and learn as much and play with as much as you want to over the next three days. 04:51.880 --> 05:00.860 We've got everything from topics on aircraft, airports, air traffic management, so air traffic control, aircraft, and space. 05:00.860 --> 05:03.340 Everything from satellites to ground stations. 05:03.680 --> 05:09.340 And we've got talks, panels, workshops, and CTFs, and everything from beginning to advanced. 05:09.480 --> 05:23.960 So please find our website at aerospacevillage.org, which has got the schedule and more content about what's on and what we're doing both now for DEF CON and as we're going forwards. 05:23.980 --> 05:28.380 And subscribe to us on YouTube and follow us on Twitter at Secure Aerospace. 05:28.760 --> 05:34.460 And finally, to really pull together and drive this amazing event, it takes an amazing team. 05:34.740 --> 05:36.560 And it's an honor to be a part of that amazing team. 05:36.560 --> 05:41.780 So when you're pleased floating around the virtual village, look out for the village leads and those team members. 05:41.780 --> 05:42.600 Say hi and thanks. 05:42.600 --> 05:46.200 They are the most awesome group of people that pull this together. 05:48.320 --> 05:54.460 So next up are two guest speakers that are going to help us open up the Aerospace Village this year. 05:54.500 --> 06:04.320 Partnerships are going to be really important to help build out this community and build trust between the hacking and researching community and industry and government. 06:04.320 --> 06:06.680 So it's great to have them here speaking at the opening. 06:06.680 --> 06:12.760 So the first is CISA Director Chris Krebs and this is the conversation that I had with him. 06:12.760 --> 06:13.620 Thank you. 06:13.920 --> 06:23.300 So welcome everybody to the Aerospace Village and I'm honored to have Director CISA Chris Krebs with us to help with the opening. 06:23.300 --> 06:25.240 So good morning Chris. 06:25.240 --> 06:26.460 Hey Pete, thanks for having me. 06:26.460 --> 06:32.140 Good to be here with you and the Aerospace Village, formerly the Aviation Village. 06:32.220 --> 06:33.220 It's a journey. 06:33.220 --> 06:34.340 It always is. 06:34.860 --> 06:38.920 So you came to the Aviation Village last year. 06:38.920 --> 06:46.420 We've got the Aerospace Village this year and I know that you and the CISA team are working really, really hard on the aerospace sector. 06:46.980 --> 06:54.540 But what's unique do you think about the aerospace sector when it comes to some of the challenges that we're facing across the security perspective? 06:55.300 --> 07:04.860 Yeah, I think it's representative of almost everything else in the kind of almost the industrial or life safety space. 07:04.860 --> 07:15.280 Things that historically have not been connected or relied upon overly networked systems, IT systems that either touch the internet or have paths of entry. 07:15.460 --> 07:19.000 That's different than it was 10 plus years ago. 07:19.000 --> 07:31.160 You know, when a plane used to lose the contact with the earth, it also lost contact, generally speaking, with communications channels. 07:31.160 --> 07:42.660 So what we're seeing now though is due to various customer demands, other navigation requirements, that yeah, there are pathways into a plane. 07:43.080 --> 07:45.080 And frankly, what's at stake? 07:45.080 --> 07:47.620 And we're really truly talking about lives here. 07:47.620 --> 08:04.440 So, you know, when I look at both aviation but more broadly aerospace, it's not just about the things that are moving around in the air, it's the things that are going through the infrastructure itself. 08:04.640 --> 08:08.080 You know, look at what's happened here in the US over the last year or so. 08:08.080 --> 08:09.840 It's the establishment of Space Command. 08:09.840 --> 08:10.260 Why? 08:10.260 --> 08:16.420 It's because the space-based infrastructure is that critical to just day-to-day operations. 08:16.420 --> 08:32.140 When you talk about PNT, when you talk about satellite-based communications, it really is a incredibly critical slice of not just our infrastructure, but of frankly our economy. 08:33.360 --> 08:42.200 So do you think that the threat actors are different to the other sectors, or is this still the same sort of threat environment that we're looking at here? 08:43.100 --> 08:47.360 Well, I do think that there are a couple different things you got to think about with the threat actors. 