WEBVTT 00:02.260 --> 00:04.960 All right, we are now live. 00:05.100 --> 00:11.780 Chris, thank you very much for keynoting the first virtual SafeMode DEF CON ICS Village. 00:11.780 --> 00:14.180 It has been a lot of work. 00:14.900 --> 00:17.240 I think it was really great how you set out both... 00:19.200 --> 00:21.240 I'm sorry, I'm getting some feedback. 00:22.460 --> 00:24.020 There we go, sorry. 00:25.020 --> 00:34.680 How you set out both the way that the strategy has changed, acknowledging how government has to be different, and then extending the hand to the community. 00:34.680 --> 00:37.800 And so the first question is, why now? 00:37.840 --> 00:39.180 What's changed? 00:40.760 --> 00:42.080 Hey, thanks. 00:42.080 --> 00:45.160 So first off, let me... First, thanks to you. 00:45.160 --> 00:47.220 Thanks to the ICS Village for having me on. 00:47.220 --> 01:03.900 I got to admit, it is painful watching recordings of your own remarks in what's, I looked like a hostage in that feed. 01:03.900 --> 01:05.500 This is more of a natural setup. 01:05.500 --> 01:12.120 You, on the other hand, Bryson, we could spruce up, I think, your setup there a little bit. 01:12.120 --> 01:14.020 So I'll help you on that front. 01:14.620 --> 01:16.040 I've got the important things. 01:16.040 --> 01:18.000 I know, I'm jealous. 01:18.000 --> 01:18.580 I got it. 01:18.580 --> 01:23.080 Hey, I got my aerospace badge the other night, so I'm excited about that. 01:23.660 --> 01:25.260 So what changed? 01:25.260 --> 01:29.420 I think it's... I don't think anything necessarily changed overnight. 01:29.420 --> 01:40.920 I think it was more of an agency coming into its own and trying to figure out, you know, A, what Congress asks us to do, and B, the, you know, the special authorities and relationships that we've had. 01:40.920 --> 01:45.860 We've been in the ICS space for years. 01:46.060 --> 01:57.600 And if, you know, in fact, we had an announcement earlier today, I mentioned the Control Systems Interagency Working Group, the private sector co-chair, we announced that just simultaneously. 01:57.600 --> 01:59.700 And that's Marty Edwards from Tenable. 01:59.700 --> 02:02.060 Marty Edwards has obviously been around for quite a long time. 02:02.060 --> 02:08.580 In fact, he was an employee of a predecessor organization to CISA running our ICS CERT capability. 02:08.640 --> 02:19.200 So we've been here, but again, I think what it was more about is a philosophy change here at the agency about being bridge builders, about connecting the dots. 02:19.320 --> 02:25.860 And that's in part, I think, just kind of my style, my, you know, the way I always operate. 02:25.860 --> 02:33.800 I'm a middle child, always seeking to build people, you know, bridges, relationships, compromises, and not being adversarial. 02:33.800 --> 02:41.980 And I think this is a community that kind of, I think, shares that mentality and approach is just looking for that hand for the pull-up. 02:41.980 --> 02:46.480 So again, I think we've got a number of different things that we're trying to do here. 02:46.480 --> 02:58.360 And one of the big takeaways that I had from the speech is democratizing security in the control system space, that the gap between the haves and the have-nots is pretty remarkable. 02:58.360 --> 03:15.140 So what I'm looking to do is not just make sure that the bigs are in into the party, but the fact that we can roll out into rural communities in water sector, water facilities, the 30,000 plus water treatment facilities across the country, and make sure that they have access to training, 03:15.140 --> 03:16.400 resources, and capabilities. 03:16.400 --> 03:18.160 Not trying to take anything over here. 03:18.160 --> 03:21.300 They're still going to be responsible for their security, whatever we can do. 03:21.300 --> 03:36.720 So we've got a couple concepts between the control environment lab, resource to seller capability, but also looking to put some people on wheels moving around the country and, you know, again, bringing that last mile delivery on ICS training. 03:37.900 --> 03:44.440 Yeah, so I appreciate the kudos to Timmy and to several others, certainly with the village. 