start	end	text
2260	10040	All right, we are now live. Chris, thank you very much for keynoting the first virtual SafeMode
10040	17240	DEF CON ICS Village. It has been a lot of work. I think it was really great how you set out both...
19200	21240	I'm sorry, I'm getting some feedback.
22460	30240	There we go, sorry. How you set out both the way that the strategy has changed,
30240	33620	acknowledging how government has to be different, and then extending the hand
33620	39180	to the community. And so the first question is, why now? What's changed?
40760	46700	Hey, thanks. So first off, let me... First, thanks to you. Thanks to the ICS Village for having me
46700	60220	on. I got to admit, it is painful watching recordings of your own remarks in what's,
60220	66740	I looked like a hostage in that feed. This is more of a natural setup. You, on the other hand,
66740	73300	Bryson, we could spruce up, I think, your setup there a little bit. So I'll help you on that
73300	80680	front. I've got the important things. I know, I'm jealous. I got it. Hey, I got my aerospace badge
80680	87700	the other night, so I'm excited about that. So what changed? I think it's... I don't think anything
87700	93660	necessarily changed overnight. I think it was more of an agency coming into its own and trying
93660	99660	to figure out, you know, A, what Congress asks us to do, and B, the, you know, the special authorities
99660	107260	and relationships that we've had. We've been in the ICS space for years. And if, you know,
107260	113840	in fact, we had an announcement earlier today, I mentioned the Control Systems Interagency Working
113840	118460	Group, the private sector co-chair, we announced that just simultaneously. And that's Marty Edwards
118960	122380	from Tenable. Marty Edwards has obviously been around for quite a long time. In fact,
122380	128580	he was an employee of a predecessor organization to CISA running our ICS CERT capability.
128640	133740	So we've been here, but again, I think what it was more about is a philosophy change here at the
133740	141380	agency about being bridge builders, about connecting the dots. And that's in part, I think, just kind
141380	148960	of my style, my, you know, the way I always operate. I'm a middle child, always seeking to build people,
148960	154920	you know, bridges, relationships, compromises, and not being adversarial. And I think this is a
155820	159940	community that kind of, I think, shares that mentality and approach is just looking for
159940	165420	that hand for the pull-up. So again, I think we've got a number of different things
165420	170760	that we're trying to do here. And one of the big takeaways that I had from the speech is
171920	176500	democratizing security in the control system space, that the gap between the haves and the
176500	182240	have-nots is pretty remarkable. So what I'm looking to do is not just make sure that the bigs
182240	188660	are in into the party, but the fact that we can roll out into rural communities in water sector,
188660	192800	water facilities, the 30,000 plus water treatment facilities across the country,
192800	197260	and make sure that they have access to training, resources, and capabilities. Not trying to take
197260	200980	anything over here. They're still going to be responsible for their security, whatever we can
200980	206920	do. So we've got a couple concepts between the control environment lab, resource to seller
207740	212800	capability, but also looking to put some people on wheels moving around the country and, you know,
212800	220440	again, bringing that last mile delivery on ICS training. Yeah, so I appreciate the kudos
220920	226760	to Timmy and to several others, certainly with the village. It's a team sport. I couldn't do
226760	232520	it without Tom Van Norman, who has done the lion's share of the CTF work, including
232520	237900	integrating CISA into that, along with all the volunteers we have and all of the legends that
237900	244540	we follow on from before. And so with that, opening the aperture for team and democracy,
244540	248660	how can small and mid-sized businesses get more involved with these efforts?
248660	253080	The CISA calls during COVID have been a fantastic resource for situational awareness.
253080	256560	How can people get more involved in the R&D to bridge the gaps?
257320	264840	Yeah, so a few things here. First is, first, I like hearing that the calls that we do during
264840	270300	COVID, just so everybody's tracking Tuesday, Thursdays for the first, I don't know, 15
270300	275380	months of COVID, however long it was, six or seven months, we did Tuesday, Wednesday calls,
275380	280120	broad stakeholders open. We're averaging anywhere, you know, the highest number, I think we had about
280120	285480	10,000 connections, and that's winnowed down over time. Now we're at every other week.
