1 00:00:00,360 --> 00:00:01,860 - So we have a pretty interesting talk today. 2 00:00:01,860 --> 00:00:04,170 We have Jen Easterly and our own Dark Tangent. 3 00:00:04,170 --> 00:00:06,030 They're gonna give us a little discussion 4 00:00:06,030 --> 00:00:08,100 about how Aerosmith and Run-DMC 5 00:00:08,100 --> 00:00:10,830 can tell us about the future of cybersecurity. 6 00:00:10,830 --> 00:00:12,808 So enjoy. 7 00:00:12,808 --> 00:00:14,660 (audience applauding) 8 00:00:14,660 --> 00:00:15,493 - Okay. 9 00:00:17,940 --> 00:00:19,890 All right, thanks for coming to our talk, 10 00:00:19,890 --> 00:00:22,650 and I'm gonna reveal our agenda. 11 00:00:22,650 --> 00:00:24,480 This is what we'll be covering. 12 00:00:24,480 --> 00:00:25,537 That's blank. 13 00:00:25,537 --> 00:00:26,370 (audience laughing) 14 00:00:26,370 --> 00:00:29,100 'Cause this is gonna be a more unscripted conversation 15 00:00:29,100 --> 00:00:31,500 between Jen and myself. 16 00:00:31,500 --> 00:00:33,570 And we have a couple things we want to cover. 17 00:00:33,570 --> 00:00:35,130 But really, we wanted to have 18 00:00:35,130 --> 00:00:36,810 a sort of an authentic conversation, 19 00:00:36,810 --> 00:00:39,240 not a scripted thing where I have to make sure 20 00:00:39,240 --> 00:00:41,880 I ask a specific question and so on and so forth. 21 00:00:41,880 --> 00:00:43,980 So it might not be totally smooth, 22 00:00:43,980 --> 00:00:45,960 but it'll be totally interesting. 23 00:00:45,960 --> 00:00:47,550 And then at some point we're gonna start 24 00:00:47,550 --> 00:00:50,220 involving the audience with some questions. 25 00:00:50,220 --> 00:00:51,540 And so you can listen to us, 26 00:00:51,540 --> 00:00:53,790 maybe work through some of your questions. 27 00:00:53,790 --> 00:00:58,790 And before we get started, I have to de conflict myself. 28 00:00:59,190 --> 00:01:02,670 I actually am on the CISA Advisory Board 29 00:01:02,670 --> 00:01:07,670 and so I'm gonna be repping my "Keep CISA weird" shirt. 30 00:01:07,980 --> 00:01:09,090 (audience cheering) 31 00:01:09,090 --> 00:01:12,870 So just to remind the director 32 00:01:12,870 --> 00:01:15,120 that just 'cause it's government 33 00:01:15,120 --> 00:01:16,863 doesn't mean it has to be boring. 34 00:01:16,863 --> 00:01:18,734 - Exactly. (Dark laughs) 35 00:01:18,734 --> 00:01:19,567 Love it. 36 00:01:19,567 --> 00:01:21,240 I should have brought mine now I feel kind of guilty. 37 00:01:21,240 --> 00:01:22,670 - Yeah, look at that. 38 00:01:22,670 --> 00:01:24,240 In the blade runner font, 39 00:01:24,240 --> 00:01:26,070 for those of you wondering what that font is. 40 00:01:26,070 --> 00:01:27,477 - You should show them the back. 41 00:01:27,477 --> 00:01:28,710 - Oh, I can't read that. 42 00:01:28,710 --> 00:01:29,543 What does that say? 43 00:01:29,543 --> 00:01:31,830 - It says, "How about a nice game of chess?" 44 00:01:31,830 --> 00:01:33,060 - Yes. 45 00:01:33,060 --> 00:01:34,440 A nice game of chess, 46 00:01:34,440 --> 00:01:37,440 which Kenneth Gears is running the chess competition 47 00:01:37,440 --> 00:01:40,623 at DEFCON in case you wanna have a nice game of chess. 48 00:01:41,970 --> 00:01:44,250 All right, let's kick it off. 49 00:01:44,250 --> 00:01:45,900 Why are you here? 50 00:01:45,900 --> 00:01:48,780 - Yeah, well, let's see a show of hands. 51 00:01:48,780 --> 00:01:51,363 How many people know what CISA is? 52 00:01:52,740 --> 00:01:54,210 - Wow. - Oh, it's pretty good. 53 00:01:54,210 --> 00:01:56,512 - How many of you work for CISA? 54 00:01:56,512 --> 00:01:59,095 (all laughing) 55 00:02:00,780 --> 00:02:01,860 - Well, maybe I can leave. 56 00:02:01,860 --> 00:02:02,958 My job is done here. 57 00:02:02,958 --> 00:02:05,730 - Yeah, we've converted them all to employees. 58 00:02:05,730 --> 00:02:06,563 - Exactly. 59 00:02:06,563 --> 00:02:09,330 So as you know, CISA is the newest agency 60 00:02:09,330 --> 00:02:10,664 in the federal government 61 00:02:10,664 --> 00:02:14,160 founded by our mutual friend, Chris Krebs 62 00:02:14,160 --> 00:02:16,230 about three and a half years ago. 63 00:02:16,230 --> 00:02:18,690 And I think events like this, 64 00:02:18,690 --> 00:02:23,550 especially with the folks who are here are so important 65 00:02:23,550 --> 00:02:26,670 for us to develop trusted partnerships with. 66 00:02:26,670 --> 00:02:28,530 And so you and I before I was confirmed, 67 00:02:28,530 --> 00:02:31,500 had a great conversation about the importance 68 00:02:31,500 --> 00:02:32,790 of this community. 69 00:02:32,790 --> 00:02:37,363 And certainly from my past in the army, at the NSA, 70 00:02:37,363 --> 00:02:40,950 and even at Morgan Stanley where we sent folks here 71 00:02:40,950 --> 00:02:43,230 realized that this is such an important community 72 00:02:43,230 --> 00:02:44,280 for us to connect to. 73 00:02:44,280 --> 00:02:47,100 So I was excited to come hang out with you- 74 00:02:47,100 --> 00:02:47,933 - Yeah. 75 00:02:47,933 --> 00:02:49,170 - And have some fun. 76 00:02:49,170 --> 00:02:51,174 - You're all important. 77 00:02:51,174 --> 00:02:52,925 (audience laughing) 78 00:02:52,925 --> 00:02:55,830 We're gonna talk about that I think a little bit. 79 00:02:55,830 --> 00:02:58,380 It's interesting because when I started with DEFCON 80 00:02:58,380 --> 00:03:00,600 and it was all about the technical, 81 00:03:00,600 --> 00:03:01,770 and it was all about the party, 82 00:03:01,770 --> 00:03:03,900 and it was all about the hack 83 00:03:03,900 --> 00:03:06,093 and the social grew up around it. 84 00:03:06,930 --> 00:03:08,790 And we'd always talk about keeping true 85 00:03:08,790 --> 00:03:11,760 to the core of DEFCON meant that you had to stay 86 00:03:11,760 --> 00:03:14,640 kind of hacker and all the things that weren't hacker, 87 00:03:14,640 --> 00:03:15,660 that's fine too. 88 00:03:15,660 --> 00:03:20,460 But if you lost that core, you might drift 89 00:03:20,460 --> 00:03:22,410 and then you're not quite sure what your identity is. 90 00:03:22,410 --> 00:03:24,150 And one of the things we do at DEFCON now 91 00:03:24,150 --> 00:03:27,330 is when we're reviewing papers is we say, 92 00:03:27,330 --> 00:03:30,120 we're not an InfoSec conference, we're a hacking conference. 93 00:03:30,120 --> 00:03:31,110 And there's difference. 94 00:03:31,110 --> 00:03:36,110 Here it's maybe joy of discoveries, spontaneous learning. 95 00:03:37,470 --> 00:03:39,030 InfoSec may be advancing your career 96 00:03:39,030 --> 00:03:42,360 or honing a technique that will help you in your job. 97 00:03:42,360 --> 00:03:45,780 Have you really thought through, what is the core of CISA? 98 00:03:45,780 --> 00:03:47,880 What is your guiding stone 99 00:03:47,880 --> 00:03:49,907 where everything else kind of orients? 100 00:03:49,907 --> 00:03:51,960 'Cause we've had 30 years to figure it out 101 00:03:51,960 --> 00:03:55,860 and you've had a year and a half plus what Chris had. 102 00:03:55,860 --> 00:03:57,947 - Well a year and a couple weeks. 103 00:03:57,947 --> 00:03:59,400 - Yeah. 104 00:03:59,400 --> 00:04:02,190 - Well, it's a good question because one of the first things 105 00:04:02,190 --> 00:04:06,303 that I looked at when I got there is, what's our culture? 106 00:04:07,410 --> 00:04:08,640 What are our core values? 107 00:04:08,640 --> 00:04:10,020 What do we expect from each other 108 00:04:10,020 --> 00:04:12,660 and what do we aspire to be as an organization? 109 00:04:12,660 --> 00:04:16,110 And because we were built off the back of a staff element, 110 00:04:16,110 --> 00:04:18,308 we really didn't have any of that kind. 111 00:04:18,308 --> 00:04:20,670 - I was curious, if you can share the numbers, 112 00:04:20,670 --> 00:04:24,470 what's average turnover in a government agency or in CISA? 113 00:04:24,470 --> 00:04:26,550 What's retention even like in that? 114 00:04:26,550 --> 00:04:30,720 - Yeah, I mean, it's actually pretty good retention. 115 00:04:30,720 --> 00:04:32,460 Our turnover attrition, 116 00:04:32,460 --> 00:04:37,140 and I separate attrition from regretted attrition, 117 00:04:37,140 --> 00:04:38,760 'cause not all attrition is- 118 00:04:38,760 --> 00:04:39,593 - Is bad. 119 00:04:39,593 --> 00:04:42,450 - Necessarily a bad thing for the organization, 120 00:04:42,450 --> 00:04:45,240 but it's under probably like 10%. 121 00:04:45,240 --> 00:04:49,830 So maybe in some case under 5%, but it's low. 122 00:04:49,830 --> 00:04:53,790 - Compared to say Amazon at 40%, not looking so bad. 123 00:04:53,790 --> 00:04:55,890 - Yeah, but I have a different philosophy. 124 00:04:55,890 --> 00:04:59,250 I mean, so attracting and retaining talent 125 00:04:59,250 --> 00:05:02,100 is really predicated on developing a great culture 126 00:05:02,100 --> 00:05:03,810 and that's why we've laid out 127 00:05:03,810 --> 00:05:05,520 what the core values of CISA are, 128 00:05:05,520 --> 00:05:06,720 what our core principles are. 129 00:05:06,720 --> 00:05:10,020 But if somebody wants to come in to defend the nation 130 00:05:10,020 --> 00:05:12,330 for a period of time and then go back out 131 00:05:12,330 --> 00:05:15,480 to a critical infrastructure owner or operator, 132 00:05:15,480 --> 00:05:18,060 you become part of the collective defense of the nation. 133 00:05:18,060 --> 00:05:20,580 So I'm totally cool with that. 134 00:05:20,580 --> 00:05:23,640 Come learn what it's like to work in the federal government. 135 00:05:23,640 --> 00:05:26,970 We are probably as much the private sector 136 00:05:26,970 --> 00:05:29,130 as any place in the federal government. 137 00:05:29,130 --> 00:05:33,390 And so I think it's about building capability 138 00:05:33,390 --> 00:05:34,500 for the nation. 139 00:05:34,500 --> 00:05:37,680 - I remember when I was spending time in DC, 140 00:05:37,680 --> 00:05:40,440 there was always the politicals, 141 00:05:40,440 --> 00:05:43,140 the full-time employees, and the contractors. 142 00:05:43,140 --> 00:05:45,360 And there are these three communities 143 00:05:45,360 --> 00:05:47,220 and they're all working at the same agency, 144 00:05:47,220 --> 00:05:48,900 but they're different 145 00:05:48,900 --> 00:05:50,010 and they have different interests, 146 00:05:50,010 --> 00:05:51,870 and different motivations and everything. 147 00:05:51,870 --> 00:05:54,240 And originally at big DHS, 148 00:05:54,240 --> 00:05:57,090 they had quite a large number of contractors 149 00:05:57,090 --> 00:05:58,650 and I remember having a conversation 150 00:05:58,650 --> 00:06:01,523 with some leadership back in the day saying, 151 00:06:01,523 --> 00:06:05,550 if 60% of your workforce are contractors, 152 00:06:05,550 --> 00:06:07,140 that means the remaining 40% 153 00:06:07,140 --> 00:06:10,800 have to be really good at managing contractors. 154 00:06:10,800 --> 00:06:12,240 You have to have expert skills, 155 00:06:12,240 --> 00:06:15,630 but if you're 40% is just like those 60%, 156 00:06:15,630 --> 00:06:18,600 so does it mean that 'cause you're building that culture, 157 00:06:18,600 --> 00:06:21,780 you have to have the culture of managing contractors 158 00:06:21,780 --> 00:06:24,900 or is it you treat everybody identically 159 00:06:24,900 --> 00:06:27,750 knowing you have to have different skill sets for the...? 160 00:06:27,750 --> 00:06:29,010 How do you...? - Yeah. 161 00:06:29,010 --> 00:06:31,310 - Because it's not managing cooperate America. 