03:44.440 --> 03:45.960 It's a team sport. 03:46.000 --> 04:00.220 I couldn't do it without Tom Van Norman, who has done the lion's share of the CTF work, including integrating CISA into that, along with all the volunteers we have and all of the legends that we follow on from before. 04:00.800 --> 04:08.660 And so with that, opening the aperture for team and democracy, how can small and mid-sized businesses get more involved with these efforts? 04:08.660 --> 04:13.080 The CISA calls during COVID have been a fantastic resource for situational awareness. 04:13.080 --> 04:16.560 How can people get more involved in the R&D to bridge the gaps? 04:17.320 --> 04:19.740 Yeah, so a few things here. 04:19.740 --> 04:36.980 First is, first, I like hearing that the calls that we do during COVID, just so everybody's tracking Tuesday, Thursdays for the first, I don't know, 15 months of COVID, however long it was, six or seven months, we did Tuesday, Wednesday calls, broad stakeholders open. 04:36.980 --> 04:43.620 We're averaging anywhere, you know, the highest number, I think we had about 10,000 connections, and that's winnowed down over time. 04:43.620 --> 04:45.480 Now we're at every other week. 04:45.480 --> 04:55.920 But the idea there is to make sure that we can bring a set of resources, educational information sharing, technical guidance to the broader community. 04:55.920 --> 05:00.520 And that's not just us, but it's CDC, HHS, FEMA, anyone else. 05:00.520 --> 05:02.380 And we've done that for other events too. 05:02.380 --> 05:07.700 If you recall back at the beginning of the year with Iran, we did a couple calls there as well. 05:07.760 --> 05:15.900 The first evening call we had, you know, 6,000 plus folks on a Friday afternoon, Friday, Friday, 6pm call Eastern. 05:16.140 --> 05:19.360 And to me, again, it's, hey, here's what's going on in the world. 05:19.500 --> 05:22.960 Here is the background on the Iranian actors. 05:23.000 --> 05:25.020 Here are the things that we're worried about. 05:25.020 --> 05:27.880 And you should probably be worried about and covering down on over the weekend. 05:27.880 --> 05:29.360 Yeah, sorry to do this to you over the weekend. 05:29.360 --> 05:32.160 But that's just kind of how life is right now. 05:32.540 --> 05:35.360 So again, the idea is to be able to quickly engage. 05:35.360 --> 05:39.300 We've built partnership mechanisms and distribution mechanisms. 05:39.400 --> 05:45.300 Over the years, we got 10s of 1000s of partners in these programs, but that's not nearly enough. 05:45.300 --> 05:49.860 We have a lot of room left to cover or ground left to cover in terms of bringing people in. 05:49.860 --> 05:51.740 So we'll continue doing these. 05:52.820 --> 05:54.460 We'll continue doing those calls. 05:54.460 --> 05:58.860 We're going to continue to do things like the ICS JWG, which is open to everybody. 05:58.860 --> 05:59.780 It's free of charge. 05:59.780 --> 06:00.860 It's virtual now. 06:00.860 --> 06:03.760 So there's really no barrier to entry. 06:03.980 --> 06:08.340 Since it's streaming online, if you got a connection to the internet, you should be able to tap in. 06:08.340 --> 06:21.280 We also have our cyber security summit, our third annual cyber security summit later this year, which is also going to be in safe mode, which is going to be about two to three hours of programming once a week on a I think it's on a Wednesday. 06:21.540 --> 06:24.420 And what's the first day there, September? 06:25.080 --> 06:26.820 I'll come back around on that. 06:26.820 --> 06:31.000 But it's going to be four weeks in a row, every Wednesday, two to three hours of programming. 06:31.000 --> 06:32.400 Again, free of charge. 06:32.400 --> 06:35.660 We're going to be streaming it on the CISA.gov website. 06:36.080 --> 06:38.780 And so lots of opportunity. 06:38.820 --> 06:48.140 And from there, what we've got to do a better job of is communicating the specific, almost the equivalent of an API on how you hook in. 06:48.140 --> 06:59.840 Just a week or two ago, we released the CISA service catalog, which is an interactive tool so that you can kind of pick and choose, sort through the things that we provide. 