1
00:00:00,000 --> 00:00:09,080
Hello and welcome back to the seventh year of the Industrial Control System Village, the ICS Village at DEF CON.

2
00:00:09,080 --> 00:00:13,620
We're really excited this year because, one, we made it.

3
00:00:13,620 --> 00:00:27,180
This was a more difficult year for us than past years because all of those ranges, all of that industrial control system equipment that you've seen in the past, we had to figure out how to get it completely virtualized for you.

4
00:00:27,240 --> 00:00:33,780
So I want to say thank you to Grim, who has been hosting a lot of our equipment for us.

5
00:00:33,900 --> 00:00:43,800
New this year, besides everything being virtualized for access for our CTF, the last two years our CTF, the winner, has won a black badge.

6
00:00:43,800 --> 00:00:46,520
So crossing our fingers, we can pull that off for a third time.

7
00:00:46,520 --> 00:00:47,940
No guarantees.

8
00:00:49,760 --> 00:01:02,840
The Department of Homeland Security CISA agency is going to be... they have some special range equipment that they have integrated into a part of our CTF.

9
00:01:03,020 --> 00:01:07,380
So there's going to be a lot more fun and a lot more challenges this year.

10
00:01:07,380 --> 00:01:09,360
We have a great lineup of speakers.

11
00:01:09,360 --> 00:01:18,200
One of the biggest things that we took advantage of this year with the conference being completely virtual was reaching out to get a lot of international speakers.

12
00:01:18,200 --> 00:01:25,220
So the kinds of folks that work in industrial control systems elsewhere in the world, that would not typically be able to make the trip to Vegas.

13
00:01:25,220 --> 00:01:29,700
So a lot more variety in international representation with the speakers.

14
00:01:29,700 --> 00:01:31,980
So really looking forward to that.

15
00:01:32,420 --> 00:01:41,300
Logistics for it this year, obviously you know about everything that's going on Discord at DEF CON with the ICS Village specific channels around that.

16
00:01:41,420 --> 00:01:43,000
Q&A will be done there.

17
00:01:43,380 --> 00:01:47,340
Some speakers will be doing Q&A for the live sessions.

18
00:01:47,340 --> 00:01:50,560
So live speaker sessions, Q&A will be in Zoom.

19
00:01:50,560 --> 00:01:53,040
Otherwise you can meet with the speakers in Discord.

20
00:01:53,180 --> 00:02:00,940
And check out and subscribe to our new channels in YouTube and Twitch, where we'll be streaming everything live to you.

21
00:02:02,180 --> 00:02:04,120
Have a great DEF CON.

22
00:02:05,060 --> 00:02:18,920
Our keynote for this year is the director of CISA, Chris Krebs, reflecting the continued collaboration between the agency and the Village with bringing education and more equipment to the community.

23
00:02:18,920 --> 00:02:28,840
This DEF CON, we are kicking off the first of many opportunities to bring real ICS to even more hackers to get to work with.

24
00:02:28,840 --> 00:02:33,220
So without further ado, Chris Krebs with the ICS Village keynote for DEF CON.

25
00:02:35,660 --> 00:02:37,500
Hey, hello out there.

26
00:02:37,500 --> 00:02:41,660
Welcome to DEF CON ICS Village Safe Mode.

27
00:02:41,660 --> 00:02:43,060
My name is Chris Krebs.

28
00:02:43,060 --> 00:02:45,000
I am the director of the U.S.

29
00:02:45,000 --> 00:02:48,700
Cyber and Infrastructure Security Agency.

30
00:02:48,780 --> 00:03:09,900
Today I'm going to tell you a little bit about what we've been doing over the last couple years, our approach to control systems, but more broadly, not just our approach, the things we're doing working with you and the community to improve control system cybersecurity out there across this great country and throughout the world.

31
00:03:10,100 --> 00:03:36,680
So I think what I want to start with is tell you a little bit about who we are, CISA, again, the Cyber and Infrastructure Security Agency, youngest federal agency coming up on our second birthday here, and talk to you a little bit about the threat landscape as we see it and tie it to a few actors out there that have been improving their capabilities.

32
00:03:36,680 --> 00:03:53,680
And then stitch that all up into a story of the things that we've identified as important and how we work with you and the rest of the ICS security community to actually achieve these objectives that we're all working day in, day out towards.

33
00:03:54,260 --> 00:03:59,340
So that, yeah, CISA, almost two years old now.