162 00:06:32,631 --> 00:06:34,849 - For me, we are just riffing here so that's just a... 163 00:06:34,849 --> 00:06:36,330 - Yeah. 164 00:06:36,330 --> 00:06:39,030 - For me, I really don't see a distinction. 165 00:06:39,030 --> 00:06:43,140 I mean, there is a distinction in terms of certain rules, 166 00:06:43,140 --> 00:06:44,700 a way a contract is handed. 167 00:06:44,700 --> 00:06:48,060 So for example, I'm a big mental health advocate. 168 00:06:48,060 --> 00:06:50,220 So we made 2022 the year of mental health 169 00:06:50,220 --> 00:06:52,740 and employee wellbeing. 170 00:06:52,740 --> 00:06:55,020 But really everybody wellbeing obviously 171 00:06:55,020 --> 00:06:56,700 if you contribute to the mission of CISA. 172 00:06:56,700 --> 00:06:58,927 But one of the things that we did 173 00:06:58,927 --> 00:07:01,320 was we got Headspace, the mindfulness app. 174 00:07:01,320 --> 00:07:02,349 Do you use that? 175 00:07:02,349 --> 00:07:03,182 - Okay, I don't use it. 176 00:07:03,182 --> 00:07:04,015 - I recommend it to you. 177 00:07:04,950 --> 00:07:08,133 So it's good for meditation and mindfulness. 178 00:07:09,480 --> 00:07:11,190 So we got that for all of our employees 179 00:07:11,190 --> 00:07:13,230 and we couldn't get it for the contractor. 180 00:07:13,230 --> 00:07:14,992 So there's certainly the legal things- 181 00:07:14,992 --> 00:07:15,825 - Interesting. 182 00:07:15,825 --> 00:07:16,800 - There's training that we offer 183 00:07:16,800 --> 00:07:21,150 that we can ask a contractors company to offer to them. 184 00:07:21,150 --> 00:07:24,720 If we give days off, we can work with that vendor. 185 00:07:24,720 --> 00:07:29,670 But otherwise, I just see everybody as part of team CISA. 186 00:07:29,670 --> 00:07:33,270 Same values, collaboration, innovation, service, 187 00:07:33,270 --> 00:07:35,790 accountability, all of us same principles. 188 00:07:35,790 --> 00:07:38,580 And we have a culture council that we stood up 189 00:07:38,580 --> 00:07:41,100 to make sure that we are guarding our culture 190 00:07:41,100 --> 00:07:42,044 and embracing it. 191 00:07:42,044 --> 00:07:43,410 - So the people in other agencies looking at you like, 192 00:07:43,410 --> 00:07:45,000 what the hell is Jen doing? 193 00:07:45,000 --> 00:07:47,972 Or are they like, that's awesome, we wanna imitate that? 194 00:07:47,972 --> 00:07:49,739 - That. - That, okay. 195 00:07:49,739 --> 00:07:51,300 - I don't know. (Black laughs) 196 00:07:51,300 --> 00:07:54,570 I think people see that we're having a lot of success 197 00:07:54,570 --> 00:07:56,280 with bringing in talent. 198 00:07:56,280 --> 00:07:57,780 - Yeah. - And so that's good. 199 00:07:57,780 --> 00:08:00,300 I mean, partially that is the culture that we're building, 200 00:08:00,300 --> 00:08:04,710 but it's also because we were uniquely given authorities 201 00:08:04,710 --> 00:08:06,810 as America's Cyber Defense Agency. 202 00:08:06,810 --> 00:08:08,940 I mean, the Congress went all in on us. 203 00:08:08,940 --> 00:08:10,680 They gave us more money, more authorities. 204 00:08:10,680 --> 00:08:12,060 They gave us something called 205 00:08:12,060 --> 00:08:13,770 the Cyber Talent Management System, 206 00:08:13,770 --> 00:08:18,770 which allows us to hire much more agilely and pay more. 207 00:08:19,800 --> 00:08:22,560 One thing that always drove me bananas was, 208 00:08:22,560 --> 00:08:24,900 you have to have a bachelor's degree, 209 00:08:24,900 --> 00:08:27,060 or a master's degree, or a PhD. 210 00:08:27,060 --> 00:08:28,830 I mean, and then you get a PhD 211 00:08:28,830 --> 00:08:31,020 and come in as a GS 11 or something. 212 00:08:31,020 --> 00:08:32,503 - Right, doing malware analysis. 213 00:08:32,503 --> 00:08:33,336 - Exactly. 214 00:08:33,336 --> 00:08:34,169 I don't really care 215 00:08:34,169 --> 00:08:35,520 whether you have a college degree or not. 216 00:08:35,520 --> 00:08:38,430 My most technical person at Morgan Stanley, 217 00:08:38,430 --> 00:08:41,370 my head of cyber analytics had no college degree. 218 00:08:41,370 --> 00:08:46,370 And so I think it's really about aptitude and attitude 219 00:08:46,830 --> 00:08:48,990 and that's why I think the culture piece is so important 220 00:08:48,990 --> 00:08:52,590 because you might be the most technical person in the world. 221 00:08:52,590 --> 00:08:54,390 But if you're an asshole, 222 00:08:54,390 --> 00:08:57,420 that's not gonna be good for the culture 223 00:08:57,420 --> 00:08:58,740 that we're trying to build. 224 00:08:58,740 --> 00:09:01,830 And so aptitude and attitude is what we need to do 225 00:09:01,830 --> 00:09:03,900 and the CTMS takes us there. 226 00:09:03,900 --> 00:09:06,510 It also helps us pay closer to market, 227 00:09:06,510 --> 00:09:08,410 not what I paid the guys at Morgan Stanley. 228 00:09:08,410 --> 00:09:11,430 - The CTMS she's mentioning... 229 00:09:11,430 --> 00:09:12,660 - Oh yeah, you started that, right? 230 00:09:12,660 --> 00:09:15,813 - Well, eight years ago or more 231 00:09:15,813 --> 00:09:19,290 that we did some recommendations on hiring in DHS 232 00:09:19,290 --> 00:09:21,150 and how to retain, attract. 233 00:09:21,150 --> 00:09:23,130 We were really big on this concept 234 00:09:23,130 --> 00:09:26,703 of verification of talent. 235 00:09:27,971 --> 00:09:29,370 So you have to prove your skills, 236 00:09:29,370 --> 00:09:31,590 Demonstration of Skill I think is what we called it. 237 00:09:31,590 --> 00:09:33,030 And then that way you would hire, 238 00:09:33,030 --> 00:09:34,380 it doesn't matter what your education is. 239 00:09:34,380 --> 00:09:37,770 If you can demonstrate the skill, then you're qualified 240 00:09:37,770 --> 00:09:41,460 and it was a good report, people agreed with it 241 00:09:41,460 --> 00:09:45,270 and then nothing for it until just last year, seven years. 242 00:09:45,270 --> 00:09:46,410 - Yeah, 2021. 243 00:09:46,410 --> 00:09:49,650 - And so, speed of government. 244 00:09:49,650 --> 00:09:53,933 But now that it's happened, now you can run with it. 245 00:09:53,933 --> 00:09:56,523 And so, yeah, it's slow fast. 246 00:09:57,360 --> 00:09:58,193 In our world, 247 00:09:58,193 --> 00:10:00,150 in hacking you expect things to happen very quickly, 248 00:10:00,150 --> 00:10:02,400 but in government world, sometimes things are slow 249 00:10:02,400 --> 00:10:04,590 and I kind of use that to balance 250 00:10:04,590 --> 00:10:06,238 both sides of my personality. 251 00:10:06,238 --> 00:10:08,483 - Yeah, but it's the bureaucracy. 252 00:10:08,483 --> 00:10:12,843 I mean, people ask often what keeps you up at night? 253 00:10:14,190 --> 00:10:15,420 The adversaries are out there 254 00:10:15,420 --> 00:10:17,070 and they're really sophisticated 255 00:10:17,070 --> 00:10:20,250 and increasingly complex threat landscape. 256 00:10:20,250 --> 00:10:23,340 But for me, it's battling the bureaucracy 257 00:10:23,340 --> 00:10:27,120 both so we can attract and retain great talent, 258 00:10:27,120 --> 00:10:28,740 but also be able to do the mission. 259 00:10:28,740 --> 00:10:30,570 We have to be able to move the speed of cyber 260 00:10:30,570 --> 00:10:32,117 and not at the speed of bureaucracy. 261 00:10:32,117 --> 00:10:34,170 - You can't get a PhD in bureaucracy, can you? 262 00:10:34,170 --> 00:10:35,751 So I mean.... - Or government. 263 00:10:35,751 --> 00:10:37,080 - Yeah, or government. 264 00:10:37,080 --> 00:10:39,720 - And so that's the thing that I worry the most about 265 00:10:39,720 --> 00:10:42,390 and that's the thing that we're fighting against is, 266 00:10:42,390 --> 00:10:45,960 how can we do things much more like the private sector 267 00:10:45,960 --> 00:10:47,730 and battle the government bureaucracy? 268 00:10:47,730 --> 00:10:50,220 And we're starting to have a lot of good success 269 00:10:50,220 --> 00:10:52,920 and part of it is what we've been talking about 270 00:10:52,920 --> 00:10:54,540 since over a year ago is, 271 00:10:54,540 --> 00:10:57,000 how do you build those trusted partnerships? 272 00:10:57,000 --> 00:11:00,030 There's this whole talk predicated on unlikely 273 00:11:00,030 --> 00:11:02,790 but powerful partnerships that Run-DMC 274 00:11:02,790 --> 00:11:05,460 and Andrew Smith, 1986 walked this way. 275 00:11:05,460 --> 00:11:07,602 - I like the DMC, I'll take that. 276 00:11:07,602 --> 00:11:09,060 That'd be good. 277 00:11:09,060 --> 00:11:10,530 One of the things, 278 00:11:10,530 --> 00:11:13,920 I think we talked about this is that... 279 00:11:13,920 --> 00:11:17,490 And I'm curious if by show of hands, 280 00:11:17,490 --> 00:11:21,010 how many people trust an organization 281 00:11:22,080 --> 00:11:25,260 versus trust an individual? 282 00:11:25,260 --> 00:11:28,400 You don't trust say the FBI, you trust your buddy at FBI 283 00:11:28,400 --> 00:11:30,540 or you don't trust Microsoft, you trust your buddy. 284 00:11:30,540 --> 00:11:33,250 So show of hands, who would trust the organization 285 00:11:35,400 --> 00:11:37,203 and who would trust your individual 286 00:11:37,203 --> 00:11:38,903 that you have a relationship with? 287 00:11:40,260 --> 00:11:43,950 Right, and so I think knowing that... 288 00:11:43,950 --> 00:11:45,447 - [Audience 1] I trust no one. 289 00:11:45,447 --> 00:11:46,950 - You trust no one. - You trust no one. 290 00:11:46,950 --> 00:11:51,660 - Yeah, and so I think that means that we have to organize, 291 00:11:51,660 --> 00:11:53,400 you have to build a way for people 292 00:11:53,400 --> 00:11:56,400 to build those relationships with your organization 293 00:11:56,400 --> 00:11:58,260 and then maybe over time they trust the organization 294 00:11:58,260 --> 00:11:59,190 more and more and more. 295 00:11:59,190 --> 00:12:03,570 But until you have that kind of continuity of trust, 296 00:12:03,570 --> 00:12:05,430 because I think when the hits the fan, 297 00:12:05,430 --> 00:12:07,082 they're gonna call up their buddy 298 00:12:07,082 --> 00:12:09,175 and they're not gonna call the Switchboard. 299 00:12:09,175 --> 00:12:10,008 - No. - Yeah. 300 00:12:10,008 --> 00:12:11,250 - I mean, that answers your question 301 00:12:11,250 --> 00:12:12,750 and that's why I'm here. 302 00:12:12,750 --> 00:12:15,357 And that's why I spend so much time engaging with people 303 00:12:15,357 --> 00:12:18,310 and on the road, and going to various events to meet people 304 00:12:19,345 --> 00:12:20,294 and being responsive. 305 00:12:20,294 --> 00:12:22,020 - But behind you, you have to have a team, 306 00:12:22,020 --> 00:12:23,497 or group of people or... 307 00:12:23,497 --> 00:12:25,269 - Yeah, I've got an awesome team. 308 00:12:25,269 --> 00:12:26,850 A lot of them as you know. 309 00:12:26,850 --> 00:12:28,650 A lot of them are here but now that, 310 00:12:28,650 --> 00:12:30,090 you and I talked about this 311 00:12:30,090 --> 00:12:34,080 and I just came from a discussion around elections. 312 00:12:34,080 --> 00:12:38,450 And the operative word for all of this is trust 313 00:12:38,450 --> 00:12:39,390 at the end of the day. 314 00:12:39,390 --> 00:12:40,680 And so the question is, 315 00:12:40,680 --> 00:12:43,740 how do you actually build trusted partnerships 316 00:12:43,740 --> 00:12:47,070 between the federal government and all of the partners 317 00:12:47,070 --> 00:12:47,903 that we need to work with? 318 00:12:47,903 --> 00:12:50,730 Because we're a voluntary agency, we're not a regulator. 319 00:12:50,730 --> 00:12:53,520 And our job is to defend critical infrastructure 320 00:12:53,520 --> 00:12:55,380 and we don't own the vast majority 321 00:12:55,380 --> 00:12:56,580 of critical infrastructure. 