WEBVTT 00:00.000 --> 00:09.080 Hello and welcome back to the seventh year of the Industrial Control System Village, the ICS Village at DEF CON. 00:09.080 --> 00:13.620 We're really excited this year because, one, we made it. 00:13.620 --> 00:27.180 This was a more difficult year for us than past years because all of those ranges, all of that industrial control system equipment that you've seen in the past, we had to figure out how to get it completely virtualized for you. 00:27.240 --> 00:33.780 So I want to say thank you to Grim, who has been hosting a lot of our equipment for us. 00:33.900 --> 00:43.800 New this year, besides everything being virtualized for access for our CTF, the last two years our CTF, the winner, has won a black badge. 00:43.800 --> 00:46.520 So crossing our fingers, we can pull that off for a third time. 00:46.520 --> 00:47.940 No guarantees. 00:49.760 --> 01:02.840 The Department of Homeland Security CISA agency is going to be... they have some special range equipment that they have integrated into a part of our CTF. 01:03.020 --> 01:07.380 So there's going to be a lot more fun and a lot more challenges this year. 01:07.380 --> 01:09.360 We have a great lineup of speakers. 01:09.360 --> 01:18.200 One of the biggest things that we took advantage of this year with the conference being completely virtual was reaching out to get a lot of international speakers. 01:18.200 --> 01:25.220 So the kinds of folks that work in industrial control systems elsewhere in the world, that would not typically be able to make the trip to Vegas. 01:25.220 --> 01:29.700 So a lot more variety in international representation with the speakers. 01:29.700 --> 01:31.980 So really looking forward to that. 01:32.420 --> 01:41.300 Logistics for it this year, obviously you know about everything that's going on Discord at DEF CON with the ICS Village specific channels around that. 01:41.420 --> 01:43.000 Q&A will be done there. 01:43.380 --> 01:47.340 Some speakers will be doing Q&A for the live sessions. 01:47.340 --> 01:50.560 So live speaker sessions, Q&A will be in Zoom. 01:50.560 --> 01:53.040 Otherwise you can meet with the speakers in Discord. 01:53.180 --> 02:00.940 And check out and subscribe to our new channels in YouTube and Twitch, where we'll be streaming everything live to you. 02:02.180 --> 02:04.120 Have a great DEF CON. 02:05.060 --> 02:18.920 Our keynote for this year is the director of CISA, Chris Krebs, reflecting the continued collaboration between the agency and the Village with bringing education and more equipment to the community. 02:18.920 --> 02:28.840 This DEF CON, we are kicking off the first of many opportunities to bring real ICS to even more hackers to get to work with. 02:28.840 --> 02:33.220 So without further ado, Chris Krebs with the ICS Village keynote for DEF CON. 02:35.660 --> 02:37.500 Hey, hello out there. 02:37.500 --> 02:41.660 Welcome to DEF CON ICS Village Safe Mode. 02:41.660 --> 02:43.060 My name is Chris Krebs. 02:43.060 --> 02:45.000 I am the director of the U.S. 02:45.000 --> 02:48.700 Cyber and Infrastructure Security Agency. 02:48.780 --> 03:09.900 Today I'm going to tell you a little bit about what we've been doing over the last couple years, our approach to control systems, but more broadly, not just our approach, the things we're doing working with you and the community to improve control system cybersecurity out there across this great country and throughout the world. 03:10.100 --> 03:36.680 So I think what I want to start with is tell you a little bit about who we are, CISA, again, the Cyber and Infrastructure Security Agency, youngest federal agency coming up on our second birthday here, and talk to you a little bit about the threat landscape as we see it and tie it to a few actors out there that have been improving their capabilities. 03:36.680 --> 03:53.680 And then stitch that all up into a story of the things that we've identified as important and how we work with you and the rest of the ICS security community to actually achieve these objectives that we're all working day in, day out towards. 