08:47.360 --> 08:54.700 So yes, they're absolutely threat actors that are focusing in on this aerospace ecosystem. 08:54.700 --> 08:58.820 And not that it's been a steady state thing, I think it's increasing. 08:59.200 --> 09:05.860 They're understanding the ability and the capability, particularly when you talk about functional disruptions. 09:06.380 --> 09:11.700 The future of warfare is not necessarily going to be on the plains of Europe. 09:12.040 --> 09:19.740 The first strike capabilities that you would see launched against our infrastructure are things we need to be thinking about. 09:19.740 --> 09:27.240 And that's from an elections perspective, election infrastructure perspective, that's what I've been talking about now for years. 09:27.240 --> 09:36.180 What was so dramatic or significant about the 2016 interference with the US election was it was almost a Sputnik moment. 09:36.180 --> 09:43.940 Take us back to 1957, and the Russia, the Soviets at the time, put Sputnik into low Earth orbit. 09:44.060 --> 09:53.100 It wasn't that they got to space first, it was that they had an ICBM, they had this capability to overcome geographic distancing and reach out and touch us. 09:53.140 --> 09:55.860 Why was 2016 the same? 09:55.860 --> 10:01.620 It was because cyber could be used as that tool to reach out and touch us and destabilize democracy. 10:01.740 --> 10:17.320 I think the future, again, of conflict is going to be using these infrastructure aspects against us to undermine our confidence, undermine our ability, or undermine our willingness to do the things that need to be done. 10:18.080 --> 10:19.100 And thanks for that. 10:19.100 --> 10:26.860 And so it shows that really, that this is touching on pretty much all the themes about trust and resilience across all the other sectors as well. 10:26.880 --> 10:45.260 But for those that are sort of new into the aerospace sector, and we've got loads of researchers and hackers that are now really engaging on the topic, what's the key challenge for yourselves on trying to look at the safety and security aspects of it? 10:45.260 --> 10:46.760 Because it's a safety critical industry. 10:46.760 --> 10:50.500 So we've got the FAA and also CISA in the frame as well. 10:50.500 --> 11:01.980 Can you try and help explain to the audience out there is actually how does that balance work on working through safety and security with the different partners that are out there? 11:02.720 --> 11:05.620 So, oh, wow. 11:05.720 --> 11:09.880 So, you know, they're the technical aspects of it, actually getting access to the equipment. 11:09.880 --> 11:14.640 This is not kit you can typically just find out they're hanging on eBay. 11:14.900 --> 11:24.020 So there are some proprietary systems that you've got to be able to get access to and work in an environment that's trusted. 11:24.020 --> 11:25.720 I think that's the second aspect. 11:25.720 --> 11:29.260 Beyond the technical, it's the relationship piece and the trust. 11:29.260 --> 11:46.820 You know, this is, I think, that constant struggle, that constant tension between the research community and the owner operators or the vendors is how do you have an effective, a meaningful conversation about security and trust when you add life safety? 11:46.820 --> 11:50.040 Same things for the medical device community, too. 11:50.040 --> 11:56.500 You know, unfettered access into a piece of equipment that has life safety implications is not something to be toyed with. 11:56.500 --> 11:59.460 And you want to make sure that you've got open lines of communication. 11:59.460 --> 12:08.660 You're not just dropping a ball onto the open market without giving the folks that are maintaining those systems the appropriate time to control or to implement. 12:08.660 --> 12:20.680 But that also, you know, when you talk about these proprietary systems, there are some DCMA and other issues that really restrict the ability or the access. 12:20.680 --> 12:28.920 So we have looked over the last several years to help really foster those conversations to bring the security researcher community together with the vendor community. 12:28.920 --> 12:30.640 And it's been a journey. 12:30.740 --> 12:34.140 You talk about the journey from the aviation village to the aerospace village. 12:34.140 --> 12:35.460 It's really been a journey. 