322 00:12:56,580 --> 00:12:59,040 So you have to have trusted partnerships 323 00:12:59,040 --> 00:13:00,690 so we can work together to make sure 324 00:13:00,690 --> 00:13:02,820 that everybody has the guidance, and the resources, 325 00:13:02,820 --> 00:13:06,057 and the tools to be able to defend the nation. 326 00:13:06,057 --> 00:13:08,220 And so again, it's about trust, 327 00:13:08,220 --> 00:13:10,650 And again, what we talked about, 328 00:13:10,650 --> 00:13:12,000 what we've been trying to do 329 00:13:12,000 --> 00:13:15,180 through the Joint Cyber Defense Collaborative as you know 330 00:13:15,180 --> 00:13:17,610 through our Cybersecurity Advisory Council, 331 00:13:17,610 --> 00:13:20,490 through the Technical Advisory Council, 332 00:13:20,490 --> 00:13:22,290 and I really want you to talk about that, 333 00:13:22,290 --> 00:13:24,900 through the CSRB, the Cyber Safety Review Board 334 00:13:24,900 --> 00:13:27,960 that you and Rob Silvers and Heather Atkins talked about, 335 00:13:27,960 --> 00:13:31,200 is creating trust between the federal government 336 00:13:31,200 --> 00:13:35,340 and all of the stakeholders to include industry. 337 00:13:35,340 --> 00:13:37,830 And I see the most important things is, 338 00:13:37,830 --> 00:13:42,150 you gotta approach it with first of all, humility. 339 00:13:42,150 --> 00:13:44,250 We certainly can't solve this problem as a government. 340 00:13:44,250 --> 00:13:45,570 We don't have all the answers, 341 00:13:45,570 --> 00:13:48,120 and so humility I think is truly important. 342 00:13:48,120 --> 00:13:49,860 I think vulnerability is something. 343 00:13:49,860 --> 00:13:51,300 So it's interesting, right? - Yeah. 344 00:13:51,300 --> 00:13:54,180 - Because vulnerabilities are such a negative word 345 00:13:54,180 --> 00:13:55,590 in our technical community. 346 00:13:55,590 --> 00:13:58,080 But I think vulnerability is an incredibly important thing 347 00:13:58,080 --> 00:13:59,190 when you're talking about building- 348 00:13:59,190 --> 00:14:00,023 - Personal development. 349 00:14:00,023 --> 00:14:01,470 - Trusted relationship. 350 00:14:01,470 --> 00:14:03,870 I think transparency is something we always talk about. 351 00:14:03,870 --> 00:14:08,580 Transparency builds trust, and that's huge for me. 352 00:14:08,580 --> 00:14:12,450 And then finally, gratitude, bringing together the community 353 00:14:12,450 --> 00:14:15,900 and sort of figuring out how we can appreciate 354 00:14:15,900 --> 00:14:18,092 what every side is bringing to the table. 355 00:14:18,092 --> 00:14:19,740 - So you mentioned a couple words 356 00:14:19,740 --> 00:14:22,350 that really resonate with me. 357 00:14:22,350 --> 00:14:24,030 One is transparency, 358 00:14:24,030 --> 00:14:26,340 just because DEFCON we've done so much work 359 00:14:26,340 --> 00:14:27,173 trying to build. 360 00:14:27,173 --> 00:14:30,750 We were the first conference to use a transparency report 361 00:14:30,750 --> 00:14:32,700 to try to tell people what happened. 362 00:14:32,700 --> 00:14:33,600 That's a little painful 363 00:14:33,600 --> 00:14:36,840 because you don't revealing the bad things that happen, 364 00:14:36,840 --> 00:14:41,840 but the good that comes out of it outweighs the bad. 365 00:14:42,247 --> 00:14:46,650 And the other thing I think is, this is a global game now 366 00:14:46,650 --> 00:14:50,160 and so things you do are setting a standard 367 00:14:50,160 --> 00:14:52,140 or an expectation with all the partners 368 00:14:52,140 --> 00:14:55,260 and allies and frankly opponents. 369 00:14:55,260 --> 00:14:58,260 And so, it's almost like if you could set up 370 00:14:58,260 --> 00:15:01,320 your organization to play the... 371 00:15:01,320 --> 00:15:04,710 So what does team rule of loss strengths? 372 00:15:04,710 --> 00:15:08,733 Its transparency, its accountability. 373 00:15:10,350 --> 00:15:12,270 Team authoritarian doesn't wanna be transparent, 374 00:15:12,270 --> 00:15:13,530 they don't wanna be accountable. 375 00:15:13,530 --> 00:15:16,020 So it's like the more we can emphasize 376 00:15:16,020 --> 00:15:18,690 and highlight that contrast between both sides, 377 00:15:18,690 --> 00:15:21,150 team undecided in the middle, 378 00:15:21,150 --> 00:15:22,500 they can make a more informed decision 379 00:15:22,500 --> 00:15:25,020 of which team they may be want to associate with. 380 00:15:25,020 --> 00:15:27,000 And so I think the more that you or I 381 00:15:27,000 --> 00:15:30,360 or any of our organizations can operate in a transparent 382 00:15:30,360 --> 00:15:31,740 or an accountable way, 383 00:15:31,740 --> 00:15:34,477 it makes it that much harder for your opponents to say, 384 00:15:34,477 --> 00:15:36,090 "Oh, we're transparent too. 385 00:15:36,090 --> 00:15:37,770 Oh look how accountable we are." 386 00:15:37,770 --> 00:15:40,290 No, we might have other things that are similar, 387 00:15:40,290 --> 00:15:42,480 but draw the contrast. - Yeah. 388 00:15:42,480 --> 00:15:44,100 - And it might be hard for a government to do that 389 00:15:44,100 --> 00:15:46,080 because you you're so used to 390 00:15:46,080 --> 00:15:50,160 all the liability of being transparent, right? 391 00:15:50,160 --> 00:15:51,930 You might have laws against it. 392 00:15:51,930 --> 00:15:52,980 - It's really interesting. 393 00:15:52,980 --> 00:15:57,980 So I spent the first 27 years of my career in the army, 394 00:15:58,841 --> 00:16:02,070 a good portion at the National Security Agency. 395 00:16:02,070 --> 00:16:04,200 I was at the White House under the Bush administration, 396 00:16:04,200 --> 00:16:05,487 then under the Obama administration 397 00:16:05,487 --> 00:16:07,140 and then went off to Morgan Stanley 398 00:16:07,140 --> 00:16:08,580 for four and a half years. 399 00:16:08,580 --> 00:16:10,666 And when you think about the first half 400 00:16:10,666 --> 00:16:15,666 of that being in the intelligence community, 401 00:16:15,870 --> 00:16:19,117 it was a little bit counterintuitive to say, 402 00:16:19,117 --> 00:16:22,050 "Okay, we wanna be really transparent with everything." 403 00:16:22,050 --> 00:16:22,883 - Right. 404 00:16:22,883 --> 00:16:26,100 - Not because we didn't believe in transparency, 405 00:16:26,100 --> 00:16:28,620 but because there's always a fear of sources 406 00:16:28,620 --> 00:16:30,360 and methods getting compromised 407 00:16:30,360 --> 00:16:34,070 and then not being able to do the mission for the nation. 408 00:16:34,070 --> 00:16:37,803 But I think increasingly, and this was after 2013, 409 00:16:38,827 --> 00:16:39,660 (inaudible) 410 00:16:39,660 --> 00:16:41,820 there's a real embrace of transparency 411 00:16:41,820 --> 00:16:45,180 because ultimately government has to be accountable 412 00:16:45,180 --> 00:16:46,740 to the American people. 413 00:16:46,740 --> 00:16:50,100 And so I've seen a very good evolution 414 00:16:50,100 --> 00:16:51,960 in the embrace of transparency. 415 00:16:51,960 --> 00:16:53,970 And frankly at CISA, 416 00:16:53,970 --> 00:16:57,240 because we are such an outward facing agency, 417 00:16:57,240 --> 00:16:59,250 every day is working with private sector, 418 00:16:59,250 --> 00:17:01,350 or state and local, or election officials. 419 00:17:01,350 --> 00:17:03,540 - Right. - It is about... 420 00:17:03,540 --> 00:17:05,340 We know that unless we're transparent, 421 00:17:05,340 --> 00:17:08,700 unless people can understand why we're doing 422 00:17:08,700 --> 00:17:11,040 what we're doing, the products are going out, 423 00:17:11,040 --> 00:17:12,360 we're asking for feedback from them, 424 00:17:12,360 --> 00:17:14,910 unless we're being completely transparent, 425 00:17:14,910 --> 00:17:16,110 the model breaks down. 426 00:17:16,110 --> 00:17:18,510 I don't have a badge where I can show up, 427 00:17:18,510 --> 00:17:20,370 I don't have subpoena power 428 00:17:20,370 --> 00:17:24,780 and so it's all about, "Okay, why should you trust CISA?" 429 00:17:24,780 --> 00:17:27,570 Because we add value, because we're responsive, 430 00:17:27,570 --> 00:17:29,537 because we have great expertise, because we're transparent. 431 00:17:29,537 --> 00:17:33,690 - So it's the all carrots, no sticks kind of. 432 00:17:33,690 --> 00:17:34,523 - Not really. 433 00:17:34,523 --> 00:17:37,860 I mean, we have very, very small regulatory power 434 00:17:37,860 --> 00:17:40,920 on the chemical facilities, anti-terrorism side. 435 00:17:40,920 --> 00:17:41,820 There's a physical... 436 00:17:41,820 --> 00:17:43,890 - But so it has to be voluntary. 437 00:17:43,890 --> 00:17:45,270 - But it's all voluntary, 438 00:17:45,270 --> 00:17:50,270 which frankly, I embrace because I think 439 00:17:50,430 --> 00:17:52,410 if we were a regulator, 440 00:17:52,410 --> 00:17:55,410 we would not be able to create the trust and partnerships. 441 00:17:55,410 --> 00:17:56,595 - You'd be in court every other minute. 442 00:17:56,595 --> 00:17:57,719 You wouldn't get anything done. 443 00:17:57,719 --> 00:17:58,552 - But we did it. 444 00:17:58,552 --> 00:17:59,917 when I was in finance it's not like, 445 00:17:59,917 --> 00:18:02,310 "Hey, let's go rush to tell the regulators 446 00:18:02,310 --> 00:18:03,925 when we (inaudible)." 447 00:18:03,925 --> 00:18:06,210 - Yeah, we discovered something like that. 448 00:18:06,210 --> 00:18:07,590 - And for the stuff that we talk about, 449 00:18:07,590 --> 00:18:08,550 you guys did some great work 450 00:18:08,550 --> 00:18:09,660 and I really want you to talk about this 451 00:18:09,660 --> 00:18:12,000 on coordinated vulnerability disclosure. 452 00:18:12,000 --> 00:18:14,070 You have to have a relationship 453 00:18:14,070 --> 00:18:18,090 where you can have that trust with the researchers, 454 00:18:18,090 --> 00:18:23,070 and then ultimately be able to put information out that is, 455 00:18:23,070 --> 00:18:24,930 people are gonna have confidence in, believe it, 456 00:18:24,930 --> 00:18:27,360 understand it, be able to mitigate vulnerabilities, 457 00:18:27,360 --> 00:18:29,370 and it's just incredibly important. 458 00:18:29,370 --> 00:18:31,500 So can you talk a little bit about the tech? 459 00:18:31,500 --> 00:18:33,303 - Yeah, okay. 460 00:18:34,898 --> 00:18:39,898 So, Jen constituted a security advisory committee for CISA 461 00:18:42,513 --> 00:18:47,070 and it looks at, I think we have what seven or...? 462 00:18:47,070 --> 00:18:49,710 - Oh yeah, probably seven big things. 463 00:18:49,710 --> 00:18:52,290 It's about how do you build the agency? 464 00:18:52,290 --> 00:18:55,050 How do you evolve America's Cyber Defense Agency? 465 00:18:55,050 --> 00:18:57,453 So it's a very eclectic group, 466 00:18:58,410 --> 00:18:59,340 but I really want... 467 00:18:59,340 --> 00:19:00,605 And not everybody's technical. 468 00:19:00,605 --> 00:19:01,920 Some people come from... 469 00:19:01,920 --> 00:19:04,470 - Yeah, you're doing infrastructure, and energy. 470 00:19:04,470 --> 00:19:05,850 and misinformation. 471 00:19:05,850 --> 00:19:06,683 We have different.... 472 00:19:06,683 --> 00:19:07,523 - Finance, energy, exactly. 473 00:19:07,523 --> 00:19:12,210 - Yeah finance and so out of that spectrum of subgroups, 474 00:19:12,210 --> 00:19:14,460 I'm chairing a technical advisory committee. 