03:54.260 --> 03:59.340 So that, yeah, CISA, almost two years old now. 03:59.600 --> 04:02.320 We are a part of the Department of Homeland Security. 04:02.320 --> 04:08.000 We've been around in one way, shape, or form since the creation of the department, but the U.S. 04:08.000 --> 04:24.540 Congress gave us the authority to stand up as a separate operational component, like the Transportation Security Administration, you normally would have had to deal with if we were in Vegas, like last year and ideally next year. 04:24.540 --> 04:32.700 And FEMA, if you're paying attention to COVID or hurricane season, they're out in front. 04:32.700 --> 04:34.160 So that's where we come in. 04:34.160 --> 04:34.800 We're CISA. 04:34.800 --> 04:39.260 We are the nation's risk advisor as we style ourselves. 04:39.260 --> 04:53.520 But the concept here is to get an understanding of what the risk landscape looks like and how it intersects with the nation's critical infrastructure across a number of different lines of effort, but I tend to distill them down to five. 04:53.520 --> 04:56.540 First is traditional InfoSec. 04:56.540 --> 04:58.400 We are the home of U.S. 04:58.400 --> 05:07.460 CERT, and we have been working some aspect of InfoSec for two plus decades now. 05:07.540 --> 05:11.620 The second aspect or discipline is control system security. 05:11.620 --> 05:22.540 We are also home to ICS CERT and have been in this game for quite some time with varying levels of investment and capability, but we are fully committed to this mission. 05:22.680 --> 05:24.920 The third is supply chain security. 05:24.920 --> 05:38.580 Lots of activity on the supply chain front over the last couple years, particularly since I've been here, and really looking forward to building more capability and sight and maturity across the supply chain risk management discipline. 05:38.680 --> 05:54.500 And the last two pieces, insider threat, and this is more about that blending of close access operations, allowing an adversary into your network or into your perimeter that they can then combine with other techniques to achieve their objectives. 05:54.500 --> 05:56.340 And then lastly, physical security. 05:56.340 --> 06:15.180 So in this broader cybersecurity and infrastructure security space, we're also out there day in, day out conducting physical security assessments of facilities to help protect things like schools and hospitals right now, and places of worship. 06:15.340 --> 06:30.480 Back when sports start up again at larger scale and you can actually go attend the sporting event, assuming you like sports ball, we are out there helping the facility owners and operators understand how to best secure their facilities. 06:30.480 --> 06:34.840 So that's kind of the disciplines that we focus on. 06:35.080 --> 06:45.860 And we have a very different approach, I think, to engaging our stakeholders, our customers, as it were, than you might find in other parts of the federal government. 06:46.000 --> 06:57.900 They're usually persuasive hooks that agencies have, whether it's law enforcement authorities, or it's regulatory authorities, or they have money, things like that. 06:57.980 --> 07:11.040 We're in a public-private partnership business, and that's a kind of cliche thing to say, I think, certainly over the last 15 plus years. 07:11.040 --> 07:14.980 But we spend a lot of time listening. 07:15.040 --> 07:21.000 So it's not that old, tired, you know, we're from the government and we're here to help. 07:21.380 --> 07:24.840 It's more along the lines of, we're from the government, we're here to listen. 07:24.840 --> 07:30.200 We want to understand what your problems are, your challenges are, what your gaps are. 07:30.200 --> 07:40.500 We have certain advantages where, at the end of the day, profit and revenue is not our prime objective. 07:40.500 --> 07:49.940 We have the ability to overcome places where there's no legitimate business model for the private sector to chip in and contribute. 07:49.940 --> 07:51.960 So that's kind of a sweet spot for us. 07:51.960 --> 07:54.440 And of course, there are other aspects here. 07:54.440 --> 07:57.480 We have access to classified information. 