12:35.460 --> 12:48.980 And I am so incredibly, you know, impressed by a number of the bigger companies out there that, you know, a year and a half ago, weren't particularly interested, for instance, in participating in the village. 12:48.980 --> 12:57.320 But now they're meaningful, full-bore, full-throated supporters and members because they get the kind of force multiplier aspect. 12:57.320 --> 13:00.300 I'd rather have you on my team than working against me. 13:00.300 --> 13:03.080 That sort of mentality has really taken root. 13:03.080 --> 13:07.320 And we're, you know, proud to be a part of that effort to keep driving forward. 13:07.540 --> 13:08.200 No, thanks. 13:08.200 --> 13:14.420 And it's that challenge of trying to make sure the dialogue's there because the perspectives are different. 13:15.560 --> 13:21.760 And it feels like trying to fit a really small Venn diagram together and just getting that common ground in the middle. 13:23.220 --> 13:29.200 But what do you think CISA, I mean, and partnering with us on the villages is great. 13:29.520 --> 13:37.100 But what do you think we, the village and the community, and CISA would want to be doing in the next sort of year? 13:37.100 --> 13:43.620 I mean, how do you think that that can work better across all of those stakeholders? 13:43.640 --> 13:47.460 And also as well, what message would you be giving to industry across that as well? 13:48.000 --> 14:02.540 Yeah, so last year, for instance, we were kind of silent partners, helping, again, facilitate some of the conversations, but not a financial supporter, not a, you know, really staffing supporter. 14:02.540 --> 14:13.160 We had folks there last year in Vegas, this year, much more engaged in the planning, bringing the partners together, working with the information sharing and analysis centers, working with the vendors. 14:13.160 --> 14:33.000 I think going forward, I really want to see, you know, assuming we, and hopefully we get through this, this current pandemic where we can get back together physically, really would love to see more practical environmental environments that we can bring researchers in to take, 14:33.000 --> 14:36.720 you know, start shooting holes in things, figuratively, not literally. 14:36.840 --> 14:52.980 But, you know, we've been working in our industrial control systems initiative to develop environmental laboratories, so our cellar program, where we've got control systems environments that folks can mess around with, that they can either conduct research on, 14:52.980 --> 15:09.180 we can tailor them to specific environments like water, but also I think aviation is a great opportunity going forward where we can continue, you know, it's almost like democratizing security for the control system space and including the aerospace environment. 15:09.180 --> 15:17.660 You know, again, it's just making these partnerships more accessible to everyone and much, much more open. 15:17.660 --> 15:22.660 And again, you know, the concept here really more than anything is let's democratize this. 15:22.660 --> 15:27.540 It does not happen overnight, so we've all got to be patient, keep plucking away. 15:27.540 --> 15:35.020 And yeah, sometimes various parts of the community raise their voice and get a little frustrated with others, but keep working on it. 15:35.020 --> 15:39.660 And the more we work on it, the more trust we'll build and the more we'll be able to do in the out years. 15:40.860 --> 15:44.100 And is this the same journey that you've seen across the other sectors as well? 15:44.320 --> 15:58.140 I mean, from what we're seeing across the research and hack community and the dialogue that we've got with industry and regulators and everybody is that actually, this is a journey that has its ups and downs. 15:59.180 --> 16:06.340 And it's not always an easy path because there are so many different and quite strong perspectives out there. 16:07.600 --> 16:12.460 But it sort of feels like this is a journey that other sectors have gone through as well. 16:13.080 --> 16:13.980 Yeah, absolutely. 16:13.980 --> 16:16.840 And again, I'll make second elections. 16:16.840 --> 16:26.920 If somebody's got the Chris Krebs bingo card, if I don't mention election security like six times in any speech, even if it has nothing to do with election security, I've failed. 16:27.020 --> 16:29.380 But election security is a great example. 