All right, we are now live. Chris, thank you very much for keynoting the first virtual SafeMode
DEF CON ICS Village. It has been a lot of work. I think it was really great how you set out both...
I'm sorry, I'm getting some feedback.
There we go, sorry. How you set out both the way that the strategy has changed,
acknowledging how government has to be different, and then extending the hand
to the community. And so the first question is, why now? What's changed?
Hey, thanks. So first off, let me... First, thanks to you. Thanks to the ICS Village for having me
on. I got to admit, it is painful watching recordings of your own remarks in what's,
I looked like a hostage in that feed. This is more of a natural setup. You, on the other hand,
Bryson, we could spruce up, I think, your setup there a little bit. So I'll help you on that
front. I've got the important things. I know, I'm jealous. I got it. Hey, I got my aerospace badge
the other night, so I'm excited about that. So what changed? I think it's... I don't think anything
necessarily changed overnight. I think it was more of an agency coming into its own and trying
to figure out, you know, A, what Congress asks us to do, and B, the, you know, the special authorities
and relationships that we've had. We've been in the ICS space for years. And if, you know,
in fact, we had an announcement earlier today, I mentioned the Control Systems Interagency Working
Group, the private sector co-chair, we announced that just simultaneously. And that's Marty Edwards
from Tenable. Marty Edwards has obviously been around for quite a long time. In fact,
he was an employee of a predecessor organization to CISA running our ICS CERT capability.
So we've been here, but again, I think what it was more about is a philosophy change here at the
agency about being bridge builders, about connecting the dots. And that's in part, I think, just kind
of my style, my, you know, the way I always operate. I'm a middle child, always seeking to build people,
you know, bridges, relationships, compromises, and not being adversarial. And I think this is a
community that kind of, I think, shares that mentality and approach is just looking for
that hand for the pull-up. So again, I think we've got a number of different things
that we're trying to do here. And one of the big takeaways that I had from the speech is
democratizing security in the control system space, that the gap between the haves and the
have-nots is pretty remarkable. So what I'm looking to do is not just make sure that the bigs
are in into the party, but the fact that we can roll out into rural communities in water sector,
water facilities, the 30,000 plus water treatment facilities across the country,
and make sure that they have access to training, resources, and capabilities. Not trying to take
anything over here. They're still going to be responsible for their security, whatever we can
do. So we've got a couple concepts between the control environment lab, resource to seller
capability, but also looking to put some people on wheels moving around the country and, you know,
again, bringing that last mile delivery on ICS training. Yeah, so I appreciate the kudos
to Timmy and to several others, certainly with the village. It's a team sport. I couldn't do
it without Tom Van Norman, who has done the lion's share of the CTF work, including
integrating CISA into that, along with all the volunteers we have and all of the legends that
we follow on from before. And so with that, opening the aperture for team and democracy,
how can small and mid-sized businesses get more involved with these efforts?
The CISA calls during COVID have been a fantastic resource for situational awareness.
How can people get more involved in the R&D to bridge the gaps?
Yeah, so a few things here. First is, first, I like hearing that the calls that we do during
COVID, just so everybody's tracking Tuesday, Thursdays for the first, I don't know, 15
months of COVID, however long it was, six or seven months, we did Tuesday, Wednesday calls,
broad stakeholders open. We're averaging anywhere, you know, the highest number, I think we had about
10,000 connections, and that's winnowed down over time. Now we're at every other week.
But the idea there is to make sure that we can bring a set of resources, educational information
sharing, technical guidance to the broader community. And that's not just us, but it's CDC,
HHS, FEMA, anyone else. And we've done that for other events too. If you recall back at
the beginning of the year with Iran, we did a couple calls there as well. The first evening
call we had, you know, 6,000 plus folks on a Friday afternoon, Friday, Friday, 6pm call Eastern.
And to me, again, it's, hey, here's what's going on in the world. Here is the background on the
Iranian actors. Here are the things that we're worried about. And you should probably be worried
about and covering down on over the weekend. Yeah, sorry to do this to you over the weekend. But
that's just kind of how life is right now. So again, the idea is to be able to quickly engage.
We've built partnership mechanisms and distribution mechanisms. Over the years,
we got 10s of 1000s of partners in these programs, but that's not nearly enough.
We have a lot of room left to cover or ground left to cover in terms of bringing people in. So
we'll continue doing these. We'll continue doing those calls. We're going to continue to do things
like the ICS JWG, which is open to everybody. It's free of charge. It's virtual now. So there's
really no barrier to entry. Since it's streaming online, if you got a connection to the internet,
you should be able to tap in. We also have our cyber security summit, our third annual cyber
security summit later this year, which is also going to be in safe mode, which is going to be
about two to three hours of programming once a week on a I think it's on a Wednesday. And what's
the first day there, September? I'll come back around on that. But it's going to be four weeks
in a row, every Wednesday, two to three hours of programming. Again, free of charge. We're going to
be streaming it on the CISA.gov website. And so lots of opportunity. And from there, what we've
got to do a better job of is communicating the specific, almost the equivalent of an API on how
you hook in. Just a week or two ago, we released the CISA service catalog, which is an interactive
tool so that you can kind of pick and choose, sort through the things that we provide. Again,
training, education, guidance, best practices, so that an organization of any stripe or capability
can plug in. And that'll, you know, get you into some of the other things we can do, like
have a protective security advisor, cyber security advisor,
sit down with you and walk you through a good plan.