475 00:19:14,460 --> 00:19:15,870 And the part that was really cool 476 00:19:15,870 --> 00:19:18,630 is I can bring people in from other countries, 477 00:19:18,630 --> 00:19:20,430 clearances aren't necessary, 478 00:19:20,430 --> 00:19:22,170 all of our reports become public 479 00:19:22,170 --> 00:19:24,240 and we just published two reports. 480 00:19:24,240 --> 00:19:25,590 One on threaten intelligence 481 00:19:25,590 --> 00:19:28,119 and one on vulnerability disclosure, 482 00:19:28,119 --> 00:19:32,550 and we'll be producing more reports in the future. 483 00:19:32,550 --> 00:19:34,770 And so I had a lot of leeway 484 00:19:34,770 --> 00:19:39,360 to attract a diverse group of people, 485 00:19:39,360 --> 00:19:41,700 and it's been really amazing 486 00:19:41,700 --> 00:19:44,880 because unlike the big HSAC reports 487 00:19:44,880 --> 00:19:47,040 that would take a long time, and be very large, 488 00:19:47,040 --> 00:19:49,320 and there was no immediate impact, 489 00:19:49,320 --> 00:19:51,720 we delivered our first reports. 490 00:19:51,720 --> 00:19:53,940 They were voted on by the overall committee, 491 00:19:53,940 --> 00:19:55,860 they were approved by the director, 492 00:19:55,860 --> 00:19:57,570 and two weeks later, 493 00:19:57,570 --> 00:19:59,820 we're having calls with people inside CISA 494 00:19:59,820 --> 00:20:04,820 from those teams and threat intel digesting our report, 495 00:20:05,730 --> 00:20:07,530 excited that we've given recommendations, 496 00:20:07,530 --> 00:20:10,680 already making changes inside the organization. 497 00:20:10,680 --> 00:20:11,923 What's going on here? 498 00:20:11,923 --> 00:20:13,247 I'm not used to that. 499 00:20:13,247 --> 00:20:15,000 - That's not your daddy's government. 500 00:20:15,000 --> 00:20:16,560 - No, and they're excited, 501 00:20:16,560 --> 00:20:18,240 and they're like, "Wow, you gave us a great idea, 502 00:20:18,240 --> 00:20:20,610 and that reinforces this other thinking 503 00:20:20,610 --> 00:20:21,930 that we need to tie a connection 504 00:20:21,930 --> 00:20:23,280 between just not the threat intel. 505 00:20:23,280 --> 00:20:26,550 We need to start enriching it with metadata 506 00:20:26,550 --> 00:20:31,550 because the people in OT they wanna know, 507 00:20:32,070 --> 00:20:37,020 do I really have to turn off my vaccine processor 508 00:20:37,020 --> 00:20:38,280 to patch this? 509 00:20:38,280 --> 00:20:41,128 Or can I just put in a firewall rule? 510 00:20:41,128 --> 00:20:44,010 Yes, you said this is a critical nine, 511 00:20:44,010 --> 00:20:46,080 but what does that mean to me?" 512 00:20:46,080 --> 00:20:47,520 And so we want to create, 513 00:20:47,520 --> 00:20:49,890 one of our recommendations was essentially creating a way 514 00:20:49,890 --> 00:20:54,270 to enrich these with metadata in a community portal 515 00:20:54,270 --> 00:20:56,377 where people, the other vaccine manufacturers can say, 516 00:20:56,377 --> 00:20:58,200 "No, no, no, we're running that Phillips gear, 517 00:20:58,200 --> 00:20:59,940 just do this other thing." 518 00:20:59,940 --> 00:21:02,280 And then we're missing that. 519 00:21:02,280 --> 00:21:05,340 And what that does, is without that metadata, 520 00:21:05,340 --> 00:21:07,020 people are frozen with indecision 521 00:21:07,020 --> 00:21:08,700 and they're running all these risks. 522 00:21:08,700 --> 00:21:11,220 So we can speed up that loop, 523 00:21:11,220 --> 00:21:16,020 making the threat intel more valuable, faster. 524 00:21:16,020 --> 00:21:20,190 And so there's other interesting recommendations like that, 525 00:21:20,190 --> 00:21:23,250 but just the speed at which they got it, 526 00:21:23,250 --> 00:21:24,510 and they wanted to implement it. 527 00:21:24,510 --> 00:21:27,660 And so I think for the rest 528 00:21:27,660 --> 00:21:29,850 of the technical advisory committee, 529 00:21:29,850 --> 00:21:32,040 that have never interacted really with government before 530 00:21:32,040 --> 00:21:33,810 there's a lot of them, this is their first chance 531 00:21:33,810 --> 00:21:36,420 ever being on an advisory committee. 532 00:21:36,420 --> 00:21:37,800 It's really empowering to them. 533 00:21:37,800 --> 00:21:39,540 They're really excited. 534 00:21:39,540 --> 00:21:41,130 They listen to us. 535 00:21:41,130 --> 00:21:44,430 They did something, this is not how it's supposed to be. 536 00:21:44,430 --> 00:21:46,500 And I'm hoping that through this experience, 537 00:21:46,500 --> 00:21:48,150 more and more people want to get involved. 538 00:21:48,150 --> 00:21:49,290 And so for example, 539 00:21:49,290 --> 00:21:54,180 we would interview 20 different people on a report. 540 00:21:54,180 --> 00:21:56,130 So even though you're not on the tech, 541 00:21:56,130 --> 00:21:57,570 if you're a subject matter expert 542 00:21:57,570 --> 00:22:00,690 in something we're looking at, we might call you up 543 00:22:00,690 --> 00:22:03,420 and you might come in and give us your opinion. 544 00:22:03,420 --> 00:22:04,253 And because of that, 545 00:22:04,253 --> 00:22:07,260 we get people across the whole industry, 546 00:22:07,260 --> 00:22:10,740 small manufacturers and energy giant 547 00:22:10,740 --> 00:22:13,500 Southern corporation style, huge companies. 548 00:22:13,500 --> 00:22:18,090 And we're really focused on diversity of opinion 549 00:22:18,090 --> 00:22:19,410 because what we're finding too 550 00:22:19,410 --> 00:22:21,210 is there's no one single use case, 551 00:22:21,210 --> 00:22:23,943 especially in vulnerability disclosure. 552 00:22:25,050 --> 00:22:26,910 There's some people that are out of business, 553 00:22:26,910 --> 00:22:29,220 companies are out of business, but they're widely adopted. 554 00:22:29,220 --> 00:22:31,410 How do you disclose that to the manufacturer 555 00:22:31,410 --> 00:22:33,090 if they're gone? 556 00:22:33,090 --> 00:22:34,980 Who can bless that it's okay 557 00:22:34,980 --> 00:22:36,720 for you to reveal that publicly? 558 00:22:36,720 --> 00:22:39,540 There's no law, there's no... 559 00:22:39,540 --> 00:22:41,610 So you can run into these thorny issues 560 00:22:41,610 --> 00:22:46,290 and CISA acting as sort of a governance mediator, 561 00:22:46,290 --> 00:22:49,980 I'll argue that they should take on 562 00:22:49,980 --> 00:22:51,940 more of a coordination role 563 00:22:53,010 --> 00:22:58,010 and get sometimes between the researcher and the company. 564 00:22:58,020 --> 00:22:59,610 Because a lot of researchers, 565 00:22:59,610 --> 00:23:01,590 we don't wanna spend the rest of our lives 566 00:23:01,590 --> 00:23:03,030 arguing with the company. 567 00:23:03,030 --> 00:23:05,700 We found the bug, we want the right thing done, 568 00:23:05,700 --> 00:23:08,640 but I'm not willing to sacrifice three months of pain. 569 00:23:08,640 --> 00:23:10,320 - Yeah, and that's exactly what we're doing. 570 00:23:10,320 --> 00:23:12,390 I mean, we have the platform 571 00:23:12,390 --> 00:23:16,350 and recently we did this for elections actually. 572 00:23:16,350 --> 00:23:17,850 Folks might have seen a report we did 573 00:23:17,850 --> 00:23:22,020 working with a researcher and working with Dominion. 574 00:23:22,020 --> 00:23:24,150 And that was a really complicated, 575 00:23:24,150 --> 00:23:26,037 coordinated vulnerability disclosure. 576 00:23:26,037 --> 00:23:30,450 And so, we spent a lot of rigor, 577 00:23:30,450 --> 00:23:33,270 very deliberate efforts to do that. 578 00:23:33,270 --> 00:23:36,570 And sometimes it's hard to necessarily mediate 579 00:23:36,570 --> 00:23:37,403 the middle of that but... 580 00:23:37,403 --> 00:23:39,127 - And the interesting thing is people say, 581 00:23:39,127 --> 00:23:40,710 "Well, what's the role of government?" 582 00:23:40,710 --> 00:23:42,210 And it seems like role of government 583 00:23:42,210 --> 00:23:46,140 is to get involved in these sticky issues 584 00:23:46,140 --> 00:23:49,290 that don't have a clear business solution. 585 00:23:49,290 --> 00:23:54,180 It's like a conflict between commercial and civil society 586 00:23:54,180 --> 00:23:57,600 and you need a disinterested third party 587 00:23:57,600 --> 00:23:59,787 to make those hard calls on something. 588 00:23:59,787 --> 00:24:01,620 - And disinterested is an important word 589 00:24:01,620 --> 00:24:05,220 because we are only... 590 00:24:05,220 --> 00:24:08,880 I mean, our north star is defense, 591 00:24:08,880 --> 00:24:10,350 which is kind of pure to me. 592 00:24:10,350 --> 00:24:12,314 Having been on the offense side, 593 00:24:12,314 --> 00:24:14,730 I actually like the defense better 594 00:24:14,730 --> 00:24:16,803 and I think defense is the new offense. 595 00:24:17,880 --> 00:24:19,890 But it's a pure mission 596 00:24:19,890 --> 00:24:22,440 and so I think that's really important when you think about, 597 00:24:22,440 --> 00:24:24,990 we are only in it to defend the nation. 598 00:24:24,990 --> 00:24:26,610 But I wanna pick up on something you said, 599 00:24:26,610 --> 00:24:29,940 because this morning I got to just chat 600 00:24:29,940 --> 00:24:31,020 with some of the researchers 601 00:24:31,020 --> 00:24:35,130 that we've built relationships with over the past six months 602 00:24:35,130 --> 00:24:36,720 and it's kind of funny. 603 00:24:36,720 --> 00:24:37,590 The one was Jags. 604 00:24:37,590 --> 00:24:40,816 If you know Jags and then Silas Cutler. 605 00:24:40,816 --> 00:24:41,790 - Yeah, Silas is always fun. 606 00:24:41,790 --> 00:24:43,440 - Yeah, and then I saw Marcus 607 00:24:43,440 --> 00:24:45,780 over at the EFF poker tournament with Kurt. 608 00:24:45,780 --> 00:24:46,890 So that was fun too. 609 00:24:46,890 --> 00:24:50,010 But I met those two guys 610 00:24:50,010 --> 00:24:52,530 because they reached out to me on Twitter. 611 00:24:52,530 --> 00:24:56,310 Actually it was something critical, Jags had some... 612 00:24:56,310 --> 00:25:00,210 He was unhappy about something, decisions we had made 613 00:25:00,210 --> 00:25:03,907 and he just sends me this DMs and I said, 614 00:25:03,907 --> 00:25:06,000 "Well, let me give you a call. 615 00:25:06,000 --> 00:25:07,170 What's your phone number?" 616 00:25:07,170 --> 00:25:08,460 I didn't know who he was but here we are. 617 00:25:08,460 --> 00:25:11,181 - Yeah, you didn't know we all had a (inaudible). 618 00:25:11,181 --> 00:25:13,468 - We talked it out, and actually we talked through it 619 00:25:13,468 --> 00:25:14,301 and he was the one said, 620 00:25:14,301 --> 00:25:15,134 "Well it's..." 621 00:25:15,134 --> 00:25:17,430 'Cause it started out with ignite the hackers, 622 00:25:17,430 --> 00:25:18,990 he's like, "No, what you really need 623 00:25:18,990 --> 00:25:20,610 is this technical advisory council." 624 00:25:20,610 --> 00:25:22,380 And I said, "Well, I've got Jeff Moss." 625 00:25:22,380 --> 00:25:23,430 He's like, "Well, he's fabulous." 626 00:25:23,430 --> 00:25:25,320 I said, "Yes, I know." - Okay. 627 00:25:25,320 --> 00:25:27,780 - But I am such a fan 628 00:25:27,780 --> 00:25:30,270 of the incredible power of researchers. 629 00:25:30,270 --> 00:25:31,219 - Yeah, the community. 630 00:25:31,219 --> 00:25:32,580 - I've seen the power on the government side, 631 00:25:32,580 --> 00:25:34,980 but on the private sector side, 632 00:25:34,980 --> 00:25:39,630 I mean, we are really leaning into working with everybody 633 00:25:39,630 --> 00:25:41,250 who wants to be part of this community. 634 00:25:41,250 --> 00:25:45,180 And Silas worked with us on the Maui ransomware report 635 00:25:45,180 --> 00:25:48,600 that we did doing some fantastic reverse engineering. 