16:29.380 --> 16:42.020 So in 2016, when it first started becoming apparent what the Russians were trying to do, there wasn't an established, vibrant community of practice in election security. 16:42.020 --> 16:50.880 Yes, there was a security research core team that was looking at these issues, but it hadn't really gone mainstream. 16:50.880 --> 16:53.220 You didn't really have the vendors on board. 16:53.220 --> 16:58.240 You didn't have the operators of the systems, the practical operators of the system. 16:58.240 --> 17:05.860 But over the last three or four years, we really worked hard to bring all those partners together and again, create that vibrant community of practice. 17:05.860 --> 17:14.260 And so as we look into 2020 election, feel much more comfortable, much better about where things are, the security state of various systems. 17:14.260 --> 17:16.120 Are we where we need to go? 17:16.380 --> 17:17.400 Oh, hell no. 17:17.400 --> 17:19.520 I mean, there is still work to be done. 17:19.520 --> 17:20.560 Absolutely. 17:20.800 --> 17:30.600 But by coming together all aspects of the community, we have ensured, or at least we're working towards that additional level of assurance that we're doing the right thing. 17:30.600 --> 17:32.420 We're defending democracy. 17:32.780 --> 17:37.900 And again, the 2020 should be the most secure election in history. 17:37.900 --> 17:39.680 So again, you got to break it down. 17:39.700 --> 17:41.660 Why did we get there? 17:41.740 --> 17:47.980 What led or what contributed to the progress we've made over the last four years? 17:47.980 --> 17:57.560 I kind of, you know, I've stolen this from General Mattis, who I think adapted his leadership style from General Washington, President Washington. 17:57.560 --> 17:59.720 And it's basically four things. 17:59.780 --> 18:02.740 Listen, learn, help, lead. 18:02.740 --> 18:12.780 So we're still, I think, in that learning phase of leadership and understanding the community and transitioning well, I think, into the help space. 18:12.780 --> 18:18.240 But here in the aviation airspace world, there's opportunities for leadership. 18:18.240 --> 18:29.120 And so we're looking at those, seeing what we can do, again, to bring this community together, bring this practical research and sharing of ideas and information. 18:29.120 --> 18:43.080 Last thing I think I'll mention is, you know, I think it goes in just about any other discipline within the security research community is vulnerability coordination. 18:43.080 --> 18:54.500 And how do you do that in a way that gives the defender an opportunity to close out any gaps before the bad guys have proof of concept? 18:54.800 --> 18:56.700 We've seen it in the election space. 18:56.700 --> 18:58.200 We've seen it here. 18:58.820 --> 19:10.120 You know, there are opportunities to help the defender before advantaging the offensive security side of the offense, the threat actor. 19:10.120 --> 19:22.220 So to the extent that we can continue to build those partnerships between the security research community and the vendors, I think we're going to, again, we're going to continue advancing towards a defensive advantage position. 19:23.040 --> 19:23.660 Thanks. 19:23.660 --> 19:26.680 And that touches on so many different areas. 19:26.940 --> 19:41.440 I think one of the things that you've been talking about there from the democratization of it, from the amount of research and hackers that we've got contributing to the village through either breakers yards or buying stuff off the internet and things like that. 19:41.440 --> 19:45.160 And actually, they're doing some really great research on what they're finding. 19:45.580 --> 19:50.960 And it's trying to make sure that those pathways exist to be able to talk about some of those findings and go through it. 19:51.580 --> 20:00.120 Because that then sparks a dialogue that actually allows engagement to happen and actually that progress to be made. 20:00.120 --> 20:03.240 So yeah, there's loads of lessons across all of that. 20:03.240 --> 20:12.300 To be perfectly clear here, I'm not casting any aspersions or judgment on any part of the community right now. 20:12.540 --> 20:21.600 Whether you're on the vendor side of the security research community, I think everybody's got... you talk about ups and downs. 20:21.840 --> 20:28.780 Everybody, I think, has made some good strides forward over the last couple of years and we want to continue making those. 