34
00:03:59,600 --> 00:04:02,320
We are a part of the Department of Homeland Security.

35
00:04:02,320 --> 00:04:08,000
We've been around in one way, shape, or form since the creation of the department, but the U.S.

36
00:04:08,000 --> 00:04:24,540
Congress gave us the authority to stand up as a separate operational component, like the Transportation Security Administration, you normally would have had to deal with if we were in Vegas, like last year and ideally next year.

37
00:04:24,540 --> 00:04:32,700
And FEMA, if you're paying attention to COVID or hurricane season, they're out in front.

38
00:04:32,700 --> 00:04:34,160
So that's where we come in.

39
00:04:34,160 --> 00:04:34,800
We're CISA.

40
00:04:34,800 --> 00:04:39,260
We are the nation's risk advisor as we style ourselves.

41
00:04:39,260 --> 00:04:53,520
But the concept here is to get an understanding of what the risk landscape looks like and how it intersects with the nation's critical infrastructure across a number of different lines of effort, but I tend to distill them down to five.

42
00:04:53,520 --> 00:04:56,540
First is traditional InfoSec.

43
00:04:56,540 --> 00:04:58,400
We are the home of U.S.

44
00:04:58,400 --> 00:05:07,460
CERT, and we have been working some aspect of InfoSec for two plus decades now.

45
00:05:07,540 --> 00:05:11,620
The second aspect or discipline is control system security.

46
00:05:11,620 --> 00:05:22,540
We are also home to ICS CERT and have been in this game for quite some time with varying levels of investment and capability, but we are fully committed to this mission.

47
00:05:22,680 --> 00:05:24,920
The third is supply chain security.

48
00:05:24,920 --> 00:05:38,580
Lots of activity on the supply chain front over the last couple years, particularly since I've been here, and really looking forward to building more capability and sight and maturity across the supply chain risk management discipline.

49
00:05:38,680 --> 00:05:54,500
And the last two pieces, insider threat, and this is more about that blending of close access operations, allowing an adversary into your network or into your perimeter that they can then combine with other techniques to achieve their objectives.

50
00:05:54,500 --> 00:05:56,340
And then lastly, physical security.

51
00:05:56,340 --> 00:06:15,180
So in this broader cybersecurity and infrastructure security space, we're also out there day in, day out conducting physical security assessments of facilities to help protect things like schools and hospitals right now, and places of worship.

52
00:06:15,340 --> 00:06:30,480
Back when sports start up again at larger scale and you can actually go attend the sporting event, assuming you like sports ball, we are out there helping the facility owners and operators understand how to best secure their facilities.

53
00:06:30,480 --> 00:06:34,840
So that's kind of the disciplines that we focus on.

54
00:06:35,080 --> 00:06:45,860
And we have a very different approach, I think, to engaging our stakeholders, our customers, as it were, than you might find in other parts of the federal government.

55
00:06:46,000 --> 00:06:57,900
They're usually persuasive hooks that agencies have, whether it's law enforcement authorities, or it's regulatory authorities, or they have money, things like that.

56
00:06:57,980 --> 00:07:11,040
We're in a public-private partnership business, and that's a kind of cliche thing to say, I think, certainly over the last 15 plus years.

57
00:07:11,040 --> 00:07:14,980
But we spend a lot of time listening.

58
00:07:15,040 --> 00:07:21,000
So it's not that old, tired, you know, we're from the government and we're here to help.

59
00:07:21,380 --> 00:07:24,840
It's more along the lines of, we're from the government, we're here to listen.

60
00:07:24,840 --> 00:07:30,200
We want to understand what your problems are, your challenges are, what your gaps are.

61
00:07:30,200 --> 00:07:40,500
We have certain advantages where, at the end of the day, profit and revenue is not our prime objective.

62
00:07:40,500 --> 00:07:49,940
We have the ability to overcome places where there's no legitimate business model for the private sector to chip in and contribute.

63
00:07:49,940 --> 00:07:51,960
So that's kind of a sweet spot for us.

64
00:07:51,960 --> 00:07:54,440
And of course, there are other aspects here.

65
00:07:54,440 --> 00:07:57,480
We have access to classified information.

66
00:07:57,480 --> 00:08:10,540
And when we know what the bad guys are trying to do, or, oh, I don't know, actually doing, we're able to distill that down and bring partners into the fight to counter those efforts.

67
00:08:10,780 --> 00:08:19,700
And so again, we're this public-private partnership, voluntary effort agency.