06:59.840 --> 07:08.320 Again, training, education, guidance, best practices, so that an organization of any stripe or capability can plug in. 07:08.320 --> 07:19.820 And that'll, you know, get you into some of the other things we can do, like have a protective security advisor, cyber security advisor, sit down with you and walk you through a good plan. 07:21.160 --> 07:37.260 Do you have any suggestions for how CISA can help push for critical infrastructure software updates where the current model of CVE vulnerability reporting and tools like OWASP scans do not show a problem in old, deprecated software platforms and tools? 07:37.260 --> 07:41.320 This would help open up the budget and get prioritization escalated. 07:41.480 --> 07:41.940 Yeah. 07:41.940 --> 07:48.720 So, I mean, this is some of the initial feedback we got through the cross-sector interagency working group. 07:49.560 --> 08:03.620 One issue was standards help improve government input and engagement on standards bodies, but that doesn't really help for stuff that's already deployed, the legacy systems. 08:03.680 --> 08:07.440 And in part, that's what we're trying to do through pillar two of our ICS strategy. 08:07.440 --> 08:12.520 Again, I made the point in my remarks of nobody wants, nobody's here to hear about a strategy. 08:12.520 --> 08:14.080 They want to hear about the things that we can do. 08:14.080 --> 08:25.540 And that's what we're trying to build towards is collaborate with the community to the extent we can do joint research, joint investment to get that defend today aspect of our mission space. 08:25.880 --> 08:39.620 So we get the tools out there, the visibility out there, transparency out there on currently deployed and then help to the extent possible transition over into more secure by design, secure by deployment technologies. 08:39.620 --> 08:43.420 But this is the real challenge because some of this stuff's hard to get to. 08:43.460 --> 08:47.900 You can't take the plant floor offline to do a swap out. 08:48.040 --> 08:52.620 So we've got to continue thinking through what some of the alternative options are. 08:53.400 --> 09:01.320 So as a two-year-old agency, you noted how young CEAS is, how is the process of recruiting ICS talent going? 09:01.340 --> 09:05.940 And can you discuss what you were doing or plan to do to grow future talent? 09:07.100 --> 09:10.620 Yeah, this is tricky, right? 09:11.180 --> 09:16.260 ICS talent is a unicorn out there right now. 09:16.580 --> 09:17.700 Oh, wait. 09:17.700 --> 09:19.000 Oh, there it is. 09:19.000 --> 09:19.860 Yeah. 09:20.180 --> 09:21.380 Is that new? 09:21.380 --> 09:25.900 I haven't seen the dark unicorn version. 09:25.900 --> 09:27.820 Yeah, this is new. 09:27.820 --> 09:29.360 Okay, nice. 09:30.840 --> 09:33.200 Bryson, seven months into COVID. 09:36.900 --> 09:39.200 So it's tricky, right? 09:39.780 --> 09:47.160 We are able to attract talent right now on a 1Z, 2Z basis, but that's not going to cut it. 09:47.160 --> 09:49.500 Our requirements are pretty dramatic. 09:49.640 --> 09:54.300 But it's also not about getting the people in the boots on the ground here. 09:54.300 --> 09:56.260 So first off, I have a philosophy. 09:56.260 --> 10:05.100 I want to be able to bring in as much talent as possible, I'm okay if after four or five years or three years or whatever it is, they spin out in the private sector. 10:05.100 --> 10:06.280 For me, it does a few things. 10:06.280 --> 10:13.460 One, it allows us to have an alumni network of folks that know how we work, the things we do. 10:13.540 --> 10:22.440 And then once they spin out into the private sector into the vendor community or the deployed community, they know how to work with us and they have an affinity and predisposition to work with us. 10:22.440 --> 10:24.860 Second, it allows us to provide training. 10:24.860 --> 10:34.300 So we're providing a lot of this training anyway, but if we do it here in-house, then we know that there's some degree of bar met or standardization and training for ICS security. 10:34.380 --> 10:36.720 Now, that's all well and good. 10:36.720 --> 10:38.980 You got to identify the talent as it comes up through. 