20:28.780 --> 20:30.800 But it's got to be an open conversation. 20:31.100 --> 20:33.980 It's got to be forward-thinking and progressive. 20:34.140 --> 20:39.380 That's the only way we're going to get where we need to be. 20:40.200 --> 20:43.140 Yeah, and actually... and look at the scale of the challenge. 20:43.700 --> 20:49.260 I mean, you touched upon the elections on... if you just sort of sat back and said, let's just protect the elections. 20:49.260 --> 20:50.720 I mean, that's a massive task. 20:50.720 --> 21:04.980 If we look across the aerospace sector, with everything from airports, the air traffic management aspects, the aircraft, and then space, be that ground stations or all the on-orbit assets, the scale of that is huge. 21:04.980 --> 21:08.400 And it's a massively interdependent sector as well. 21:09.240 --> 21:17.940 How do we scale this, from your perspective, looking at this nationally and also internationally, with all of the international work you and the team are involved in? 21:17.940 --> 21:22.840 But how do we make sure that we do this in lily pads of excellence? 21:23.220 --> 21:26.940 I think that's exactly what we've been doing over the last couple years. 21:26.940 --> 21:31.920 Everybody's got their normal partners that they work with. 21:31.920 --> 21:35.180 And that really became clear to me last year. 21:35.180 --> 21:52.060 We were going through a process, working with the Department of Commerce, trying to understand across the telecommunications sector, the ICT folks, where really the most risk lies in terms of supply chain vulnerabilities. 21:52.060 --> 21:54.800 Not vulnerabilities, but risks, really, more than anything. 21:54.860 --> 22:03.280 And what we found is we didn't have a really strong relationship with the satellite communities in the industry. 22:03.340 --> 22:08.940 And it was an area that I think they realized as well, that they didn't really know what we were doing, what our role was. 22:08.940 --> 22:23.440 So to get to those elements of scale, I think it's got to be these broader conversations, talking both within government, but also within industry, and understanding what the respective lanes in the road are. 22:24.060 --> 22:34.680 And, you know, something I've said a couple times now, but, you know, you really, you know, it goes back to that, the mantra of, you know, to improve something, you've got to be able to measure it. 22:34.700 --> 22:41.820 Well, to really scope the problem, you have to understand who the players are, and what their roles are, and how we can all work together. 22:41.820 --> 22:48.560 So that's what we've really been focusing on, in part through an effort that we have called the National Critical Function. 22:48.560 --> 23:06.380 So it's moving away from a 16 sector based understanding of US critical infrastructure, but instead distilling it down to what are the actual services, what are the functions, really a systemic risk approach to the economy, and then identifying who the key providers of services are. 23:06.380 --> 23:15.720 And in doing so, we'll get that better understanding of risk, better partnerships built, and then better solutions against the risks that we need to manage. 23:16.100 --> 23:29.820 And against those risks, would you be expecting those critical service providers to be working with the research community and actively engaging with that community as well? 23:30.700 --> 23:38.400 I, yeah, I mean, look, this is, part of our force multiplier here as defenders. 23:38.760 --> 23:44.280 The security research community has proven time and time again, that it can help. 23:44.460 --> 23:51.820 I am, you know, I'm in a similar situation, honestly, to the security research community, in a lot of respects. 23:51.820 --> 23:57.180 All the things we do here at CISA tend to be voluntary, public private partnerships. 23:57.180 --> 24:01.640 And the security research community working with is similar, it's a partnership. 24:01.700 --> 24:13.080 So you do that by building trust, by understanding what the kind of the needs are, and then putting up a capability or putting a resource or service against that need. 24:13.140 --> 24:15.100 And both sides benefit. 24:15.100 --> 24:16.560 That's how we operate. 24:16.560 --> 24:26.100 And I think that's again, going forward, that's that culture, that community, that we really look forward to being a part of, but also fostering. 24:26.560 --> 24:27.280 No, thanks. 