68
00:08:19,780 --> 00:08:21,780
I'm not going to lie, it's tough.

69
00:08:22,300 --> 00:08:38,720
When you really have to work that extra bit to understand what a partner's challenges are, and then go back and craft something that is going to help them, that takes a lot more work than I think some of the other authorities that other agencies have.

70
00:08:38,840 --> 00:08:45,040
But in a sense, it's also pretty darn easy if you listen the right way.

71
00:08:45,040 --> 00:09:05,460
If you listen to really what the challenges and the gaps are in the critical infrastructure community, whether it's on the Infosec side or the OT control system side, if you listen really hard, and you isolate the issue, and you address the issue and deliver some value,

72
00:09:05,460 --> 00:09:10,840
it's a self-fulfilling prophecy in terms of your ultimate success.

73
00:09:10,840 --> 00:09:14,760
So we, in a certain sense, are like the private sector, right?

74
00:09:14,760 --> 00:09:30,140
We're like an organization that has to develop the capability, turn it, do the market research, pull together a product lifecycle, have a team to deliver it to customers, and then have feedback and dial it in.

75
00:09:30,140 --> 00:09:33,300
So we very much have that private sector mentality.

76
00:09:33,300 --> 00:09:40,720
In that philosophy, that approach is in part why I'm here today, wherever here is.

77
00:09:40,720 --> 00:09:42,720
But that's why I'm here today.

78
00:09:42,720 --> 00:09:54,000
It's part of market research, it's part of engaging a community and understanding what the challenges are and how we can all work together to close out those gaps.

79
00:09:54,180 --> 00:10:13,440
And I honestly think, which means I'm not lying to you right now, I guess, that right now, the threat landscape, the bad guys out there doing bad things, is as active as I've ever seen it.

80
00:10:14,000 --> 00:10:19,440
And that's not to say that the bad guys out there haven't been doing bad things for a long time.

81
00:10:19,620 --> 00:10:31,420
2012, 2013, dating all the way back, we've seen, particularly in the control system space and the hard infrastructure space, really dramatic adversary activity.

82
00:10:31,420 --> 00:10:35,960
So go back and look at the 2019 Worldwide Threat Assessment.

83
00:10:35,960 --> 00:10:44,060
There's a very specific piece in there that talks about Chinese capabilities to disrupt pipelines, cause localized outages.

84
00:10:44,160 --> 00:10:46,460
That goes back several years.

85
00:10:46,720 --> 00:10:56,000
A couple years ago, the Russians, what we called at the time alien viper, but they absolutely targeted energy infrastructure.

86
00:10:56,040 --> 00:11:05,420
They went through the supply chain, they went through contractors, construction organizations in this case, they knew where they were wanting to go.

87
00:11:06,080 --> 00:11:11,860
And they used a range of capabilities, a range of accesses to get there.

88
00:11:12,200 --> 00:11:29,380
Even more recently, we, alongside the National Security Agency, issued an alert that was pretty clear and pretty stark in the terms of, if you have OT systems that touch the internet, you need to get them offline.

89
00:11:29,380 --> 00:11:30,460
You need to harden them.

90
00:11:30,460 --> 00:11:31,560
You need to protect them.

91
00:11:31,560 --> 00:11:45,040
You need to install or implement better email security measures because what we found is flat, unsegmented networks provides the adversary the ability to pivot off the business network into the OT networks.

92
00:11:45,040 --> 00:11:51,880
Again, these are very, very active targets for the bad guys.

93
00:11:52,120 --> 00:12:05,600
It's only a matter of time, as I think Dale Peterson said back in January down at S4, in an interview I did with him, that ransomware will come to the control system space.

94
00:12:05,600 --> 00:12:06,980
It's a matter of time.

95
00:12:07,120 --> 00:12:09,620
Let's get there before them.

96
00:12:09,900 --> 00:12:16,540
So our mindset has been going back to that general philosophy of the agency.

97
00:12:16,540 --> 00:12:20,840
How do we understand, how do we build a community of practice here?

98
00:12:20,840 --> 00:12:23,100
We're not the ones building it, to be clear.

99
00:12:23,100 --> 00:12:27,120
We want to be able to foster that community of practice.

100
00:12:27,800 --> 00:12:37,540
And so a year and a half or so ago now, when we came out of a pretty historic, not pretty, but a historic shutdown of the U.S.

101
00:12:37,540 --> 00:12:42,280
federal government, I laid out a series of priorities for this agency.