636 00:25:48,600 --> 00:25:52,680 Jags worked with us on the Hermetic Wiper stuff for Ukraine. 637 00:25:52,680 --> 00:25:55,560 And so, these types of collaborations 638 00:25:55,560 --> 00:25:59,130 are just so absolutely critical 639 00:25:59,130 --> 00:26:01,050 And I think we're making some really good progress. 640 00:26:01,050 --> 00:26:02,010 - So talk a little bit... 641 00:26:02,010 --> 00:26:06,023 I'm always curious on CISA's it's global nature, 642 00:26:06,023 --> 00:26:09,873 when you're talking to our partners or others, 643 00:26:11,238 --> 00:26:13,800 do they come up and say, "Hey, how is this working?" 644 00:26:13,800 --> 00:26:15,450 Are they lessons that can be imitated, 645 00:26:15,450 --> 00:26:18,360 or is the society so different 646 00:26:18,360 --> 00:26:20,970 that it's kind of like a unicorn? 647 00:26:20,970 --> 00:26:22,500 - Yeah, other feds you mean? 648 00:26:22,500 --> 00:26:24,450 - Yeah, or other countries like Australia, UK, 649 00:26:24,450 --> 00:26:25,443 anywhere, European. 650 00:26:26,681 --> 00:26:29,640 I saw you signing an MOU with Ukraine. 651 00:26:29,640 --> 00:26:30,473 - With Ukraine, yeah. 652 00:26:30,473 --> 00:26:31,802 It's like (inaudible), yeah. 653 00:26:31,802 --> 00:26:34,350 - So what is the MOU? 654 00:26:34,350 --> 00:26:37,260 How do they see CISA a in the US government, 655 00:26:37,260 --> 00:26:39,630 it's not an MOU with FBI or NSA, right? 656 00:26:39,630 --> 00:26:41,010 It's the defensive agency. 657 00:26:41,010 --> 00:26:43,410 - It's all defense, but that's the beauty of it 658 00:26:43,410 --> 00:26:47,643 because every country has different things on encryption. 659 00:26:48,510 --> 00:26:50,010 Different things in terms of authorities 660 00:26:50,010 --> 00:26:51,720 they can do on the offensive side, 661 00:26:51,720 --> 00:26:53,160 different things that they're doing 662 00:26:53,160 --> 00:26:54,540 on the foreign in intelligence side. 663 00:26:54,540 --> 00:26:58,170 But defense is pretty much the same around the world 664 00:26:58,170 --> 00:27:00,210 and so we have fantastic relationships 665 00:27:00,210 --> 00:27:01,950 with over 100 CERTs, 666 00:27:01,950 --> 00:27:05,070 'cause we're US-CERT and ICS CERT. 667 00:27:05,070 --> 00:27:06,510 We have what's called 668 00:27:06,510 --> 00:27:08,430 the International Watch and Warning Network, 669 00:27:08,430 --> 00:27:10,890 which is 16 nations across the country, 670 00:27:10,890 --> 00:27:14,700 really terrific information sharing partnerships. 671 00:27:14,700 --> 00:27:16,560 And then of course we're very, very close 672 00:27:16,560 --> 00:27:18,150 with all of our 5i's partners. 673 00:27:18,150 --> 00:27:20,820 And so, the international piece is fantastic. 674 00:27:20,820 --> 00:27:22,530 Whenever we talk about the JCDC, 675 00:27:22,530 --> 00:27:25,024 we lean into the private sector part, 676 00:27:25,024 --> 00:27:29,610 but the JCDC includes all of our international relationships 677 00:27:29,610 --> 00:27:33,630 to include Ukraine, and we had this terrific as you said, 678 00:27:33,630 --> 00:27:35,790 meeting with the sort of four different agencies 679 00:27:35,790 --> 00:27:36,870 across Ukraine. 680 00:27:36,870 --> 00:27:38,790 We did this memorandum of cooperation, 681 00:27:38,790 --> 00:27:41,250 which is really about capacity building 682 00:27:41,250 --> 00:27:45,150 as well as ways to more actually share information. 683 00:27:45,150 --> 00:27:46,770 - Is there the equivalent of a, 684 00:27:46,770 --> 00:27:49,110 if you see something, say something 685 00:27:49,110 --> 00:27:51,630 sort of we're the US government, we see something, 686 00:27:51,630 --> 00:27:53,820 we're gonna say something in the UK or Ukraine. 687 00:27:53,820 --> 00:27:55,020 Is there sort of that kind of...? 688 00:27:55,020 --> 00:27:57,067 - Yeah, a hundred percent. - Yeah. 689 00:27:57,067 --> 00:28:01,470 - Obviously if there's an imminent threat we will, 690 00:28:01,470 --> 00:28:03,240 whether it's private sector or whatever, 691 00:28:03,240 --> 00:28:05,790 we have an obligation to ensure 692 00:28:05,790 --> 00:28:08,010 that we are getting that information out. 693 00:28:08,010 --> 00:28:11,100 But sometimes it's just dots, suspicious (inaudible). 694 00:28:11,100 --> 00:28:13,080 - Only in hindsight. 695 00:28:13,080 --> 00:28:17,723 - And so we will always lean forward because we think. 696 00:28:17,723 --> 00:28:19,890 - So it's a bias toward... 697 00:28:19,890 --> 00:28:21,750 - It's always a bias towards action 698 00:28:21,750 --> 00:28:24,120 and we'd much rather be in the proactive space 699 00:28:24,120 --> 00:28:27,690 than in the reactive space because left of boom 700 00:28:27,690 --> 00:28:30,300 is better than right of boom, which is right. 701 00:28:30,300 --> 00:28:31,920 The name of the game is resilience. 702 00:28:31,920 --> 00:28:36,920 But a great example is Albania. 703 00:28:37,530 --> 00:28:40,680 The whole thing happened that came out 704 00:28:40,680 --> 00:28:45,680 and we have a good relationship with their CERT. 705 00:28:45,900 --> 00:28:50,460 And so we were able to help them based on researchers 706 00:28:50,460 --> 00:28:53,040 that came in to work with the JCDC 707 00:28:53,040 --> 00:28:55,830 to do some malware analysis 708 00:28:55,830 --> 00:28:59,700 and to give back some really important information to them. 709 00:28:59,700 --> 00:29:03,210 And so it's really this community coming together 710 00:29:03,210 --> 00:29:05,130 for the global defense. 711 00:29:05,130 --> 00:29:06,840 - Well, that was... 712 00:29:06,840 --> 00:29:08,190 There's so much to talk about, man. 713 00:29:08,190 --> 00:29:09,570 We could have beers, we could beer on that. 714 00:29:09,570 --> 00:29:10,950 - We have to ask questions. 715 00:29:10,950 --> 00:29:11,820 Did you say beers? 716 00:29:11,820 --> 00:29:13,047 - Yeah, I wish we had some beers. 717 00:29:13,047 --> 00:29:13,893 - Oh. - Yeah. 718 00:29:14,880 --> 00:29:15,713 'Cause I can drink. 719 00:29:15,713 --> 00:29:17,710 I don't know if you're technically on duty, but... 720 00:29:17,710 --> 00:29:19,890 - Yeah, I stopped drinking in 2021, 721 00:29:19,890 --> 00:29:21,452 which I think was a bad idea. 722 00:29:21,452 --> 00:29:23,910 (all laughing) 723 00:29:23,910 --> 00:29:24,743 - Yeah, that's good. 724 00:29:24,743 --> 00:29:26,640 Let's go for a question or two. 725 00:29:26,640 --> 00:29:27,870 But I wanted to get back. 726 00:29:27,870 --> 00:29:30,420 Your north star, you said that core principle, 727 00:29:30,420 --> 00:29:34,150 where a Hackathon CISA is a defense organization 728 00:29:35,430 --> 00:29:39,540 and you are what defend today, protect the... 729 00:29:39,540 --> 00:29:40,800 - Well, Chris and I talk about this. 730 00:29:40,800 --> 00:29:43,440 It started out at defend today, secure tomorrow. 731 00:29:43,440 --> 00:29:46,380 - Secure tomorrow to sort show put out today's fires- 732 00:29:46,380 --> 00:29:47,940 - Yeah, and secure the future. 733 00:29:47,940 --> 00:29:49,607 - But think longer term. 734 00:29:49,607 --> 00:29:52,303 - Sure, I mean, the emerging tech piece 735 00:29:52,303 --> 00:29:54,120 is we do the quantum piece as you know, 736 00:29:54,120 --> 00:29:56,367 a lot of work on that with NSA and NIST 737 00:29:56,367 --> 00:30:01,367 and focus on 60, focus on security of smart cities. 738 00:30:01,680 --> 00:30:02,859 And so we're working... 739 00:30:02,859 --> 00:30:04,230 - So there's this longer term perspective. 740 00:30:04,230 --> 00:30:05,394 - Yeah. 741 00:30:05,394 --> 00:30:06,227 - You're not just a firefighting agency. 742 00:30:06,227 --> 00:30:07,350 - No and we don't wanna be. 743 00:30:07,350 --> 00:30:11,250 We wanna actually ensure that all of our partners 744 00:30:11,250 --> 00:30:15,270 are building resilience into their systems. 745 00:30:15,270 --> 00:30:16,770 And that's one thing. 746 00:30:16,770 --> 00:30:19,039 From a tech perspective, we we've talked about this 747 00:30:19,039 --> 00:30:21,870 at the Cybersecurity Advisory Committee. 748 00:30:21,870 --> 00:30:23,460 I spend a lot of time talking about things 749 00:30:23,460 --> 00:30:25,290 like multifactor authentication, 750 00:30:25,290 --> 00:30:28,290 more than a password and all the basics. 751 00:30:28,290 --> 00:30:29,970 But what I think we need to do 752 00:30:29,970 --> 00:30:32,760 is ensure that the big technology companies 753 00:30:32,760 --> 00:30:35,340 are actually taking accountability 754 00:30:35,340 --> 00:30:37,710 for breaking the security into their systems- 755 00:30:37,710 --> 00:30:38,910 - It drives crazy. 756 00:30:38,910 --> 00:30:40,410 - So users don't have to actually 757 00:30:40,410 --> 00:30:41,430 ultimately worry about the (inaudible). 758 00:30:41,430 --> 00:30:43,260 - Well, the people I think most responsible 759 00:30:43,260 --> 00:30:45,720 are the people closest to the levers of power. 760 00:30:45,720 --> 00:30:48,210 And if you're the manufacturer, you're Microsoft, 761 00:30:48,210 --> 00:30:49,680 not to beat on them, they do a great job, 762 00:30:49,680 --> 00:30:50,730 but if you're Microsoft, 763 00:30:50,730 --> 00:30:52,680 you are in the best position to make the correction, 764 00:30:52,680 --> 00:30:54,480 not a third party piece of software 765 00:30:54,480 --> 00:30:56,850 to run on top of your operating system. 766 00:30:56,850 --> 00:31:00,570 And so I think there's that responsibility there 767 00:31:00,570 --> 00:31:03,381 and they've been acknowledging in Apple and Google. 768 00:31:03,381 --> 00:31:05,730 But I really think that the more that can be done 769 00:31:05,730 --> 00:31:07,890 at close to where the problem is, 770 00:31:07,890 --> 00:31:09,420 that frees us up to do... 771 00:31:09,420 --> 00:31:10,530 - Hundred percent. 772 00:31:10,530 --> 00:31:12,990 And I think they're recognizing that as well. 773 00:31:12,990 --> 00:31:14,820 I mean, part of the executive order last year 774 00:31:14,820 --> 00:31:18,750 was to signal that use of the government's purchasing power. 775 00:31:18,750 --> 00:31:20,700 So if you have contracts with the government, 776 00:31:20,700 --> 00:31:24,360 some of these requirements 777 00:31:24,360 --> 00:31:27,360 will become necessary to do business. 778 00:31:27,360 --> 00:31:29,468 - You must be this tall to sell the government. 779 00:31:29,468 --> 00:31:30,301 - Yeah, sort of. 780 00:31:30,301 --> 00:31:32,280 Exactly, so we're getting there. 781 00:31:32,280 --> 00:31:35,040 And then your other point about the federal partners. 782 00:31:35,040 --> 00:31:37,920 I think the other really cool thing about the JCDC is, 783 00:31:37,920 --> 00:31:41,370 it's the only federal cyber entity that by law 784 00:31:41,370 --> 00:31:46,230 brings in CISA, NSA, FBI, DOD, DOJ, ODNI, 785 00:31:46,230 --> 00:31:48,000 the National Cyber Director Secret Service. 786 00:31:48,000 --> 00:31:50,400 So by law all on one platform. 787 00:31:50,400 --> 00:31:51,840 So we stood this (inaudible). 788 00:31:51,840 --> 00:31:53,280 - Different than a fusion center, right? 789 00:31:53,280 --> 00:31:55,503 - Exactly, we stood this thing up, but it's not CISA's. 790 00:31:55,503 --> 00:31:59,370 It's a platform where industry can come to government 791 00:31:59,370 --> 00:32:03,210 and not have to have that PhD in government 792 00:32:03,210 --> 00:32:05,238 to figure out how to interact. 793 00:32:05,238 --> 00:32:06,684 - Right. 794 00:32:06,684 --> 00:32:08,373 Okay, let's go for some question guys. 795 00:32:08,373 --> 00:32:09,206 - Any question. 