10:38.980 --> 10:46.820 So we are working with colleges, universities, with various veterans programs to bring folks in. 10:46.820 --> 10:52.020 And in some cases, we can pay for tuition, scholarship for service is one program. 10:52.020 --> 10:58.440 But again, that assumes that at least that part assumes that people are going into the traditional education paths. 10:58.520 --> 11:09.280 And we are committed to a diverse and inclusive approach to bringing folks into the government and particularly this agency. 11:09.280 --> 11:10.800 So we're working with Congress. 11:10.800 --> 11:17.460 They've provided us some funding to set up a program that'll look more like a trade school or an institute-like approach. 11:17.460 --> 11:20.940 So it's not necessarily a four-year college, but maybe two years. 11:20.940 --> 11:28.420 And that'll, I think, get us into an entirely different population of potential employees. 11:28.680 --> 11:39.200 But more importantly, get more capability and training out there at the edge, rather than just thinking through the standard, you know, four-year college and university approach. 11:39.480 --> 11:41.640 So I know our time is almost up. 11:41.640 --> 11:42.040 Oh, sorry. 11:42.040 --> 11:43.600 I don't think... yeah, right there. 11:43.600 --> 11:45.180 Look, we're hiring all the time. 11:48.420 --> 11:53.900 So for any of our ICS resources, cisa.gov slash ICS. 11:53.900 --> 11:55.840 I realize the glare's probably bad. 11:55.840 --> 11:57.860 We'll fix that for the next one. 11:57.860 --> 11:59.880 But we are always hiring. 11:59.880 --> 12:07.680 We are a steady employment machine, not just here in the national capital region, but throughout this great country. 12:08.340 --> 12:11.560 So I just figured you've been writing your password back up there. 12:11.560 --> 12:14.440 So it'd be a typical OPSEC fun fail. 12:14.840 --> 12:16.240 One, two, three, four, five, six. 12:16.920 --> 12:20.560 Yeah, it's the same combination I have in my luggage. 12:21.220 --> 12:30.260 Three rapid-fire questions to close it out, because I know you're out of time, is you get to wave a non-internet connected magic wand. 12:30.820 --> 12:33.580 What is that one wish that you wish could happen? 12:33.620 --> 12:40.180 And then the final two questions is, next year, a non-internet connected magic wand is a crystal ball. 12:40.180 --> 12:46.280 What is one good thing and one bad thing that you think is going to happen in critical infrastructure in the next five years? 12:47.100 --> 13:03.060 Yeah, so one thing that we've heard pretty clearly from across the community is a need for some sort of, you know, Rosetta Stone of protocols within various ICS technology and equipment. 13:03.060 --> 13:18.500 So anything we can do on that front to enumerate all the protocols and have it just that much easier for the security and safety folks to understand what they're dealing with and be able to make good informed decisions. 13:18.500 --> 13:20.400 So that's on the list. 13:21.020 --> 13:22.600 What's a good thing that's coming? 13:22.600 --> 13:39.080 I think we're going to have a much better, in part through things like ICS for ICS and part through things like updating CVSS and the distilling down commonalities across vulnerabilities in various deployments. 13:39.300 --> 13:46.200 Again, have a more informed risk-based approach to decision making. 13:46.200 --> 13:56.920 On the bad side, you know, look, the more stuff that's getting plugged in, the more stuff that's getting remotely monitored, it is just additional attack surface. 13:56.920 --> 13:58.700 There will be bad moments. 13:58.700 --> 14:10.320 It's not always going to be cyber, but there very likely will be cyber because we know the adversary is taking a hard, hard look between China, Iran, and Russia. 14:10.320 --> 14:26.100 So we're just hoping that we can, you know, through whether it's layer defense or just risk management and consequence management, keep the boom small and keep the loss of life to zero. 14:28.670 --> 14:30.310 Chris, thank you for your time. 14:30.310 --> 14:31.370 Pleasure as always. 14:31.370 --> 14:34.270 We look forward to continued collaboration. 14:35.070 --> 14:35.910 Thanks, Bryson. 14:35.910 --> 14:38.470 Hey, stay safe, wear a mask. 14:38.850 --> 14:39.770 Thanks, folks.