102
00:12:43,060 --> 00:12:54,300
First, half my budget goes, if you haven't checked and you don't, who looks at the federal government budgets, but half of my budget goes to federal cybersecurity.

103
00:12:55,380 --> 00:12:58,900
That's a big chunk of money, and so that's a top priority for me.

104
00:12:58,900 --> 00:13:00,620
What else is a top priority for me?

105
00:13:00,620 --> 00:13:01,900
Election security.

106
00:13:02,040 --> 00:13:08,020
Looking forward to participating, parts of my team participating in the voting village, DEFCON voting village as well.

107
00:13:08,580 --> 00:13:15,100
We're also doing physical security, as I mentioned, for crowded places and soft targets.

108
00:13:15,300 --> 00:13:32,040
But I think when we were sitting there as a team trying to identify the greatest areas for opportunity, the greatest areas for community progress, two things immediately jumped to mind, and they're related.

109
00:13:32,040 --> 00:13:33,320
Supply chain.

110
00:13:33,400 --> 00:13:44,120
Supply chain risk management is an untapped area that we are putting a significant amount of effort behind.

111
00:13:44,120 --> 00:13:47,640
But the last piece of care, of course, why I'm here today, industrial control systems.

112
00:13:47,640 --> 00:13:50,240
As I mentioned, we are the home of ICS CERT.

113
00:13:50,240 --> 00:14:03,720
It's a game that we've been playing for quite some time, and we are reinvigorating our partnerships, we're reinvigorating our investments, bringing and building a fantastic team.

114
00:14:03,760 --> 00:14:10,900
And our overall objectives is to be able to stitch together the U.S.

115
00:14:10,900 --> 00:14:16,860
government in support of industry and the control system security community.

116
00:14:17,520 --> 00:14:18,540
Together.

117
00:14:18,540 --> 00:14:19,400
That's it.

118
00:14:19,400 --> 00:14:19,860
Together.

119
00:14:19,860 --> 00:14:22,180
We're just working on doing this together.

120
00:14:22,280 --> 00:14:28,240
And so coming out of that shutdown, I challenged the team, said, tell me how we're going to do this.

121
00:14:28,540 --> 00:14:31,440
And of course, federal government agencies is what we do.

122
00:14:31,440 --> 00:14:33,280
We build strategies, right?

123
00:14:33,280 --> 00:14:38,760
So in July, we released our industrial control systems initiative, which is our strategy.

124
00:14:38,760 --> 00:14:42,780
It says, here are the things that we are aiming to accomplish.

125
00:14:42,960 --> 00:14:45,620
Here's the main thrust of activity.

126
00:14:46,360 --> 00:14:52,480
Now, you didn't come here today to hear me talk about a strategy about another federal government plan.

127
00:14:52,560 --> 00:14:59,240
Another, it's actually pretty tight in terms of page count, but that's not why we're here.

128
00:14:59,900 --> 00:15:06,020
But I do need to lay out what our objectives are and how we're going to do that.

129
00:15:06,160 --> 00:15:12,960
And then I'm going to tell you about the mechanisms we're using and some of the key implementation priorities.

130
00:15:12,960 --> 00:15:15,580
And that'll give you a sense of where we're going.

131
00:15:15,580 --> 00:15:19,260
Most importantly, how you can participate.

132
00:15:19,260 --> 00:15:23,000
Because together, to me, means one thing.

133
00:15:23,000 --> 00:15:30,300
And I mentioned it earlier this year at the industrial control systems joint working group that we had to do online, just like this.

134
00:15:30,320 --> 00:15:38,780
Our top line objective is to democratize industrial control systems security efforts.

135
00:15:38,780 --> 00:15:45,300
And what that means is making it open for everyone, bringing the community together.

136
00:15:45,300 --> 00:15:52,600
It's not about releasing products and tools and services that only a handful can afford.

137
00:15:52,600 --> 00:15:54,940
It's not about restricting access.

138
00:15:54,940 --> 00:15:56,480
It's about diversity.

139
00:15:56,480 --> 00:15:58,400
It's about inclusion.

140
00:15:58,400 --> 00:16:01,960
It's about democratizing security.

141
00:16:02,260 --> 00:16:04,520
That's what's behind our strategy.

142
00:16:04,520 --> 00:16:18,680
So real quick, the philosophy behind the strategy is about empowering you, empowering vendors and owners, operators, and integrators to make better risk management decisions.