796 00:32:09,206 --> 00:32:13,073 - Who's got a question? - Who's got a question? 797 00:32:13,073 --> 00:32:15,195 - [Audience 2] CISA can influence 798 00:32:15,195 --> 00:32:16,259 how Congress appropriates money 799 00:32:16,259 --> 00:32:19,315 to go to the state locals for cyber security? 800 00:32:19,315 --> 00:32:20,613 - Yeah. - Okay, repeat the question. 801 00:32:20,613 --> 00:32:21,446 - Yeah, the question, 802 00:32:21,446 --> 00:32:25,800 can we influence how money goes to state and locals? 803 00:32:25,800 --> 00:32:30,800 And certainly I have to say, we have been really blessed 804 00:32:31,860 --> 00:32:35,280 in terms of our engagement with the Congress. 805 00:32:35,280 --> 00:32:39,870 Cyber security happily is still a very bipartisan issue. 806 00:32:39,870 --> 00:32:41,910 And so when I go up on the hill, 807 00:32:41,910 --> 00:32:43,890 whether it's to talk about my budget, 808 00:32:43,890 --> 00:32:47,403 whether it's to testify, just an update on what we're doing, 809 00:32:48,240 --> 00:32:51,090 the questions that I routinely get 810 00:32:51,090 --> 00:32:53,100 from the House and the Senate are, 811 00:32:53,100 --> 00:32:54,810 what more can we do for you? 812 00:32:54,810 --> 00:32:55,643 Which is not the question 813 00:32:55,643 --> 00:32:57,840 that you will always get from Congress. 814 00:32:57,840 --> 00:33:00,990 And so that's actually really, really encouraging. 815 00:33:00,990 --> 00:33:03,810 And one of the things that I talk about the most 816 00:33:03,810 --> 00:33:06,840 are the importance of us being able to work closely 817 00:33:06,840 --> 00:33:10,410 with state and local to do all kinds of security, 818 00:33:10,410 --> 00:33:12,720 but a lot of focus on election security. 819 00:33:12,720 --> 00:33:16,740 And so we are always advocating for state and local 820 00:33:16,740 --> 00:33:18,870 and the grant program that we're about to do, 821 00:33:18,870 --> 00:33:22,710 the NOFO, Notice Of Funding Opportunity, 822 00:33:22,710 --> 00:33:24,930 I think will be really, really important 823 00:33:24,930 --> 00:33:25,763 for state and local. 824 00:33:25,763 --> 00:33:26,850 I thought it was great. 825 00:33:26,850 --> 00:33:29,460 That was in the last package, billion dollars, 826 00:33:29,460 --> 00:33:32,370 200 million this year, hugely important. 827 00:33:32,370 --> 00:33:35,430 And the other thing is, two other things, 828 00:33:35,430 --> 00:33:38,010 so we are over the next few years 829 00:33:38,010 --> 00:33:40,275 really growing our field force, 830 00:33:40,275 --> 00:33:42,930 it's one of the things I'm most excited about 831 00:33:42,930 --> 00:33:46,110 to have more folks out all across nation. 832 00:33:46,110 --> 00:33:48,000 - Out the beltway. - Yeah, exactly. 833 00:33:48,000 --> 00:33:50,730 It's where I love to be, out the beltway. 834 00:33:50,730 --> 00:33:52,710 Working with state and local. 835 00:33:52,710 --> 00:33:55,350 We've got cybersecurity coordinators 836 00:33:55,350 --> 00:33:58,890 working with every state CISO, state CIO. 837 00:33:58,890 --> 00:34:01,110 And so we're really gonna dig into that. 838 00:34:01,110 --> 00:34:04,980 I've got my cyber security advisor for Region 9, 839 00:34:04,980 --> 00:34:07,350 which is based out of California, Joe Oregon, 840 00:34:07,350 --> 00:34:10,830 I think he's in here and David Rosado heads that. 841 00:34:10,830 --> 00:34:13,290 But we are totally leaning in on that. 842 00:34:13,290 --> 00:34:16,410 So, please continue to give us feedback. 843 00:34:16,410 --> 00:34:18,330 The other thing, we're trying to be creative 844 00:34:18,330 --> 00:34:22,770 in terms of first, how we help small businesses, 845 00:34:22,770 --> 00:34:25,915 because they are really, as Josh Corman would say, 846 00:34:25,915 --> 00:34:29,370 often in the space of being target rich, resource poor. 847 00:34:29,370 --> 00:34:30,990 And so we've done a lot of work 848 00:34:30,990 --> 00:34:33,570 in terms of how do we break things down 849 00:34:33,570 --> 00:34:35,280 to make it simple for small business 850 00:34:35,280 --> 00:34:38,490 to be able to protect itself knowing that the median side 851 00:34:38,490 --> 00:34:40,410 of a small business is 10 people. 852 00:34:40,410 --> 00:34:43,170 And so small businesses are out in everybody's jurisdiction. 853 00:34:43,170 --> 00:34:44,518 And then also try and be creative. 854 00:34:44,518 --> 00:34:47,070 We were as part of the committee working 855 00:34:47,070 --> 00:34:51,420 this really cool pilot, like a town gown, right? 856 00:34:51,420 --> 00:34:52,530 It's awesome. 857 00:34:52,530 --> 00:34:55,260 This town gown pilot in Austin 858 00:34:55,260 --> 00:34:57,960 with Mayor Steve Adler and Bobby Chesney, 859 00:34:57,960 --> 00:35:00,000 who they're both on our board to try and... 860 00:35:00,000 --> 00:35:00,850 - He made these shirts, so I wear him. 861 00:35:00,850 --> 00:35:02,157 - Yeah, Bobby made these shirts. 862 00:35:02,157 --> 00:35:06,840 And so, what we're trying to do is Austin has this 311 863 00:35:06,840 --> 00:35:10,060 so people can call and if they've got an issue 864 00:35:10,980 --> 00:35:12,780 somebody's on the other end of the phone to help them. 865 00:35:12,780 --> 00:35:15,000 They turned out they get a lot of calls about cyber stuff 866 00:35:15,000 --> 00:35:18,330 and so now we're gonna have students on the other end 867 00:35:18,330 --> 00:35:21,630 who are gonna be trained to how to respond to things, 868 00:35:21,630 --> 00:35:23,880 and then that will also help them get experience. 869 00:35:23,880 --> 00:35:25,607 - It's the cyber 911. 870 00:35:25,607 --> 00:35:27,658 And so 81161, you can call 111- 871 00:35:27,658 --> 00:35:29,010 - Exactly. - And get some help. 872 00:35:29,010 --> 00:35:32,340 - So creative ways to build the bench 873 00:35:32,340 --> 00:35:35,190 throughout the nation and to raise skills. 874 00:35:35,190 --> 00:35:36,290 - One of the things... 875 00:35:37,740 --> 00:35:40,890 Lots of acronyms at DHS, but one of the things I like 876 00:35:40,890 --> 00:35:43,080 is it's a ground up organization, grassroots, 877 00:35:43,080 --> 00:35:45,090 it comes state, local. 878 00:35:45,090 --> 00:35:46,500 But there's acronym SLTT, 879 00:35:46,500 --> 00:35:49,110 state, local tribal, and territorial 880 00:35:49,110 --> 00:35:52,920 because we are more than a nation of states. 881 00:35:52,920 --> 00:35:56,595 And I always respected that because it was always the SLTT 882 00:35:56,595 --> 00:35:59,790 because you never hear people talk about the tribes 883 00:35:59,790 --> 00:36:00,810 and the territories. 884 00:36:00,810 --> 00:36:02,760 I mean, some presidents don't even know 885 00:36:02,760 --> 00:36:04,590 that we have territories. (audience laughing) 886 00:36:04,590 --> 00:36:07,470 And so it's confusing, I understand. 887 00:36:07,470 --> 00:36:10,530 But so it's really nice to see the DHS 888 00:36:10,530 --> 00:36:13,722 really recognize that, no, it's all Americans. 889 00:36:13,722 --> 00:36:15,360 - Yeah. 890 00:36:15,360 --> 00:36:16,193 - This gentleman here, 891 00:36:16,193 --> 00:36:17,850 and then we'll go over to this gentleman here. 892 00:36:17,850 --> 00:36:18,810 - [Audience 2] Hi, thank you guys. 893 00:36:18,810 --> 00:36:22,470 My question actually was about what you just talked about 894 00:36:22,470 --> 00:36:24,390 and that is, what can government do 895 00:36:24,390 --> 00:36:26,310 to help protect private enterprise? 896 00:36:26,310 --> 00:36:29,400 So me personally, my colleague and I 897 00:36:29,400 --> 00:36:31,847 work for a family-owned company. 898 00:36:31,847 --> 00:36:32,822 We're relatively large 899 00:36:32,822 --> 00:36:35,749 and we're an (inaudible) spending portion of budget 900 00:36:35,749 --> 00:36:36,899 on cybersecurity tools, 901 00:36:38,160 --> 00:36:41,910 whether it's software services, SOC as a service. 902 00:36:41,910 --> 00:36:43,860 We don't have our own fire department. 903 00:36:43,860 --> 00:36:45,260 We don't have our own police department. 904 00:36:45,260 --> 00:36:47,183 We don't have our north. 905 00:36:47,183 --> 00:36:49,563 Yet you now have had to (inaudible) 906 00:36:49,563 --> 00:36:52,207 many that create our own. 907 00:36:52,207 --> 00:36:53,490 And so my question to you is, 908 00:36:53,490 --> 00:36:54,630 has there been discussions about 909 00:36:54,630 --> 00:36:56,910 the role government can play, 910 00:36:56,910 --> 00:37:00,090 whether it's federal or at the state local? 911 00:37:00,090 --> 00:37:02,430 I think you gave some great examples, 912 00:37:02,430 --> 00:37:05,010 but where it's security as a service, 913 00:37:05,010 --> 00:37:09,150 almost like a tax dollar funded provided service 914 00:37:09,150 --> 00:37:11,259 that a company can sign up for 915 00:37:11,259 --> 00:37:14,270 or the government is watching it for them 916 00:37:14,270 --> 00:37:16,470 and notifying them, the small and medium size business. 917 00:37:16,470 --> 00:37:21,470 - Yep, so if you are a critical infrastructure, 918 00:37:21,660 --> 00:37:25,050 and I don't know if there are actually some small entities 919 00:37:25,050 --> 00:37:26,700 that are critical infrastructure, 920 00:37:27,630 --> 00:37:29,130 that is part of our core mission. 921 00:37:29,130 --> 00:37:31,650 We are working with businesses large and small 922 00:37:31,650 --> 00:37:33,450 as part of critical infrastructure 923 00:37:33,450 --> 00:37:36,330 to ensure that they have tools and services. 924 00:37:36,330 --> 00:37:39,360 And frankly, a lot of our stuff is free, 925 00:37:39,360 --> 00:37:42,240 which is a great four letter word. 926 00:37:42,240 --> 00:37:44,640 So you think about, 927 00:37:44,640 --> 00:37:47,220 and I would invite you to take a look at our website 928 00:37:47,220 --> 00:37:48,780 because a lot of that information is there 929 00:37:48,780 --> 00:37:51,150 and we just updated what we call 930 00:37:51,150 --> 00:37:53,430 a Small Business Cyber Security Action Plan, 931 00:37:53,430 --> 00:37:55,980 'cause we wanted to break it down as simple as possible, 932 00:37:55,980 --> 00:37:59,010 and then provide all of our no cost services. 933 00:37:59,010 --> 00:38:01,230 Some of the stuff is pro bono provided 934 00:38:01,230 --> 00:38:03,360 from our industry JCDC partners. 935 00:38:03,360 --> 00:38:06,000 So we realize that small businesses 936 00:38:06,000 --> 00:38:08,730 and small entities don't have the wherewithal 937 00:38:08,730 --> 00:38:10,590 to create these huge security teams 938 00:38:10,590 --> 00:38:12,540 like I had it at Morgan Stanley. 939 00:38:12,540 --> 00:38:15,030 And so we're spending a lot of time again, 940 00:38:15,030 --> 00:38:17,760 trying to make sure that the resources are out there 941 00:38:17,760 --> 00:38:20,970 and broken down in a way that all businesses 942 00:38:20,970 --> 00:38:22,020 can avail themselves. 943 00:38:22,020 --> 00:38:25,230 And so I would say follow up with us 944 00:38:25,230 --> 00:38:27,480 because I'm really interested in particular 945 00:38:27,480 --> 00:38:30,720 in feedback on what we're doing with small businesses, 946 00:38:30,720 --> 00:38:33,060 because the other part of critical infrastructure 947 00:38:33,060 --> 00:38:35,790 is now it's also a blurry line 948 00:38:35,790 --> 00:38:37,680 because just given the interdependencies 949 00:38:37,680 --> 00:38:40,980 on the supply chain, you might not be the classic member 950 00:38:40,980 --> 00:38:42,090 of critical infrastructure, 951 00:38:42,090 --> 00:38:44,280 but you could very well be a vendor 952 00:38:44,280 --> 00:38:45,780 for that critical infrastructure. 