24:27.280 --> 24:40.120 And I think that everyone's actually, I mean, the momentum that we're building up on all of the dialogue across the aerospace, security research and hack community is building in a really nice way. 24:40.120 --> 24:42.880 And actually, the engagement we've got from the vendors is great as well. 24:42.880 --> 24:51.440 And I think it's from dialogues such as that from yourselves, and the other industry leads really, is making a huge difference. 24:52.420 --> 25:14.020 And when we're talking about sort of all of the challenges and the scale of it, how do we try to sort of not see that necessarily through a work, partly through a workforce lens, but there's a lot of organizations now that are really throwing a lot of effort now on to securing or putting more bandwidth on their security. 25:14.060 --> 25:24.100 Therefore, how do we spin up the workforce on this from a national perspective, because getting that getting that crossover between aerospace and cyber security and security is really hard. 25:24.100 --> 25:27.160 Getting those people that can understand both worlds is a challenge. 25:27.260 --> 25:28.020 Right. 25:28.440 --> 25:43.440 You know, I think the ongoing conversations about the gap in cybersecurity workforce is ultimately a little bit, it's almost nihilistic, right? 25:43.440 --> 25:48.380 It's like, we're always going to fail in secure code and secure deployment. 25:48.380 --> 25:50.760 And I think you've already touched on it a little bit. 25:50.760 --> 26:06.340 But, you know, I think the more opportunities for STEM, steam, or whatever you want to call it, at the K through 12 level is going to generate a workforce that's more technically savvy. 26:06.340 --> 26:25.140 And if we can start folding in rather than bolting cybersecurity expertise on to the after the fact and start building it in whether it's DevSecOps or a security development or software development life cycle, those sorts of approaches, I think, are what we're going to have to adapt. 26:25.140 --> 26:28.520 So it's not about building a cybersecurity workforce in the future. 26:28.640 --> 26:34.740 It's a security minded engineering and technical workforce to the future. 26:34.960 --> 26:37.840 Let's close out these issues before we even get to them. 26:37.840 --> 26:42.560 And that's really kind of the mantra that we've got here at the agency. 26:42.560 --> 26:45.320 It's defend today, secure tomorrow. 26:45.320 --> 26:46.100 What does that mean? 26:46.100 --> 26:53.620 So today, we're dealing with patching yesterday's vaults, the stuff that, you know, whatever company dropped. 26:53.620 --> 27:04.580 Let's learn from all these examples and figure out how for the next generation, the next iteration of infrastructure deployments, we just don't make things better by design, better by deployment. 27:04.580 --> 27:06.280 Let's make our lives a little bit easier. 27:06.280 --> 27:09.140 And I frankly, it'd be great if we could put ourselves out of business. 27:09.140 --> 27:10.460 That's never going to happen. 27:10.460 --> 27:13.540 But it's not a bad thing to shoot for. 27:14.380 --> 27:20.820 So I tell you what, this is an issue, workforce, education, that's personal to me. 27:20.820 --> 27:26.040 I have five kids here in DC that are in the public education system. 27:26.040 --> 27:34.660 And I just see day in, day out, the kind of dearth of, as I see it, appropriate technical education. 27:35.060 --> 27:36.600 We've got to overcome that. 27:36.600 --> 27:46.460 So there are a number of initiatives that we're working here at CISA that are intended and designed to, again, overcome those shortfalls. 27:46.460 --> 27:49.720 And it's not going to be about universities. 27:49.720 --> 27:51.480 It's not going to be about colleges. 27:51.480 --> 27:53.280 I don't think that's the solution. 27:53.380 --> 28:02.260 I think, again, we've got to have better K-12, have better trade school-type education at institutes. 28:02.520 --> 28:12.600 Again, it's about putting the tools into the hands of the future workforce and not four-year or post-grad programs. 28:12.700 --> 28:21.160 Last thing I'll say on this front is we also need to be smarter about the way that we bring people into the workforce. 28:21.160 --> 28:25.340 And in part, that's through our hiring practices. 28:25.340 --> 28:27.440 It's through how we advertise for jobs. 28:27.440 --> 28:36.120 The Aspen Institute cyber program last summer announced a couple different ways to approach hiring. 