143
00:16:18,680 --> 00:16:21,680
It's about informing your investments.

144
00:16:21,680 --> 00:16:24,300
It's about integrating the U.S.

145
00:16:24,300 --> 00:16:29,680
government and our partners in the intelligence community, Department of Defense and FBI.

146
00:16:29,680 --> 00:16:32,520
It's about integrating our efforts into yours.

147
00:16:32,660 --> 00:16:37,380
It's about moving to a proactive industrial control systems posture.

148
00:16:37,400 --> 00:16:46,880
And lastly, it's about driving towards a sustainable, long-lasting control systems security community.

149
00:16:47,000 --> 00:16:48,780
That's the top line.

150
00:16:48,780 --> 00:16:49,720
All right.

151
00:16:49,720 --> 00:16:50,880
How are we doing this?

152
00:16:50,880 --> 00:16:51,560
Pillars.

153
00:16:51,560 --> 00:16:52,420
We got four pillars.

154
00:16:52,420 --> 00:16:53,980
Every strategy's got to have pillars.

155
00:16:53,980 --> 00:16:55,380
We have four pillars.

156
00:16:55,520 --> 00:17:04,340
First pillar is asking more of the community, but doing more for the community from the federal government perspective as well.

157
00:17:04,520 --> 00:17:11,860
The second is advancing technology and the ability to secure our systems.

158
00:17:11,860 --> 00:17:26,860
Not just tomorrow's systems, but we have to figure out how to continue to defend today's deployments while thinking through the next generation and having more security baked in.

159
00:17:26,860 --> 00:17:29,340
Secure by design, secure by deployment.

160
00:17:29,340 --> 00:17:52,680
The third piece is developing deep data capabilities to better put our understanding of risks against the current deployments and building frameworks, building resources and approaches that take advantage of just this wealth of information we all have.

161
00:17:52,680 --> 00:17:56,820
Pull it all together and putting into meaningful frameworks.

162
00:17:57,360 --> 00:18:02,700
MITRE continues to lead in this space with the industrial control systems framework.

163
00:18:02,700 --> 00:18:09,520
Those are the types of activities and approaches that we look to be a part of.

164
00:18:09,520 --> 00:18:16,000
Not necessarily invent, not own, we just want to be a part of this effort.

165
00:18:16,000 --> 00:18:41,440
And lastly, increasing that risk understanding of the interdependencies that are out there so that we can drive smarter investments, smarter solutions, smarter engagements between the government and industry to get to that objective of democratizing control system security and making the environment safer and more secure.

166
00:18:42,940 --> 00:18:46,440
So it's those four pillars that drive our approaches.

167
00:18:46,440 --> 00:18:47,760
So what the heck are our approaches?

168
00:18:47,760 --> 00:18:50,540
Okay, this is the part that matters.

169
00:18:50,620 --> 00:18:54,740
The strategy is about what we're trying to do.

170
00:18:55,460 --> 00:19:00,860
Our approaches are how you can work with us to achieve these objectives.

171
00:19:01,060 --> 00:19:04,240
So got a few things that are worth talking about here.

172
00:19:04,240 --> 00:19:09,300
I already talked about one of them and that's the industrial control system joint working group.

173
00:19:09,560 --> 00:19:32,820
This is what is now a twice a year, that's biannual, twice a year now a virtual event, but it provides a free opportunity for anyone that's either getting into the control systems game or is in a jurisdiction that doesn't have travel funds, because those are always a challenge with,

174
00:19:32,820 --> 00:19:36,700
you know, the old days conferences.

175
00:19:36,840 --> 00:19:38,480
How do you get the money to go to Vegas?

176
00:19:38,480 --> 00:19:40,220
How do you get the money to go to Miami?

177
00:19:41,240 --> 00:19:55,780
The ICS JWG is about opening up a more inclusive environment so everyone can come together and learn something, even if it's at the 101 level or the 10 whatever remedial is, 100 level, it doesn't matter.

178
00:19:55,940 --> 00:20:05,100
The point is we have the opportunity to bring more people into this community and that's what we're working towards with the ICS JWG.

179
00:20:05,100 --> 00:20:09,980
We had our most recent one in, I don't know, it was a month or so ago.

180
00:20:10,040 --> 00:20:12,220
We've got another one coming up in the fall.

181
00:20:13,480 --> 00:20:16,480
So that's point one, ICS JWG.

182
00:20:16,480 --> 00:20:21,340
So back to that kind of integrating the federal government with the community.