07:57.480 --> 08:10.540 And when we know what the bad guys are trying to do, or, oh, I don't know, actually doing, we're able to distill that down and bring partners into the fight to counter those efforts. 08:10.780 --> 08:19.700 And so again, we're this public-private partnership, voluntary effort agency. 08:19.780 --> 08:21.780 I'm not going to lie, it's tough. 08:22.300 --> 08:38.720 When you really have to work that extra bit to understand what a partner's challenges are, and then go back and craft something that is going to help them, that takes a lot more work than I think some of the other authorities that other agencies have. 08:38.840 --> 08:45.040 But in a sense, it's also pretty darn easy if you listen the right way. 08:45.040 --> 09:05.460 If you listen to really what the challenges and the gaps are in the critical infrastructure community, whether it's on the Infosec side or the OT control system side, if you listen really hard, and you isolate the issue, and you address the issue and deliver some value, 09:05.460 --> 09:10.840 it's a self-fulfilling prophecy in terms of your ultimate success. 09:10.840 --> 09:14.760 So we, in a certain sense, are like the private sector, right? 09:14.760 --> 09:30.140 We're like an organization that has to develop the capability, turn it, do the market research, pull together a product lifecycle, have a team to deliver it to customers, and then have feedback and dial it in. 09:30.140 --> 09:33.300 So we very much have that private sector mentality. 09:33.300 --> 09:40.720 In that philosophy, that approach is in part why I'm here today, wherever here is. 09:40.720 --> 09:42.720 But that's why I'm here today. 09:42.720 --> 09:54.000 It's part of market research, it's part of engaging a community and understanding what the challenges are and how we can all work together to close out those gaps. 09:54.180 --> 10:13.440 And I honestly think, which means I'm not lying to you right now, I guess, that right now, the threat landscape, the bad guys out there doing bad things, is as active as I've ever seen it. 10:14.000 --> 10:19.440 And that's not to say that the bad guys out there haven't been doing bad things for a long time. 10:19.620 --> 10:31.420 2012, 2013, dating all the way back, we've seen, particularly in the control system space and the hard infrastructure space, really dramatic adversary activity. 10:31.420 --> 10:35.960 So go back and look at the 2019 Worldwide Threat Assessment. 10:35.960 --> 10:44.060 There's a very specific piece in there that talks about Chinese capabilities to disrupt pipelines, cause localized outages. 10:44.160 --> 10:46.460 That goes back several years. 10:46.720 --> 10:56.000 A couple years ago, the Russians, what we called at the time alien viper, but they absolutely targeted energy infrastructure. 10:56.040 --> 11:05.420 They went through the supply chain, they went through contractors, construction organizations in this case, they knew where they were wanting to go. 11:06.080 --> 11:11.860 And they used a range of capabilities, a range of accesses to get there. 11:12.200 --> 11:29.380 Even more recently, we, alongside the National Security Agency, issued an alert that was pretty clear and pretty stark in the terms of, if you have OT systems that touch the internet, you need to get them offline. 11:29.380 --> 11:30.460 You need to harden them. 11:30.460 --> 11:31.560 You need to protect them. 11:31.560 --> 11:45.040 You need to install or implement better email security measures because what we found is flat, unsegmented networks provides the adversary the ability to pivot off the business network into the OT networks. 11:45.040 --> 11:51.880 Again, these are very, very active targets for the bad guys. 11:52.120 --> 12:05.600 It's only a matter of time, as I think Dale Peterson said back in January down at S4, in an interview I did with him, that ransomware will come to the control system space. 12:05.600 --> 12:06.980 It's a matter of time. 12:07.120 --> 12:09.620 Let's get there before them. 12:09.900 --> 12:16.540 So our mindset has been going back to that general philosophy of the agency. 