285480	292100	But the idea there is to make sure that we can bring a set of resources, educational information
292100	298220	sharing, technical guidance to the broader community. And that's not just us, but it's CDC,
298220	303360	HHS, FEMA, anyone else. And we've done that for other events too. If you recall back at
303360	309000	the beginning of the year with Iran, we did a couple calls there as well. The first evening
309000	315900	call we had, you know, 6,000 plus folks on a Friday afternoon, Friday, Friday, 6pm call Eastern.
316140	321560	And to me, again, it's, hey, here's what's going on in the world. Here is the background on the
321560	326040	Iranian actors. Here are the things that we're worried about. And you should probably be worried
326040	329700	about and covering down on over the weekend. Yeah, sorry to do this to you over the weekend. But
329700	335360	that's just kind of how life is right now. So again, the idea is to be able to quickly engage.
335360	340200	We've built partnership mechanisms and distribution mechanisms. Over the years,
340200	345300	we got 10s of 1000s of partners in these programs, but that's not nearly enough.
345300	349940	We have a lot of room left to cover or ground left to cover in terms of bringing people in. So
349940	356120	we'll continue doing these. We'll continue doing those calls. We're going to continue to do things
356120	361540	like the ICS JWG, which is open to everybody. It's free of charge. It's virtual now. So there's
361540	366860	really no barrier to entry. Since it's streaming online, if you got a connection to the internet,
366860	370940	you should be able to tap in. We also have our cyber security summit, our third annual cyber
370940	376480	security summit later this year, which is also going to be in safe mode, which is going to be
376480	382260	about two to three hours of programming once a week on a I think it's on a Wednesday. And what's
382260	388300	the first day there, September? I'll come back around on that. But it's going to be four weeks
388300	392580	in a row, every Wednesday, two to three hours of programming. Again, free of charge. We're going to
392580	399720	be streaming it on the CISA.gov website. And so lots of opportunity. And from there, what we've
399720	407100	got to do a better job of is communicating the specific, almost the equivalent of an API on how
407100	414620	you hook in. Just a week or two ago, we released the CISA service catalog, which is an interactive
414620	420160	tool so that you can kind of pick and choose, sort through the things that we provide. Again,
420160	426520	training, education, guidance, best practices, so that an organization of any stripe or capability
427080	431280	can plug in. And that'll, you know, get you into some of the other things we can do, like
434260	437360	have a protective security advisor, cyber security advisor,
437360	439820	sit down with you and walk you through a good plan.
441160	447040	Do you have any suggestions for how CISA can help push for critical infrastructure software updates
447040	453320	where the current model of CVE vulnerability reporting and tools like OWASP scans do not show
453480	458820	a problem in old, deprecated software platforms and tools? This would help open up the budget
458820	465920	and get prioritization escalated. Yeah. So, I mean, this is some of the initial feedback we got
465920	473660	through the cross-sector interagency working group. One issue was standards help improve
474800	480440	government input and engagement on standards bodies, but that doesn't really help for stuff
480440	485320	that's already deployed, the legacy systems. And in part, that's what we're trying to do
485320	490720	through pillar two of our ICS strategy. Again, I made the point in my remarks of nobody wants,
490720	494080	nobody's here to hear about a strategy. They want to hear about the things that we can do.
494080	498880	And that's what we're trying to build towards is collaborate with the community to the extent we
498880	505540	can do joint research, joint investment to get that defend today aspect of our mission space.
505880	512000	So we get the tools out there, the visibility out there, transparency out there on currently
512000	517240	deployed and then help to the extent possible transition over into more secure by design,
517240	522160	secure by deployment technologies. But this is the real challenge because some of this stuff's
522160	529120	hard to get to. You can't take the plant floor offline to do a swap out. So we've got to continue
529120	535760	thinking through what some of the alternative options are. So as a two-year-old agency,
535760	542240	you noted how young CEAS is, how is the process of recruiting ICS talent going? And can you discuss
542240	550620	what you were doing or plan to do to grow future talent? Yeah, this is tricky, right?
551180	559860	ICS talent is a unicorn out there right now. Oh, wait. Oh, there it is. Yeah.
560180	569360	Is that new? I haven't seen the dark unicorn version. Yeah, this is new. Okay, nice.