183
00:20:21,340 --> 00:20:27,160
We also have an effort called the Control Systems Interagency Working Group, the CISIWG.

184
00:20:27,160 --> 00:20:32,060
Now, it says interagency, but don't take from that that it's just government.

185
00:20:32,060 --> 00:20:52,360
Again, this is about bringing the executive leadership of the federal agencies that play in control systems together with leaders from industry, from the research community, from the vendor space, bringing everybody together and figuring out, okay, what are our opportunities,

186
00:20:53,040 --> 00:20:54,300
our threats?

187
00:20:54,300 --> 00:20:58,000
It's really, in part, we're doing a SWOT analysis.

188
00:20:58,020 --> 00:20:59,600
How are we strong together?

189
00:20:59,600 --> 00:21:00,800
Where are we weak together?

190
00:21:00,800 --> 00:21:02,900
What are our opportunities to work together?

191
00:21:02,900 --> 00:21:04,540
And then what are the threats?

192
00:21:05,480 --> 00:21:15,380
So coming out of the last year or so work of the control systems interagency working group, well, we figured a few things out.

193
00:21:15,380 --> 00:21:21,080
One is the government needs to be more coordinated together.

194
00:21:21,380 --> 00:21:24,560
Everybody does some part of this game.

195
00:21:24,560 --> 00:21:27,260
How do we do it in a more coordinated fashion?

196
00:21:27,280 --> 00:21:33,000
Well, one place we can really achieve, I think, some alignment and advancements is in standards.

197
00:21:33,020 --> 00:21:44,440
So if we get all the federal government players together on standards and working towards the same common purpose, we can really drive the advancements we're looking for.

198
00:21:44,480 --> 00:21:49,880
Also, we can help work to build the workforce of the future.

199
00:21:50,080 --> 00:22:05,940
Rather than doing bits and pieces here and there, let's have a collective approach to workforce and a lot of credit to NIST and their efforts in job coding, creating clarity in messaging, and hiring practices.

200
00:22:05,940 --> 00:22:07,600
So we have an opportunity there.

201
00:22:07,740 --> 00:22:12,540
And also on the investment alignment.

202
00:22:12,540 --> 00:22:16,300
So R&D, lots of different R&D efforts across the federal government.

203
00:22:16,300 --> 00:22:30,580
We should have a more unified R&D agenda that can get better uses out of our investments, maybe eliminate some duplication or redundancy in efforts.

204
00:22:30,580 --> 00:22:31,980
Always a good thing.

205
00:22:31,980 --> 00:22:35,660
Maybe put those saved dollars towards another effort.

206
00:22:35,660 --> 00:22:49,200
And then lastly, working towards a more unified, streamlined, coherent, and value-added incident response approach within the USG.

207
00:22:49,200 --> 00:23:06,180
And in part, what we want to do with this is make sure that we're taking the relevant information out of an incident response effort and sharing that information back out in a protected way for the victim.

208
00:23:06,180 --> 00:23:08,800
We're not in the business of re-victimizing a victim.

209
00:23:08,800 --> 00:23:17,060
But to the extent that we can extract insights from single or multiple incident responses, that's a good thing.

210
00:23:17,060 --> 00:23:20,880
And that's something that we've done recently.

211
00:23:21,040 --> 00:23:29,580
In fact, in the oil and natural gas sector, we issued an alert earlier this year.

212
00:23:29,580 --> 00:23:30,980
Now, we're not perfect yet.

213
00:23:30,980 --> 00:23:32,420
We're still working at this.

214
00:23:32,520 --> 00:23:37,200
But your feedback on all of our control systems products is always welcome.

215
00:23:37,200 --> 00:23:40,360
So go to cissa.gov, c-i-s-a.gov.

216
00:23:40,460 --> 00:23:48,080
Check out our control systems page and all of the products we have there, the alerts, the guidance, the advisories.

217
00:23:48,160 --> 00:23:49,980
Let us know where we're hitting the mark.

218
00:23:49,980 --> 00:23:51,820
Let us know what else we need to do.

219
00:23:52,540 --> 00:23:56,620
And then work with us through the Industrial Control Systems Joint Working Group.

220
00:23:56,620 --> 00:24:05,000
There are a few other things that are worth highlighting, particularly since we're doing this DEFCON safe mode thing, something you'll hear about.

221
00:24:05,000 --> 00:24:17,640
And that got kicked off last year, rather earlier this year, down in Miami, ICS for ICS, Industrial Control Systems for Incident Command System.