28:36.120 --> 28:38.500 One is don't over-spec your PDs. 28:38.500 --> 28:39.420 Don't over-spec them. 28:39.420 --> 28:49.040 Not everybody needs 15 different certifications and 10 years of experience for coding language that's been around for four. 28:49.340 --> 28:51.460 You saw that advert as well, then. 28:51.620 --> 28:52.680 Yeah, I did. 28:53.000 --> 28:54.380 That was a good one. 28:55.080 --> 29:00.480 And then also use un-gendered or gender-neutral terms. 29:01.480 --> 29:03.400 Unconscious bias is a thing. 29:03.440 --> 29:04.800 And how do we get away from that? 29:04.800 --> 29:13.420 How can we have a more diverse and inclusive workforce that diversity and lack thereof in cybersecurity and technical fields is absolutely a thing. 29:13.420 --> 29:20.820 And I think it's on us as leaders and voices in the community to drive for change. 29:21.840 --> 29:24.340 And hopefully that'll be the way as we go forward. 29:24.340 --> 29:31.540 And again, it's something that we're seeing through the village is actually just trying to bring on that next generation to really get engaged on it. 29:31.540 --> 29:51.400 And a lot of the activity that we've got in the villages is that crawl-walk type activity to really have that on ramp for not necessarily any sort of specific demographic, but anybody who wants to get involved and start engaging and learning about this sort of stuff. 29:53.340 --> 29:56.560 It's an open and engaging community, and that's what makes it so great. 29:56.860 --> 30:02.460 So just to kind of rip on this for a second, I think about the way that the federal government here in the U.S. 30:02.460 --> 30:03.360 hires. 30:03.360 --> 30:13.020 And it's a college degree and three years of experience, and you too can qualify for a GS-9 position. 30:13.480 --> 30:31.000 But that sort of experience, I see kids going into college at 18 having six, seven years of coding experience, of in some cases development experience, certainly of research experience. 30:31.000 --> 30:40.280 So how do we bring those types and reward them for their experience and recognize that experience and not just say, oh, you don't have a CISSP, so you're not qualified. 30:40.340 --> 30:44.320 It's absolutely wrongheaded and backwards, but we have to change that. 30:44.320 --> 30:47.660 And so there are a few things, again, that we're doing here in the government. 30:47.660 --> 30:48.840 We're trying to change that. 30:48.840 --> 30:56.880 There's one hiring regime that we're putting the final touches on, the cyber talent management system that'll do just that. 30:56.880 --> 31:08.440 It'll look for experience, practical experience, and reward that through the hiring process, rather than saying you need that four-year degree and you need three years of working in a call center. 31:08.440 --> 31:11.600 So we've got a couple of things I think we can do here. 31:11.640 --> 31:13.640 It's just a matter of implementation. 31:14.320 --> 31:15.920 That sounds really great. 31:16.120 --> 31:31.920 Now, before we move on, is there anything that, from your perspective, we haven't touched upon, but you'd want us to pitch out or engage with on the community around the aerospace cybersecurity? 31:32.820 --> 31:40.940 Well, just to kind of do a self-serving promo here, just on the last piece, we are hiring CISA. 31:41.200 --> 31:45.800 There are a lot of positions that we have that don't require top secret clearances. 31:46.390 --> 31:50.220 Either the secret or the no security clearance level. 31:50.220 --> 31:52.260 I am looking for practitioners. 31:52.260 --> 31:55.700 I'm looking for people that know the community, that can work with the community. 31:55.700 --> 32:05.800 I think we have a unique offering and a unique place within the federal government that's really the closest thing to the private sector, the closest thing to the security research community. 32:05.800 --> 32:09.540 So check us out at cisa.gov slash careers. 32:09.680 --> 32:11.540 We are always hiring. 32:12.260 --> 32:15.760 Okay, well, we don't normally do commercial pitches, but I think I'll let you have that one. 32:18.680 --> 32:20.940 Chris, many thanks for your time. 32:21.040 --> 32:24.800 Thank you for joining us at the kickoff for the Aerospace Village. 32:24.960 --> 32:29.740 And hopefully once we get through COVID, then look forward to seeing you again in person. 