12:16.540 --> 12:20.840 How do we understand, how do we build a community of practice here? 12:20.840 --> 12:23.100 We're not the ones building it, to be clear. 12:23.100 --> 12:27.120 We want to be able to foster that community of practice. 12:27.800 --> 12:37.540 And so a year and a half or so ago now, when we came out of a pretty historic, not pretty, but a historic shutdown of the U.S. 12:37.540 --> 12:42.280 federal government, I laid out a series of priorities for this agency. 12:43.060 --> 12:54.300 First, half my budget goes, if you haven't checked and you don't, who looks at the federal government budgets, but half of my budget goes to federal cybersecurity. 12:55.380 --> 12:58.900 That's a big chunk of money, and so that's a top priority for me. 12:58.900 --> 13:00.620 What else is a top priority for me? 13:00.620 --> 13:01.900 Election security. 13:02.040 --> 13:08.020 Looking forward to participating, parts of my team participating in the voting village, DEFCON voting village as well. 13:08.580 --> 13:15.100 We're also doing physical security, as I mentioned, for crowded places and soft targets. 13:15.300 --> 13:32.040 But I think when we were sitting there as a team trying to identify the greatest areas for opportunity, the greatest areas for community progress, two things immediately jumped to mind, and they're related. 13:32.040 --> 13:33.320 Supply chain. 13:33.400 --> 13:44.120 Supply chain risk management is an untapped area that we are putting a significant amount of effort behind. 13:44.120 --> 13:47.640 But the last piece of care, of course, why I'm here today, industrial control systems. 13:47.640 --> 13:50.240 As I mentioned, we are the home of ICS CERT. 13:50.240 --> 14:03.720 It's a game that we've been playing for quite some time, and we are reinvigorating our partnerships, we're reinvigorating our investments, bringing and building a fantastic team. 14:03.760 --> 14:10.900 And our overall objectives is to be able to stitch together the U.S. 14:10.900 --> 14:16.860 government in support of industry and the control system security community. 14:17.520 --> 14:18.540 Together. 14:18.540 --> 14:19.400 That's it. 14:19.400 --> 14:19.860 Together. 14:19.860 --> 14:22.180 We're just working on doing this together. 14:22.280 --> 14:28.240 And so coming out of that shutdown, I challenged the team, said, tell me how we're going to do this. 14:28.540 --> 14:31.440 And of course, federal government agencies is what we do. 14:31.440 --> 14:33.280 We build strategies, right? 14:33.280 --> 14:38.760 So in July, we released our industrial control systems initiative, which is our strategy. 14:38.760 --> 14:42.780 It says, here are the things that we are aiming to accomplish. 14:42.960 --> 14:45.620 Here's the main thrust of activity. 14:46.360 --> 14:52.480 Now, you didn't come here today to hear me talk about a strategy about another federal government plan. 14:52.560 --> 14:59.240 Another, it's actually pretty tight in terms of page count, but that's not why we're here. 14:59.900 --> 15:06.020 But I do need to lay out what our objectives are and how we're going to do that. 15:06.160 --> 15:12.960 And then I'm going to tell you about the mechanisms we're using and some of the key implementation priorities. 15:12.960 --> 15:15.580 And that'll give you a sense of where we're going. 15:15.580 --> 15:19.260 Most importantly, how you can participate. 15:19.260 --> 15:23.000 Because together, to me, means one thing. 15:23.000 --> 15:30.300 And I mentioned it earlier this year at the industrial control systems joint working group that we had to do online, just like this. 15:30.320 --> 15:38.780 Our top line objective is to democratize industrial control systems security efforts. 15:38.780 --> 15:45.300 And what that means is making it open for everyone, bringing the community together. 15:45.300 --> 15:52.600 It's not about releasing products and tools and services that only a handful can afford. 15:52.600 --> 15:54.940 It's not about restricting access. 15:54.940 --> 15:56.480 It's about diversity. 15:56.480 --> 15:58.400 It's about inclusion. 15:58.400 --> 16:01.960 It's about democratizing security. 16:02.260 --> 16:04.520 That's what's behind our strategy. 