222
00:24:17,640 --> 00:24:26,700
Not sure if everybody knows what the Incident Command System is, but it's what the physical emergency responders use to coordinate their efforts, whether it's a hurricane, a wildfire.

223
00:24:26,700 --> 00:24:33,400
It's actually the firefighters out in California, the fire service, they're the ones that develop the Incident Command System.

224
00:24:33,400 --> 00:24:37,200
But it's got a great application for physical disasters.

225
00:24:37,680 --> 00:24:49,260
But I bet if we ever have one of those big time, larger scale, physical or cyber-enabled physical event, guess who's going to show up?

226
00:24:49,260 --> 00:24:54,020
The fire department, the emergency managers, state and local officials.

227
00:24:54,020 --> 00:25:00,900
There's absolutely a role in control system security and incident response for state and locals.

228
00:25:01,000 --> 00:25:07,980
But they also recognize, we recognize, that there are roles for the security community.

229
00:25:07,980 --> 00:25:15,320
So what we've got to be able to do is develop those frameworks, develop the frameworks that put everybody together, clarity of roles and responsibilities.

230
00:25:15,320 --> 00:25:23,260
So a lot of credit to Megan Sanford for her work there, and ICS for ICS, and looking forward to continuing to contribute to that effort.

231
00:25:23,260 --> 00:25:27,800
And of course, the best for last here, ICS Village.

232
00:25:27,920 --> 00:25:32,780
This year, we were proud to partner with the ICS Village.

233
00:25:32,780 --> 00:25:36,440
A lot of credit and thanks goes to Bryson Borg for his efforts.

234
00:25:36,660 --> 00:25:40,380
But the idea is we can do more together.

235
00:25:40,380 --> 00:25:41,540
That's why we're here.

236
00:25:41,540 --> 00:25:45,980
That's why you're seeing the feds show up at DEF CON, even if it's virtually.

237
00:25:45,980 --> 00:25:56,380
We were there last year, but we look forward to really growing out this and building out this partnership with the ICS Village and other villages.

238
00:25:57,040 --> 00:25:58,980
We're doing that in a couple ways.

239
00:25:58,980 --> 00:26:15,980
This year, we've got our Control Environment Laboratory Resource, or CELER, that is going to give simulated environments so that everybody can walk through a couple different scenarios, work on your blue team skills, and run some incident response.

240
00:26:16,060 --> 00:26:27,160
This is an effort that we think, again, plays to that democratizing industrial control systems.

241
00:26:27,160 --> 00:26:28,700
It's been a long day.

242
00:26:28,700 --> 00:26:30,420
Industrial control systems security.

243
00:26:30,420 --> 00:26:32,700
Again, democratizing, making it more open.

244
00:26:32,700 --> 00:26:44,600
If we can pull more resources out of the National Capital Region, out of specific locations out west, and then make them broadly available virtually, good for everyone.

245
00:26:44,600 --> 00:26:51,600
If we can put things on wheels and drive them around to various parts of the country, again, these are good things.

246
00:26:51,600 --> 00:26:53,340
That's what we're trying to accomplish here.

247
00:26:53,340 --> 00:26:59,640
A control systems ecosystem, security ecosystem, that is open and accessible to everyone.

248
00:26:59,640 --> 00:27:05,620
Whether you're in the private sector or you're a municipal water facility, everyone's got requirements.

249
00:27:05,620 --> 00:27:07,860
We have to be able to do this together.

250
00:27:08,360 --> 00:27:14,360
So the last thing I'll talk about before wrapping this one up is our role in vulnerability management.

251
00:27:14,900 --> 00:27:22,140
This has been hell year, I think, for the vulnerability managers out there.

252
00:27:22,160 --> 00:27:27,200
Six months of week after week of big vuln after big vuln.

253
00:27:27,200 --> 00:27:39,440
I was thinking at some point it's almost a race to the bottom, because think about it, you drop one vulnerability and somebody's probably going to drop one next week, and so you've got tops of seven days in the new cycle.

254
00:27:40,120 --> 00:27:47,540
But it's really stressing the teams that historically we haven't invested too much in.

255
00:27:48,200 --> 00:27:54,840
The vulnerability management side is one of the most important teams within any organization.

256
00:27:55,600 --> 00:27:59,860
We play a key role here in coordinating vulnerability disclosure.

257
00:27:59,860 --> 00:28:07,240
We fund and support the CERT Coordination Center, CERT-CC, up at Carnegie Mellon.