32:29.740 --> 32:30.740 Thank you very much. 32:31.140 --> 32:31.940 Hey, thanks, Pete. 32:31.940 --> 32:32.820 It's great to be with you. 32:32.820 --> 32:36.440 If I was on Room Raider, I'd probably give you about a four out of 10. 32:36.520 --> 32:43.120 You'd get probably five or six for all your badges, but your lack of art and any potted plants probably set you back a few. 32:43.120 --> 32:47.480 Yeah, I made sure I kicked the cats out, so I thought I'd get a few extra points. 32:47.940 --> 32:49.300 Thanks very much. 32:50.780 --> 32:53.560 So our next guest speaker is Dr. 32:53.560 --> 32:56.520 Will Roper, and I'm honored to have him here this morning. 32:56.720 --> 32:57.320 So Dr. 32:57.320 --> 32:59.380 Will Roper is the Assistant Secretary of the U.S. 32:59.380 --> 33:02.320 Air Force for Acquisition Technology and Logistics. 33:03.140 --> 33:09.060 And he and his team, along with DDS, were great supporters of the village last year and have been again this year as well. 33:09.280 --> 33:26.840 And as you can see from the efforts that we've got through the HACSAT CTF and also the workshops that they've brought along to the village to support us this year, they've shown a huge amount of passion in the topic, and it's great to have him here. 33:26.840 --> 33:27.620 So, Dr. 33:27.620 --> 33:28.500 Will Roper. 33:29.640 --> 33:36.300 Hello , everyone, and welcome to the Aerospace Village at DEFCON 28, safe mode. 33:36.300 --> 33:44.580 I'm Will Roper, the Head of Air Force and Space Force Programs, and it is a privilege to be at DEFCON for my second year. 33:44.700 --> 33:56.820 Last year, I came and was blown away by the technical talent that DEFCON has in this community of creative, inquisitive investigators of all things software-driven. 33:56.900 --> 34:04.840 We brought a live hacking opportunity with one of our F-15 fighters, and yes, this community was able to get in. 34:04.840 --> 34:20.920 We were left with a lot of great understanding about how to be better in the cyber domain, and we're back this year with an amazing opportunity that's going to teach the community and us how to take good cyber practices into space. 34:21.040 --> 34:30.120 Orbiting overhead right now is a satellite that hackers are going to have access to to see if they can apply their skills to get in. 34:30.120 --> 34:41.160 They're going to have to understand complicated physics, how satellites communicate with the ground, and how we communicate back in order to overcome this capture the flag challenge. 34:41.160 --> 34:46.300 But seeing the talent that's here, my money is on that they will succeed. 34:46.360 --> 34:53.400 Now, how cool is that, that winning teams are going to get to have their code run live in space? 34:53.400 --> 35:02.600 And what we'll learn is how to make this new area of defense and commercial innovation more cyber secure in the long run. 35:02.600 --> 35:14.040 You know, if you back up and you look at how the Air Force engaged, we really sat behind our high walls and fence lines, and we used secrecy as a way to keep our military systems safe. 35:14.040 --> 35:16.400 That doesn't make sense in today's world. 35:16.400 --> 35:28.140 With so much technology happening commercially, we've got to get outside of our bases and fence lines and be part of this community that continues to push innovation forward. 35:28.140 --> 35:37.300 So we are here to share, we are here to learn, and to make openness and transparency part of our equation for being secure. 35:37.320 --> 35:40.780 Thank you for being here as part of the Aerospace Village. 35:40.780 --> 35:43.780 Thank you for being here to participate in HackASAT. 35:43.780 --> 35:58.580 And next year, when we're back with the next round of the thing we bring to expose to the community, I hope you'll share your thoughts about what opportunity would inspire you to help us learn how to be a better cyber warrior. 35:58.580 --> 36:08.600 For the 60 billion dollars of airplanes and satellites and cyber technology that we produce each year, the cutting edge comes from software. 36:08.680 --> 36:20.040 Everything we learn about making that cutting edge more secure makes our men and women in uniform, this nation, and our allies and partners and all who work with us safer. 36:20.040 --> 36:24.980 So we are proud to be part of this community and can't wait to see what's ahead.