953 00:38:45,780 --> 00:38:47,130 So what we're really trying to do 954 00:38:47,130 --> 00:38:50,190 is have a very large blanket across the country 955 00:38:50,190 --> 00:38:52,440 as we continue to grow our own capability 956 00:38:52,440 --> 00:38:54,513 as America's Cyber Defense Agency. 957 00:38:55,620 --> 00:38:57,330 - This gentleman over here. 958 00:38:57,330 --> 00:39:00,600 - [Audience 3] At Black Head your predecessor, Chris Krebs 959 00:39:00,600 --> 00:39:03,780 talked about separating CISA from DHS 960 00:39:03,780 --> 00:39:06,808 as a sub cabinet agency. 961 00:39:06,808 --> 00:39:08,255 What do you see the pros and cons 962 00:39:08,255 --> 00:39:12,220 of making a move like that or a recommendation that. 963 00:39:12,220 --> 00:39:13,775 - Repeat the question. 964 00:39:13,775 --> 00:39:14,608 Or I can... 965 00:39:14,608 --> 00:39:16,830 He asked, Chris Krebs and Black Hat 966 00:39:16,830 --> 00:39:18,690 was talking about several different things 967 00:39:18,690 --> 00:39:20,070 that could be improvements, 968 00:39:20,070 --> 00:39:21,630 and one of the suggestions he's had 969 00:39:21,630 --> 00:39:23,937 was potentially separating CISA 970 00:39:23,937 --> 00:39:26,040 and creating its own standalone. 971 00:39:26,040 --> 00:39:28,230 And the question is, what are the pros, what are the cons? 972 00:39:28,230 --> 00:39:31,830 - Yeah, I mean, I think over the last two decades, 973 00:39:31,830 --> 00:39:33,870 when I think about federal cyber security, 974 00:39:33,870 --> 00:39:37,500 there's probably two big things that happened 975 00:39:37,500 --> 00:39:40,140 that have really helped to change the landscape 976 00:39:40,140 --> 00:39:42,780 in terms of America's capability. 977 00:39:42,780 --> 00:39:45,120 One was on the offensive side, 978 00:39:45,120 --> 00:39:47,400 and that's when we stood up US Cyber Command. 979 00:39:47,400 --> 00:39:50,400 So that was Paul Nakasone, TJ White 980 00:39:50,400 --> 00:39:52,950 working with Keith Alexander (inaudible), 981 00:39:52,950 --> 00:39:55,260 and I think that was a really important capability 982 00:39:55,260 --> 00:39:59,910 that now 10 years on is making a real difference. 983 00:39:59,910 --> 00:40:01,980 And I think the most important thing 984 00:40:01,980 --> 00:40:03,540 that happened in the last five years 985 00:40:03,540 --> 00:40:07,233 was the establishment CISA in 2018, 986 00:40:08,640 --> 00:40:10,770 which really proved that a name change 987 00:40:10,770 --> 00:40:12,660 and more money and more authorities 988 00:40:12,660 --> 00:40:14,190 can make a real difference. 989 00:40:14,190 --> 00:40:16,470 I still have NPPD. 990 00:40:16,470 --> 00:40:17,730 - NPPD, right? 991 00:40:17,730 --> 00:40:19,740 - There's no infrastructure in there or even cyber. 992 00:40:19,740 --> 00:40:23,460 And so building a cyber and infrastructure security agency 993 00:40:23,460 --> 00:40:25,260 I think was critical. 994 00:40:25,260 --> 00:40:27,240 And then following onto that, 995 00:40:27,240 --> 00:40:29,340 there were actually organizational changes 996 00:40:29,340 --> 00:40:32,130 and more authorities that came with the NDAA 997 00:40:32,130 --> 00:40:34,710 2021 out of the cyber space delirium. 998 00:40:34,710 --> 00:40:36,630 One of the things was, 999 00:40:36,630 --> 00:40:38,580 it was called the Joint Cyber Planning Office, 1000 00:40:38,580 --> 00:40:41,850 but JCPO sounded like a disease and a horrible acronym, 1001 00:40:41,850 --> 00:40:44,820 which is why JCDC 'cause it sounds like ACDC. 1002 00:40:46,425 --> 00:40:48,202 - And who can argue with ACDC? 1003 00:40:48,202 --> 00:40:49,530 - Who can argue with ACDC? 1004 00:40:49,530 --> 00:40:51,480 Exactly, right? 1005 00:40:51,480 --> 00:40:54,597 So, so many really important things have happened, 1006 00:40:54,597 --> 00:40:59,490 and my job, Tommy is to make sure that I am all in 1007 00:40:59,490 --> 00:41:03,840 on what we are doing now and I don't, well... 1008 00:41:03,840 --> 00:41:05,610 - If you split it off, 1009 00:41:05,610 --> 00:41:07,920 it's unclear what the benefits are immediately. 1010 00:41:07,920 --> 00:41:11,070 So I can see the turmoil and the bureaucratic churn 1011 00:41:11,070 --> 00:41:12,840 and the fighting for budgets and turf, 1012 00:41:12,840 --> 00:41:16,053 and even the concern would be, 1013 00:41:17,107 --> 00:41:19,320 "Oh, well we've got an agency for that. 1014 00:41:19,320 --> 00:41:20,340 They're in charge now. 1015 00:41:20,340 --> 00:41:22,770 Oh, I'm OMB, I don't have to do that. 1016 00:41:22,770 --> 00:41:24,300 That's their problem." 1017 00:41:24,300 --> 00:41:26,227 And so it's like, 1018 00:41:26,227 --> 00:41:28,380 "Okay, well if we put up with all that churn, 1019 00:41:28,380 --> 00:41:31,170 but there better be a really big golden egg 1020 00:41:31,170 --> 00:41:32,599 at the end of that." 1021 00:41:32,599 --> 00:41:34,350 And I don't know what the golden egg would be. 1022 00:41:34,350 --> 00:41:37,500 - I think CISA, I feel like we're a golden egg, right? 1023 00:41:37,500 --> 00:41:40,516 - You're right. (Black chuckles) 1024 00:41:40,516 --> 00:41:42,780 - And the other thing is there are benefits 1025 00:41:42,780 --> 00:41:47,700 to us being part of DHS in terms of having that connection 1026 00:41:47,700 --> 00:41:50,280 to my friend, Dave Pekoske TSA, 1027 00:41:50,280 --> 00:41:51,960 from an aviation security. 1028 00:41:51,960 --> 00:41:54,390 Deanne Criswell from a FEMA perspective. 1029 00:41:54,390 --> 00:41:57,030 So they're important connectivity, 1030 00:41:57,030 --> 00:41:58,770 secret service that we've got there 1031 00:41:58,770 --> 00:42:00,720 to have these colleagues around the table 1032 00:42:00,720 --> 00:42:02,520 as fellow components. 1033 00:42:02,520 --> 00:42:06,030 But I am laser focused on building 1034 00:42:06,030 --> 00:42:07,740 America's Cyber Defense Agency 1035 00:42:07,740 --> 00:42:10,980 to be the agency that America deserves. 1036 00:42:10,980 --> 00:42:15,980 And that's no small endeavor as you know given your role. 1037 00:42:17,010 --> 00:42:17,843 - So, yeah. 1038 00:42:17,843 --> 00:42:20,640 I'm not sure, it's not clear to me 1039 00:42:20,640 --> 00:42:21,930 and it sounds like it's not clear to Jen 1040 00:42:21,930 --> 00:42:23,340 what the benefit would be. 1041 00:42:23,340 --> 00:42:24,810 I just see economic. 1042 00:42:24,810 --> 00:42:27,240 I mean, I just see bureaucratic churn, 1043 00:42:27,240 --> 00:42:30,240 but I like the big thinking. 1044 00:42:30,240 --> 00:42:34,023 But it's not the time now, I don't think. 1045 00:42:35,056 --> 00:42:39,250 Gentlemen in the back and then in the front. 1046 00:42:39,250 --> 00:42:40,437 - [Audience 4] So obviously, you guys are doing a lot 1047 00:42:40,437 --> 00:42:41,673 and we appreciate it. 1048 00:42:42,960 --> 00:42:46,740 Historically, government has always been one way 1049 00:42:46,740 --> 00:42:49,290 capable of communicating community. 1050 00:42:49,290 --> 00:42:50,344 It's very... 1051 00:42:50,344 --> 00:42:51,360 - The FBI problem. 1052 00:42:51,360 --> 00:42:53,549 We'll listen, but never talk. 1053 00:42:53,549 --> 00:42:55,830 - [Audience 3] So what can the community here do 1054 00:42:55,830 --> 00:43:00,684 to help CISA and the nations pull beyond DMs and Twitter 1055 00:43:00,684 --> 00:43:01,830 (Jen and Black laughing) 1056 00:43:01,830 --> 00:43:04,410 help with the problems that we have? 1057 00:43:04,410 --> 00:43:08,250 - Yeah, first of all, thank you for asking that question, 1058 00:43:08,250 --> 00:43:11,640 'cause I think it's exactly the right question 1059 00:43:11,640 --> 00:43:12,570 we should be asking. 1060 00:43:12,570 --> 00:43:16,230 What can we do to help and what can you do to help us? 1061 00:43:16,230 --> 00:43:20,160 So I think the DMs and Twitter is emblematic 1062 00:43:20,160 --> 00:43:24,480 of what folks probably thought 1063 00:43:24,480 --> 00:43:26,047 about the federal government. 1064 00:43:26,047 --> 00:43:29,310 "Hey, these are just people kind of making decisions 1065 00:43:29,310 --> 00:43:30,826 and ended up being used." 1066 00:43:30,826 --> 00:43:31,659 - But honestly it's pretty cool. 1067 00:43:31,659 --> 00:43:34,560 Do you DM the head of the FBI and get a response? 1068 00:43:34,560 --> 00:43:35,393 - Yeah. 1069 00:43:35,393 --> 00:43:37,560 - "I noticed an organized crime group down the block." 1070 00:43:37,560 --> 00:43:38,393 He's not... 1071 00:43:38,393 --> 00:43:39,690 - And his DMs probably are not open yet. 1072 00:43:39,690 --> 00:43:41,536 - Yeah, they're not open. 1073 00:43:41,536 --> 00:43:44,220 - But what we have done to build on that 1074 00:43:44,220 --> 00:43:48,030 is really leaning into this new thing that we stood up, 1075 00:43:48,030 --> 00:43:50,160 which is the Joint Cyber Defense Collaborative, 1076 00:43:50,160 --> 00:43:53,400 which is working with all of the researchers 1077 00:43:53,400 --> 00:43:55,620 that wanna come to the table with us, 1078 00:43:55,620 --> 00:43:59,340 working with every company that wants to be a partner. 1079 00:43:59,340 --> 00:44:02,160 I just met with the ESET guys this morning. 1080 00:44:02,160 --> 00:44:07,160 So we are really open for collaboration, open for business. 1081 00:44:08,040 --> 00:44:08,873 And I would just say, 1082 00:44:08,873 --> 00:44:12,480 if you wanna be part of the collective cyber defense 1083 00:44:12,480 --> 00:44:14,670 of the nation, which it sounds like you do, 1084 00:44:14,670 --> 00:44:15,716 reach out to us. 1085 00:44:15,716 --> 00:44:18,240 You don't have to just come to the director, 1086 00:44:18,240 --> 00:44:20,730 everybody I think is in fact, 1087 00:44:20,730 --> 00:44:23,910 approaching the collaboration with the humility, 1088 00:44:23,910 --> 00:44:27,450 the vulnerability, the transparency and the gratitude. 1089 00:44:27,450 --> 00:44:29,430 And frankly, something that I think is important 1090 00:44:29,430 --> 00:44:31,860 and that's like assume noble intent, 1091 00:44:31,860 --> 00:44:33,813 and treat feedback is a gift. 1092 00:44:34,800 --> 00:44:37,080 I mean, that's like my operating principles in life. 1093 00:44:37,080 --> 00:44:40,353 And as an agency director, you kinda like you gotta do that. 1094 00:44:42,577 --> 00:44:44,003 - And this gentleman in the front. 1095 00:44:47,119 --> 00:44:51,060 - [Jason] I wanna ask, what is the (inaudible) 1096 00:44:51,060 --> 00:44:52,770 for applicants. 1097 00:44:52,770 --> 00:44:53,603 For example, 1098 00:44:53,603 --> 00:44:56,871 I would recruit this weekend that basically told me 1099 00:44:56,871 --> 00:45:00,501 there are a lot of applicants that they're going through. 1100 00:45:00,501 --> 00:45:04,710 They don't have that many people to handle them. 1101 00:45:04,710 --> 00:45:06,570 I know actions speak louder than words 1102 00:45:06,570 --> 00:45:08,818 and I know you're trying hard 1103 00:45:08,818 --> 00:45:09,851 and I've seen some of your talks 1104 00:45:09,851 --> 00:45:12,750 and I knew this couldn't pass me as person as you cares. 1105 00:45:12,750 --> 00:45:14,413 We seem to care as much as you do, 1106 00:45:14,413 --> 00:45:15,974 but what is CISA doing in action? 