258
00:28:07,240 --> 00:28:13,200
We also fund the National Vulnerability Database at NIST.

259
00:28:13,200 --> 00:28:28,520
So between the CERT-CC CVE process and the National Vulnerability Database, two key resources for any network defendant or any vulnerability manager of understanding what's new, what's coming, and how do you defend against it.

260
00:28:28,520 --> 00:28:45,320
We also play a role again through that CERT-CC process where the private sector or a security researcher rather, if they identify something, we can help facilitate the conversation between the appropriate vendor.

261
00:28:45,320 --> 00:28:47,980
Now sometimes we don't need to play a role.

262
00:28:48,280 --> 00:28:58,600
In fact, we encourage programs, we encourage vendors to have vulnerability disclosure programs, to have as needed bug bounty programs.

263
00:28:58,600 --> 00:29:09,200
Again, have a healthy, vibrant ability to engage with the security researcher where you don't need the government, even if it's just fostering or facilitating a protected conversation.

264
00:29:09,200 --> 00:29:12,980
But that's not always how things are right now.

265
00:29:12,980 --> 00:29:20,880
That's not where some organizations are in their maturity of their own vulnerability disclosure practices.

266
00:29:20,880 --> 00:29:22,460
So we play a vital role.

267
00:29:22,460 --> 00:29:34,080
Last year, calendar year 19, we processed and managed through our CBE process, 11,500 plus vulnerabilities.

268
00:29:34,360 --> 00:29:39,660
I think based on this year, we're probably going to exceed that.

269
00:29:39,660 --> 00:29:41,900
But that's a role we are happy to play.

270
00:29:41,900 --> 00:29:49,020
Again, we are going to continue to issue advice and guidance to organizations of all sizes and stripes.

271
00:29:50,100 --> 00:29:55,440
Guidance on how they can set up their own vulnerability disclosure programs.

272
00:29:55,440 --> 00:30:07,000
Just last week, we issued some guidance to our partners in the state and local election community about how they can set up vulnerability disclosure programs for their systems.

273
00:30:07,000 --> 00:30:11,320
And so it's not just about the code, the software they're coding or whatever.

274
00:30:11,320 --> 00:30:12,840
It's their implementations.

275
00:30:12,840 --> 00:30:22,260
If you find a vulnerability in a voter registration database, please, you know, first off, if you own that database, you need a process.

276
00:30:22,260 --> 00:30:31,580
But if you find that vulnerability, you need a way to report it in a coordinated manner so it can get closed out so that it's closed out before the bad guys get there.

277
00:30:32,200 --> 00:30:39,920
So vulnerability management is exactly where we are going to continue investing more broadly in the InfoSec space.

278
00:30:40,300 --> 00:30:46,940
And in fact, little known fact, this was supposed to be the year of vulnerability management.

279
00:30:46,940 --> 00:30:48,560
That was a theme we had.

280
00:30:48,620 --> 00:30:54,600
Little did we know that it was again, it was going to be vulnerability management hell year.

281
00:30:54,600 --> 00:30:55,360
But here we are.

282
00:30:55,360 --> 00:30:55,880
We're here.

283
00:30:55,880 --> 00:30:57,060
We're part of the team.

284
00:30:57,060 --> 00:30:58,580
Let us know what help you need.

285
00:30:58,580 --> 00:31:01,000
So I'm going to wrap this one up right now.

286
00:31:01,040 --> 00:31:06,580
Again, CISA is here as an advisor, as a partner, as a friend.

287
00:31:06,580 --> 00:31:14,860
Our objective, again, top line, democratizing industrial control system security at all levels.

288
00:31:14,860 --> 00:31:16,540
I don't care where you are.

289
00:31:16,540 --> 00:31:18,120
We want to work with you.

290
00:31:18,120 --> 00:31:27,420
We are here to provide support, resources, technical assistance, and the information you need to be able to protect your systems.

291
00:31:27,420 --> 00:31:32,960
But ultimately, it's not just about defending today's deployments.

292
00:31:32,960 --> 00:31:39,120
We've got to make sure that tomorrow's deployments are secure by design, secure by deployment.

293
00:31:39,640 --> 00:31:49,500
So with that, I'm going to wrap up these remarks, and I'm going to jump in a time machine, and I'm going to have a costume change and all that, and I think we're going to do some live Q&A.

294
00:31:49,880 --> 00:31:50,680
Thanks.