16:04.520 --> 16:18.680 So real quick, the philosophy behind the strategy is about empowering you, empowering vendors and owners, operators, and integrators to make better risk management decisions. 16:18.680 --> 16:21.680 It's about informing your investments. 16:21.680 --> 16:24.300 It's about integrating the U.S. 16:24.300 --> 16:29.680 government and our partners in the intelligence community, Department of Defense and FBI. 16:29.680 --> 16:32.520 It's about integrating our efforts into yours. 16:32.660 --> 16:37.380 It's about moving to a proactive industrial control systems posture. 16:37.400 --> 16:46.880 And lastly, it's about driving towards a sustainable, long-lasting control systems security community. 16:47.000 --> 16:48.780 That's the top line. 16:48.780 --> 16:49.720 All right. 16:49.720 --> 16:50.880 How are we doing this? 16:50.880 --> 16:51.560 Pillars. 16:51.560 --> 16:52.420 We got four pillars. 16:52.420 --> 16:53.980 Every strategy's got to have pillars. 16:53.980 --> 16:55.380 We have four pillars. 16:55.520 --> 17:04.340 First pillar is asking more of the community, but doing more for the community from the federal government perspective as well. 17:04.520 --> 17:11.860 The second is advancing technology and the ability to secure our systems. 17:11.860 --> 17:26.860 Not just tomorrow's systems, but we have to figure out how to continue to defend today's deployments while thinking through the next generation and having more security baked in. 17:26.860 --> 17:29.340 Secure by design, secure by deployment. 17:29.340 --> 17:52.680 The third piece is developing deep data capabilities to better put our understanding of risks against the current deployments and building frameworks, building resources and approaches that take advantage of just this wealth of information we all have. 17:52.680 --> 17:56.820 Pull it all together and putting into meaningful frameworks. 17:57.360 --> 18:02.700 MITRE continues to lead in this space with the industrial control systems framework. 18:02.700 --> 18:09.520 Those are the types of activities and approaches that we look to be a part of. 18:09.520 --> 18:16.000 Not necessarily invent, not own, we just want to be a part of this effort. 18:16.000 --> 18:41.440 And lastly, increasing that risk understanding of the interdependencies that are out there so that we can drive smarter investments, smarter solutions, smarter engagements between the government and industry to get to that objective of democratizing control system security and making the environment safer and more secure. 18:42.940 --> 18:46.440 So it's those four pillars that drive our approaches. 18:46.440 --> 18:47.760 So what the heck are our approaches? 18:47.760 --> 18:50.540 Okay, this is the part that matters. 18:50.620 --> 18:54.740 The strategy is about what we're trying to do. 18:55.460 --> 19:00.860 Our approaches are how you can work with us to achieve these objectives. 19:01.060 --> 19:04.240 So got a few things that are worth talking about here. 19:04.240 --> 19:09.300 I already talked about one of them and that's the industrial control system joint working group. 19:09.560 --> 19:32.820 This is what is now a twice a year, that's biannual, twice a year now a virtual event, but it provides a free opportunity for anyone that's either getting into the control systems game or is in a jurisdiction that doesn't have travel funds, because those are always a challenge with, 19:32.820 --> 19:36.700 you know, the old days conferences. 19:36.840 --> 19:38.480 How do you get the money to go to Vegas? 19:38.480 --> 19:40.220 How do you get the money to go to Miami? 19:41.240 --> 19:55.780 The ICS JWG is about opening up a more inclusive environment so everyone can come together and learn something, even if it's at the 101 level or the 10 whatever remedial is, 100 level, it doesn't matter. 19:55.940 --> 20:05.100 The point is we have the opportunity to bring more people into this community and that's what we're working towards with the ICS JWG. 20:05.100 --> 20:09.980 We had our most recent one in, I don't know, it was a month or so ago. 20:10.040 --> 20:12.220 We've got another one coming up in the fall. 20:13.480 --> 20:16.480 So that's point one, ICS JWG. 20:16.480 --> 20:21.340 So back to that kind of integrating the federal government with the community. 