570840	573200	Bryson, seven months into COVID.
576900	585700	So it's tricky, right? We are able to attract talent right now on a 1Z, 2Z basis,
585700	589500	but that's not going to cut it. Our requirements are pretty dramatic.
589640	595020	But it's also not about getting the people in the boots on the ground here. So first off,
595020	599200	I have a philosophy. I want to be able to bring in as much talent as possible,
599200	603440	I'm okay if after four or five years or three years or whatever it is,
603440	610100	they spin out in the private sector. For me, it does a few things. One, it allows us to have an
610100	614700	alumni network of folks that know how we work, the things we do. And then once they spin out into the
614700	618900	private sector into the vendor community or the deployed community, they know how to work with us
618900	624420	and they have an affinity and predisposition to work with us. Second, it allows us to provide
624420	627880	training. So we're providing a lot of this training anyway, but if we do it here in-house,
627880	634300	then we know that there's some degree of bar met or standardization and training for ICS security.
634380	639540	Now, that's all well and good. You got to identify the talent as it comes up through. So we are
639540	647360	working with colleges, universities, with various veterans programs to bring folks in. And in some
647360	653060	cases, we can pay for tuition, scholarship for service is one program. But again, that assumes
653060	658440	that at least that part assumes that people are going into the traditional education paths.
658520	667560	And we are committed to a diverse and inclusive approach to bringing folks into the government
667560	672200	and particularly this agency. So we're working with Congress. They've provided us some funding
672200	677560	to set up a program that'll look more like a trade school or an institute-like approach. So
677560	682540	it's not necessarily a four-year college, but maybe two years. And that'll, I think, get us
682540	689900	into an entirely different population of potential employees. But more importantly,
689900	694780	get more capability and training out there at the edge, rather than just thinking through the
694780	700680	standard, you know, four-year college and university approach. So I know our time is
700680	708900	almost up. Oh, sorry. I don't think... yeah, right there. Look, we're hiring all the time. So
708900	716380	for any of our ICS resources, cisa.gov slash ICS. I realize the glare's probably bad. We'll fix that
716380	723560	for the next one. But we are always hiring. We are a steady employment machine, not just here
723560	730060	in the national capital region, but throughout this great country. So I just figured you've
730060	735340	been writing your password back up there. So it'd be a typical OPSEC fun fail. One, two, three,
735340	742900	four, five, six. Yeah, it's the same combination I have in my luggage. Three rapid-fire questions
742900	749040	to close it out, because I know you're out of time, is you get to wave a non-internet connected
749040	755280	magic wand. What is that one wish that you wish could happen? And then the final two questions is,
755280	762100	next year, a non-internet connected magic wand is a crystal ball. What is one good thing and one bad
762100	766280	thing that you think is going to happen in critical infrastructure in the next five years?
767100	773780	Yeah, so one thing that we've heard pretty clearly from across the community is a need for some sort
773780	783660	of, you know, Rosetta Stone of protocols within various ICS technology and equipment. So anything
783660	790360	we can do on that front to enumerate all the protocols and have it just that much easier
790820	797120	for the security and safety folks to understand what they're dealing with and be able to make
797120	803240	good informed decisions. So that's on the list. What's a good thing that's coming? I think we're
803240	808480	going to have a much better, in part through things like ICS for ICS and part through things
808480	817980	like updating CVSS and the distilling down commonalities across vulnerabilities in various
817980	826560	deployments. Again, have a more informed risk-based approach to decision making. On the
826560	832560	bad side, you know, look, the more stuff that's getting plugged in, the more stuff that's getting
832560	839160	remotely monitored, it is just additional attack surface. There will be bad moments. It's not
839160	844180	always going to be cyber, but there very likely will be cyber because we know the adversary
844500	852620	is taking a hard, hard look between China, Iran, and Russia. So we're just hoping that we can,
852620	860460	you know, through whether it's layer defense or just risk management and consequence management,
860460	866100	keep the boom small and keep the loss of life to zero.
868670	874270	Chris, thank you for your time. Pleasure as always. We look forward to continued collaboration.
875070	879770	Thanks, Bryson. Hey, stay safe, wear a mask. Thanks, folks.