Do you have any suggestions for how CISA can help push for critical infrastructure software updates
where the current model of CVE vulnerability reporting and tools like OWASP scans do not show
a problem in old, deprecated software platforms and tools? This would help open up the budget
and get prioritization escalated. Yeah. So, I mean, this is some of the initial feedback we got
through the cross-sector interagency working group. One issue was standards help improve
government input and engagement on standards bodies, but that doesn't really help for stuff
that's already deployed, the legacy systems. And in part, that's what we're trying to do
through pillar two of our ICS strategy. Again, I made the point in my remarks of nobody wants,
nobody's here to hear about a strategy. They want to hear about the things that we can do.
And that's what we're trying to build towards is collaborate with the community to the extent we
can do joint research, joint investment to get that defend today aspect of our mission space.
So we get the tools out there, the visibility out there, transparency out there on currently
deployed and then help to the extent possible transition over into more secure by design,
secure by deployment technologies. But this is the real challenge because some of this stuff's
hard to get to. You can't take the plant floor offline to do a swap out. So we've got to continue
thinking through what some of the alternative options are. So as a two-year-old agency,
you noted how young CEAS is, how is the process of recruiting ICS talent going? And can you discuss
what you were doing or plan to do to grow future talent? Yeah, this is tricky, right?
ICS talent is a unicorn out there right now. Oh, wait. Oh, there it is. Yeah.
Is that new? I haven't seen the dark unicorn version. Yeah, this is new. Okay, nice.
Bryson, seven months into COVID.
So it's tricky, right? We are able to attract talent right now on a 1Z, 2Z basis,
but that's not going to cut it. Our requirements are pretty dramatic.
But it's also not about getting the people in the boots on the ground here. So first off,
I have a philosophy. I want to be able to bring in as much talent as possible,
I'm okay if after four or five years or three years or whatever it is,
they spin out in the private sector. For me, it does a few things. One, it allows us to have an
alumni network of folks that know how we work, the things we do. And then once they spin out into the
private sector into the vendor community or the deployed community, they know how to work with us
and they have an affinity and predisposition to work with us. Second, it allows us to provide
training. So we're providing a lot of this training anyway, but if we do it here in-house,
then we know that there's some degree of bar met or standardization and training for ICS security.
Now, that's all well and good. You got to identify the talent as it comes up through. So we are
working with colleges, universities, with various veterans programs to bring folks in. And in some
cases, we can pay for tuition, scholarship for service is one program. But again, that assumes
that at least that part assumes that people are going into the traditional education paths.
And we are committed to a diverse and inclusive approach to bringing folks into the government
and particularly this agency. So we're working with Congress. They've provided us some funding
to set up a program that'll look more like a trade school or an institute-like approach. So
it's not necessarily a four-year college, but maybe two years. And that'll, I think, get us
into an entirely different population of potential employees. But more importantly,
get more capability and training out there at the edge, rather than just thinking through the
standard, you know, four-year college and university approach. So I know our time is
almost up. Oh, sorry. I don't think... yeah, right there. Look, we're hiring all the time. So
for any of our ICS resources, cisa.gov slash ICS. I realize the glare's probably bad. We'll fix that
for the next one. But we are always hiring. We are a steady employment machine, not just here
in the national capital region, but throughout this great country. So I just figured you've
been writing your password back up there. So it'd be a typical OPSEC fun fail. One, two, three,
four, five, six. Yeah, it's the same combination I have in my luggage. Three rapid-fire questions
to close it out, because I know you're out of time, is you get to wave a non-internet connected
magic wand. What is that one wish that you wish could happen? And then the final two questions is,
next year, a non-internet connected magic wand is a crystal ball. What is one good thing and one bad
thing that you think is going to happen in critical infrastructure in the next five years?
Yeah, so one thing that we've heard pretty clearly from across the community is a need for some sort
of, you know, Rosetta Stone of protocols within various ICS technology and equipment. So anything
we can do on that front to enumerate all the protocols and have it just that much easier
for the security and safety folks to understand what they're dealing with and be able to make
good informed decisions. So that's on the list. What's a good thing that's coming? I think we're
going to have a much better, in part through things like ICS for ICS and part through things
like updating CVSS and the distilling down commonalities across vulnerabilities in various
deployments. Again, have a more informed risk-based approach to decision making. On the
bad side, you know, look, the more stuff that's getting plugged in, the more stuff that's getting
remotely monitored, it is just additional attack surface. There will be bad moments. It's not
always going to be cyber, but there very likely will be cyber because we know the adversary
is taking a hard, hard look between China, Iran, and Russia. So we're just hoping that we can,
you know, through whether it's layer defense or just risk management and consequence management,
keep the boom small and keep the loss of life to zero.
Chris, thank you for your time. Pleasure as always. We look forward to continued collaboration.
Thanks, Bryson. Hey, stay safe, wear a mask. Thanks, folks.