20:21.340 --> 20:27.160 We also have an effort called the Control Systems Interagency Working Group, the CISIWG. 20:27.160 --> 20:32.060 Now, it says interagency, but don't take from that that it's just government. 20:32.060 --> 20:52.360 Again, this is about bringing the executive leadership of the federal agencies that play in control systems together with leaders from industry, from the research community, from the vendor space, bringing everybody together and figuring out, okay, what are our opportunities, 20:53.040 --> 20:54.300 our threats? 20:54.300 --> 20:58.000 It's really, in part, we're doing a SWOT analysis. 20:58.020 --> 20:59.600 How are we strong together? 20:59.600 --> 21:00.800 Where are we weak together? 21:00.800 --> 21:02.900 What are our opportunities to work together? 21:02.900 --> 21:04.540 And then what are the threats? 21:05.480 --> 21:15.380 So coming out of the last year or so work of the control systems interagency working group, well, we figured a few things out. 21:15.380 --> 21:21.080 One is the government needs to be more coordinated together. 21:21.380 --> 21:24.560 Everybody does some part of this game. 21:24.560 --> 21:27.260 How do we do it in a more coordinated fashion? 21:27.280 --> 21:33.000 Well, one place we can really achieve, I think, some alignment and advancements is in standards. 21:33.020 --> 21:44.440 So if we get all the federal government players together on standards and working towards the same common purpose, we can really drive the advancements we're looking for. 21:44.480 --> 21:49.880 Also, we can help work to build the workforce of the future. 21:50.080 --> 22:05.940 Rather than doing bits and pieces here and there, let's have a collective approach to workforce and a lot of credit to NIST and their efforts in job coding, creating clarity in messaging, and hiring practices. 22:05.940 --> 22:07.600 So we have an opportunity there. 22:07.740 --> 22:12.540 And also on the investment alignment. 22:12.540 --> 22:16.300 So R&D, lots of different R&D efforts across the federal government. 22:16.300 --> 22:30.580 We should have a more unified R&D agenda that can get better uses out of our investments, maybe eliminate some duplication or redundancy in efforts. 22:30.580 --> 22:31.980 Always a good thing. 22:31.980 --> 22:35.660 Maybe put those saved dollars towards another effort. 22:35.660 --> 22:49.200 And then lastly, working towards a more unified, streamlined, coherent, and value-added incident response approach within the USG. 22:49.200 --> 23:06.180 And in part, what we want to do with this is make sure that we're taking the relevant information out of an incident response effort and sharing that information back out in a protected way for the victim. 23:06.180 --> 23:08.800 We're not in the business of re-victimizing a victim. 23:08.800 --> 23:17.060 But to the extent that we can extract insights from single or multiple incident responses, that's a good thing. 23:17.060 --> 23:20.880 And that's something that we've done recently. 23:21.040 --> 23:29.580 In fact, in the oil and natural gas sector, we issued an alert earlier this year. 23:29.580 --> 23:30.980 Now, we're not perfect yet. 23:30.980 --> 23:32.420 We're still working at this. 23:32.520 --> 23:37.200 But your feedback on all of our control systems products is always welcome. 23:37.200 --> 23:40.360 So go to cissa.gov, c-i-s-a.gov. 23:40.460 --> 23:48.080 Check out our control systems page and all of the products we have there, the alerts, the guidance, the advisories. 23:48.160 --> 23:49.980 Let us know where we're hitting the mark. 23:49.980 --> 23:51.820 Let us know what else we need to do. 23:52.540 --> 23:56.620 And then work with us through the Industrial Control Systems Joint Working Group. 23:56.620 --> 24:05.000 There are a few other things that are worth highlighting, particularly since we're doing this DEFCON safe mode thing, something you'll hear about. 24:05.000 --> 24:17.640 And that got kicked off last year, rather earlier this year, down in Miami, ICS for ICS, Industrial Control Systems for Incident Command System. 24:17.640 --> 24:26.700 Not sure if everybody knows what the Incident Command System is, but it's what the physical emergency responders use to coordinate their efforts, whether it's a hurricane, a wildfire. 24:26.700 --> 24:33.400 It's actually the firefighters out in California, the fire service, they're the ones that develop the Incident Command System. 24:33.400 --> 24:37.200 But it's got a great application for physical disasters. 24:37.680 --> 24:49.260 But I bet if we ever have one of those big time, larger scale, physical or cyber-enabled physical event, guess who's going to show up? 24:49.260 --> 24:54.020 The fire department, the emergency managers, state and local officials. 24:54.020 --> 25:00.900 There's absolutely a role in control system security and incident response for state and locals. 25:01.000 --> 25:07.980 But they also recognize, we recognize, that there are roles for the security community. 25:07.980 --> 25:15.320 So what we've got to be able to do is develop those frameworks, develop the frameworks that put everybody together, clarity of roles and responsibilities. 25:15.320 --> 25:23.260 So a lot of credit to Megan Sanford for her work there, and ICS for ICS, and looking forward to continuing to contribute to that effort. 25:23.260 --> 25:27.800 And of course, the best for last here, ICS Village. 25:27.920 --> 25:32.780 This year, we were proud to partner with the ICS Village. 25:32.780 --> 25:36.440 A lot of credit and thanks goes to Bryson Borg for his efforts. 25:36.660 --> 25:40.380 But the idea is we can do more together. 25:40.380 --> 25:41.540 That's why we're here. 25:41.540 --> 25:45.980 That's why you're seeing the feds show up at DEF CON, even if it's virtually. 25:45.980 --> 25:56.380 We were there last year, but we look forward to really growing out this and building out this partnership with the ICS Village and other villages. 25:57.040 --> 25:58.980 We're doing that in a couple ways. 25:58.980 --> 26:15.980 This year, we've got our Control Environment Laboratory Resource, or CELER, that is going to give simulated environments so that everybody can walk through a couple different scenarios, work on your blue team skills, and run some incident response. 26:16.060 --> 26:27.160 This is an effort that we think, again, plays to that democratizing industrial control systems. 26:27.160 --> 26:28.700 It's been a long day. 26:28.700 --> 26:30.420 Industrial control systems security. 26:30.420 --> 26:32.700 Again, democratizing, making it more open. 26:32.700 --> 26:44.600 If we can pull more resources out of the National Capital Region, out of specific locations out west, and then make them broadly available virtually, good for everyone. 26:44.600 --> 26:51.600 If we can put things on wheels and drive them around to various parts of the country, again, these are good things. 26:51.600 --> 26:53.340 That's what we're trying to accomplish here. 26:53.340 --> 26:59.640 A control systems ecosystem, security ecosystem, that is open and accessible to everyone. 26:59.640 --> 27:05.620 Whether you're in the private sector or you're a municipal water facility, everyone's got requirements. 27:05.620 --> 27:07.860 We have to be able to do this together. 27:08.360 --> 27:14.360 So the last thing I'll talk about before wrapping this one up is our role in vulnerability management. 27:14.900 --> 27:22.140 This has been hell year, I think, for the vulnerability managers out there. 27:22.160 --> 27:27.200 Six months of week after week of big vuln after big vuln. 27:27.200 --> 27:39.440 I was thinking at some point it's almost a race to the bottom, because think about it, you drop one vulnerability and somebody's probably going to drop one next week, and so you've got tops of seven days in the new cycle. 27:40.120 --> 27:47.540 But it's really stressing the teams that historically we haven't invested too much in. 27:48.200 --> 27:54.840 The vulnerability management side is one of the most important teams within any organization. 27:55.600 --> 27:59.860 We play a key role here in coordinating vulnerability disclosure. 27:59.860 --> 28:07.240 We fund and support the CERT Coordination Center, CERT-CC, up at Carnegie Mellon. 28:07.240 --> 28:13.200 We also fund the National Vulnerability Database at NIST. 28:13.200 --> 28:28.520 So between the CERT-CC CVE process and the National Vulnerability Database, two key resources for any network defendant or any vulnerability manager of understanding what's new, what's coming, and how do you defend against it. 28:28.520 --> 28:45.320 We also play a role again through that CERT-CC process where the private sector or a security researcher rather, if they identify something, we can help facilitate the conversation between the appropriate vendor. 28:45.320 --> 28:47.980 Now sometimes we don't need to play a role. 28:48.280 --> 28:58.600 In fact, we encourage programs, we encourage vendors to have vulnerability disclosure programs, to have as needed bug bounty programs. 28:58.600 --> 29:09.200 Again, have a healthy, vibrant ability to engage with the security researcher where you don't need the government, even if it's just fostering or facilitating a protected conversation. 29:09.200 --> 29:12.980 But that's not always how things are right now. 29:12.980 --> 29:20.880 That's not where some organizations are in their maturity of their own vulnerability disclosure practices. 29:20.880 --> 29:22.460 So we play a vital role. 29:22.460 --> 29:34.080 Last year, calendar year 19, we processed and managed through our CBE process, 11,500 plus vulnerabilities. 29:34.360 --> 29:39.660 I think based on this year, we're probably going to exceed that. 29:39.660 --> 29:41.900 But that's a role we are happy to play. 29:41.900 --> 29:49.020 Again, we are going to continue to issue advice and guidance to organizations of all sizes and stripes. 29:50.100 --> 29:55.440 Guidance on how they can set up their own vulnerability disclosure programs. 29:55.440 --> 30:07.000 Just last week, we issued some guidance to our partners in the state and local election community about how they can set up vulnerability disclosure programs for their systems. 30:07.000 --> 30:11.320 And so it's not just about the code, the software they're coding or whatever. 30:11.320 --> 30:12.840 It's their implementations. 30:12.840 --> 30:22.260 If you find a vulnerability in a voter registration database, please, you know, first off, if you own that database, you need a process. 30:22.260 --> 30:31.580 But if you find that vulnerability, you need a way to report it in a coordinated manner so it can get closed out so that it's closed out before the bad guys get there. 30:32.200 --> 30:39.920 So vulnerability management is exactly where we are going to continue investing more broadly in the InfoSec space. 30:40.300 --> 30:46.940 And in fact, little known fact, this was supposed to be the year of vulnerability management. 30:46.940 --> 30:48.560 That was a theme we had. 30:48.620 --> 30:54.600 Little did we know that it was again, it was going to be vulnerability management hell year. 30:54.600 --> 30:55.360 But here we are. 30:55.360 --> 30:55.880 We're here. 30:55.880 --> 30:57.060 We're part of the team. 30:57.060 --> 30:58.580 Let us know what help you need. 30:58.580 --> 31:01.000 So I'm going to wrap this one up right now. 31:01.040 --> 31:06.580 Again, CISA is here as an advisor, as a partner, as a friend. 31:06.580 --> 31:14.860 Our objective, again, top line, democratizing industrial control system security at all levels. 31:14.860 --> 31:16.540 I don't care where you are. 31:16.540 --> 31:18.120 We want to work with you. 31:18.120 --> 31:27.420 We are here to provide support, resources, technical assistance, and the information you need to be able to protect your systems. 31:27.420 --> 31:32.960 But ultimately, it's not just about defending today's deployments. 31:32.960 --> 31:39.120 We've got to make sure that tomorrow's deployments are secure by design, secure by deployment. 31:39.640 --> 31:49.500 So with that, I'm going to wrap up these remarks, and I'm going to jump in a time machine, and I'm going to have a costume change and all that, and I think we're going to do some live Q&A. 31:49.880 --> 31:50.680 Thanks.