1107 00:45:15,974 --> 00:45:16,807 - I do. 1108 00:45:16,807 --> 00:45:18,495 - Jason] It's been like you mentioned a year, 1109 00:45:18,495 --> 00:45:22,475 so what's the next three years gonna look like? 1110 00:45:22,475 --> 00:45:23,785 How are you gonna get more 1111 00:45:23,785 --> 00:45:27,060 or how you gonna hire more security agents, people to help? 1112 00:45:27,060 --> 00:45:29,430 I know there are of people who are really (inaudible) 1113 00:45:29,430 --> 00:45:32,370 and really care about this country and doing good work 1114 00:45:32,370 --> 00:45:33,480 who are you willing to take 1115 00:45:33,480 --> 00:45:36,870 pay cuts to do (inaudible) work, especially outta college. 1116 00:45:36,870 --> 00:45:38,310 - Right, do you wanna come work for us? 1117 00:45:38,310 --> 00:45:40,238 'Cause, let's talk after this. 1118 00:45:40,238 --> 00:45:41,640 (Black chuckles) 1119 00:45:41,640 --> 00:45:42,510 - All right - [Jason] Sounds good. 1120 00:45:42,510 --> 00:45:43,343 - Yeah. 1121 00:45:43,343 --> 00:45:44,370 No, I know this feels 1122 00:45:44,370 --> 00:45:46,759 like a congressional hearing actually, but yeah. 1123 00:45:46,759 --> 00:45:49,098 (all laughing) 1124 00:45:49,098 --> 00:45:50,460 That's good. 1125 00:45:50,460 --> 00:45:52,290 What's your name? - [Jason] Jason. 1126 00:45:52,290 --> 00:45:54,450 - Jason, thank you for the question. 1127 00:45:54,450 --> 00:45:58,500 Yeah, man, part of this is dealing with bureaucracy 1128 00:45:58,500 --> 00:46:00,510 and slaying the dragons of bureaucracy. 1129 00:46:00,510 --> 00:46:03,960 I mean, it's a good thing that we have the CTMS system, 1130 00:46:03,960 --> 00:46:06,363 but we just started it and it's rolling out. 1131 00:46:07,410 --> 00:46:08,243 We are... 1132 00:46:08,243 --> 00:46:09,420 - So you see that's like a year or two? 1133 00:46:09,420 --> 00:46:12,720 How long does it take to digest something like that? 1134 00:46:12,720 --> 00:46:14,520 - Well, we're almost to the end of, 1135 00:46:14,520 --> 00:46:16,620 I mean it started last November, 1136 00:46:16,620 --> 00:46:18,630 and putting a system in place, 1137 00:46:18,630 --> 00:46:20,430 which is not even on the GS scale, 1138 00:46:20,430 --> 00:46:22,170 it's a completely different scale, 1139 00:46:22,170 --> 00:46:23,730 it's a completely different way of hiring, 1140 00:46:23,730 --> 00:46:24,960 completely different way of paying. 1141 00:46:24,960 --> 00:46:29,880 So it's a little rocky getting these things stood up. 1142 00:46:29,880 --> 00:46:31,560 But to Jason's point, 1143 00:46:31,560 --> 00:46:35,130 we are also reforming all of our HR processes. 1144 00:46:35,130 --> 00:46:36,621 It's one of the reasons why 1145 00:46:36,621 --> 00:46:38,850 I'm hiring a chief people officer. 1146 00:46:38,850 --> 00:46:40,590 We don't have those in government, 1147 00:46:40,590 --> 00:46:43,320 but I felt like we actually need somebody 1148 00:46:43,320 --> 00:46:46,320 to lead our human capital strategy 1149 00:46:46,320 --> 00:46:49,410 to ensure that we can build a talent 1150 00:46:49,410 --> 00:46:51,150 like a true talent management system, 1151 00:46:51,150 --> 00:46:53,040 not just get people in the door 1152 00:46:53,040 --> 00:46:55,950 but bring people in the door more at entry level 1153 00:46:55,950 --> 00:46:58,650 because we're a very senior agency. 1154 00:46:58,650 --> 00:47:00,630 And I just think that's, first of all, 1155 00:47:00,630 --> 00:47:03,840 that's a strategic risk to be so senior. 1156 00:47:03,840 --> 00:47:06,930 But I also really believe in creating career paths 1157 00:47:06,930 --> 00:47:11,930 and ladders and we are kind of starting from not scratch, 1158 00:47:12,870 --> 00:47:14,550 but we are starting from a place 1159 00:47:14,550 --> 00:47:17,430 where I am very aggressively trying to reshape 1160 00:47:17,430 --> 00:47:18,780 the organization. 1161 00:47:18,780 --> 00:47:20,700 So we're bringing in more junior people, 1162 00:47:20,700 --> 00:47:22,590 we're doing career ladders, 1163 00:47:22,590 --> 00:47:24,660 we're doing mentoring and coaching. 1164 00:47:24,660 --> 00:47:28,290 It's part of the gift of having a startup agency 1165 00:47:28,290 --> 00:47:30,660 and the burden of having a startup agency. 1166 00:47:30,660 --> 00:47:35,660 But if you are talented, we are gonna get you in the door. 1167 00:47:36,030 --> 00:47:37,080 So let's actually... 1168 00:47:37,080 --> 00:47:38,880 I'd like to talk after this. 1169 00:47:38,880 --> 00:47:39,713 But the other thing I'd say, 1170 00:47:39,713 --> 00:47:41,970 there are things that you can do to contribute 1171 00:47:41,970 --> 00:47:44,332 to the collective defense of the nation 1172 00:47:44,332 --> 00:47:46,800 while you're waiting to come join the team. 1173 00:47:46,800 --> 00:47:49,290 And so if you talk to Jags, or you could talk to Silas, 1174 00:47:49,290 --> 00:47:52,890 people like that who have made a real contribution 1175 00:47:52,890 --> 00:47:54,450 to the products that we're doing, 1176 00:47:54,450 --> 00:47:57,930 the advisories that are being used around the world, 1177 00:47:57,930 --> 00:48:01,740 I think that's one way you can contribute in the near term. 1178 00:48:01,740 --> 00:48:04,200 But I'm working to solve that problem. 1179 00:48:04,200 --> 00:48:07,260 - So you're going for the hire the B team 1180 00:48:07,260 --> 00:48:08,820 and turn them into the A team. 1181 00:48:08,820 --> 00:48:11,550 Not try to hire the A team because that's how one, 1182 00:48:11,550 --> 00:48:12,383 you can't... 1183 00:48:12,383 --> 00:48:13,605 - Yeah, no, I agree with that, 1184 00:48:13,605 --> 00:48:14,438 but I don't like A and B. 1185 00:48:14,438 --> 00:48:15,750 - I mean, I'm using as an example 1186 00:48:15,750 --> 00:48:18,360 of you don't have this law, I'll just hire the best. 1187 00:48:18,360 --> 00:48:19,500 It's like it doesn't work that way. 1188 00:48:19,500 --> 00:48:22,620 You can't build a good culture 1189 00:48:22,620 --> 00:48:24,570 if you're only trying to get A personality 1190 00:48:24,570 --> 00:48:26,668 general type alphas. 1191 00:48:26,668 --> 00:48:27,607 - No, a hundred percent. 1192 00:48:27,607 --> 00:48:30,120 I mean, you need to, what I wanna do coming up 1193 00:48:30,120 --> 00:48:34,050 is a ton of recruiting at schools around the country. 1194 00:48:34,050 --> 00:48:35,975 So you can bring in the energy. 1195 00:48:35,975 --> 00:48:36,808 - Well, when was it? 1196 00:48:36,808 --> 00:48:39,510 The NSA has the 20 centers of university. 1197 00:48:39,510 --> 00:48:40,680 - Yes, NSA, DHS. 1198 00:48:40,680 --> 00:48:41,513 - Right. - Yeah. 1199 00:48:41,513 --> 00:48:42,485 - Yeah, so you've gotta... 1200 00:48:42,485 --> 00:48:44,940 - (inaudible) as well, the centers of academic excellence. 1201 00:48:44,940 --> 00:48:46,380 So what I'm trying to do is go visit 1202 00:48:46,380 --> 00:48:50,370 all of the minority serving institutions around the country 1203 00:48:50,370 --> 00:48:52,140 because we're also trying to- 1204 00:48:52,140 --> 00:48:54,780 - Increase. - Aggressively diversify, 1205 00:48:54,780 --> 00:48:59,700 which I think is not just a moral imperative, 1206 00:48:59,700 --> 00:49:01,620 but a national security imperative 1207 00:49:01,620 --> 00:49:04,425 when you think about the importance of- 1208 00:49:04,425 --> 00:49:05,550 - Diversity of perspective. 1209 00:49:05,550 --> 00:49:07,440 - Diversity of perspective, diversity of thought, 1210 00:49:07,440 --> 00:49:08,610 that's how we solve problems. 1211 00:49:08,610 --> 00:49:11,940 Whether it's neuro diversity, diversity of gender identity, 1212 00:49:11,940 --> 00:49:14,370 sexual preference, race, national origin, 1213 00:49:14,370 --> 00:49:16,230 all of that equals diversity of thought. 1214 00:49:16,230 --> 00:49:19,980 And that's not where the government... 1215 00:49:19,980 --> 00:49:22,230 It's like the administration is leaning into that, 1216 00:49:22,230 --> 00:49:25,110 but that's not necessarily where the government started out. 1217 00:49:25,110 --> 00:49:25,943 - Right. 1218 00:49:25,943 --> 00:49:29,070 - So we got work to do, but it's all high 1219 00:49:29,070 --> 00:49:31,538 in my two priorities, people partnerships' 1220 00:49:31,538 --> 00:49:33,090 - 'Cause I'm facing this way, I'm getting all these people. 1221 00:49:33,090 --> 00:49:34,353 Is anybody over here that has the question 1222 00:49:34,353 --> 00:49:37,320 that I'm just not in my line of sight? 1223 00:49:37,320 --> 00:49:39,720 Okay, so I'll go back over here. 1224 00:49:39,720 --> 00:49:40,553 Oh, in the middle. 1225 00:49:40,553 --> 00:49:41,386 Middle, okay. 1226 00:49:41,386 --> 00:49:42,780 Middle. 1227 00:49:42,780 --> 00:49:43,613 Where are you? 1228 00:49:44,460 --> 00:49:46,416 Oh, behind the camera. 1229 00:49:46,416 --> 00:49:49,583 (audience chattering) 1230 00:49:51,049 --> 00:49:53,532 - [Audience 5] Out of curiosity, has CISA considered 1231 00:49:53,532 --> 00:49:55,301 partnering with high schools around the nation 1232 00:49:55,301 --> 00:50:00,301 to bring new (inaudible). 1233 00:50:01,428 --> 00:50:05,295 - Has CISA considered partnering with high schools 1234 00:50:05,295 --> 00:50:07,533 around the nation to- 1235 00:50:07,533 --> 00:50:08,610 - [Audience 5] Advance their computers? 1236 00:50:08,610 --> 00:50:09,660 - Oh, advance computers. 1237 00:50:09,660 --> 00:50:13,233 Sort of like the high school version of the NCCDC, 1238 00:50:14,280 --> 00:50:16,260 the National Collegiate Cyber Defense Challenge. 1239 00:50:16,260 --> 00:50:18,810 There was a high school version of that, 1240 00:50:18,810 --> 00:50:21,060 but maybe a broader engagement. 1241 00:50:21,060 --> 00:50:23,250 - We absolutely have. 1242 00:50:23,250 --> 00:50:24,487 These are all part of... - How many minutes? 1243 00:50:24,487 --> 00:50:26,730 - I've been talking about 1244 00:50:26,730 --> 00:50:28,500 building this talent management system, 1245 00:50:28,500 --> 00:50:30,270 we're partnering with high schools. 1246 00:50:30,270 --> 00:50:33,480 We brought in our first high school intern, 1247 00:50:33,480 --> 00:50:37,500 partnering with organizations like NPower, 1248 00:50:37,500 --> 00:50:41,070 partnering with Girls Who Code, partnering with Girl Scouts. 1249 00:50:41,070 --> 00:50:46,070 So we are doing these things entrepreneurial, which is cool. 1250 00:50:46,230 --> 00:50:48,750 But what I'm trying to do is to ensure 1251 00:50:48,750 --> 00:50:52,410 we can do them systematically and at scale. 1252 00:50:52,410 --> 00:50:56,040 So if there are great ideas about how we can partner, 1253 00:50:56,040 --> 00:50:58,020 'cause I know there's probably a lot of great folks 1254 00:50:58,020 --> 00:50:59,883 who are doing things like this, 1255 00:51:01,410 --> 00:51:03,723 please come and work with us on it. 1256 00:51:04,920 --> 00:51:06,510 - Okay, I have time for one last question 1257 00:51:06,510 --> 00:51:09,540 and then we've gotta call a wrap on this. 1258 00:51:09,540 --> 00:51:13,230 I mean, if you're interested in policy type questions... 1259 00:51:13,230 --> 00:51:14,063 - Oh, yeah we're doing some afterwards. 1260 00:51:14,063 --> 00:51:16,950 - Yeah, after this, in the policy track, 1261 00:51:16,950 --> 00:51:21,660 we're doing a little policy meet and greet with some beer. 1262 00:51:21,660 --> 00:51:24,840 And so hopefully, we'll continue conversations 1263 00:51:24,840 --> 00:51:26,160 that you have, not just with Jen, 1264 00:51:26,160 --> 00:51:28,560 but other people in the policy community. 1265 00:51:28,560 --> 00:51:30,420 Jags will probably be there. 1266 00:51:30,420 --> 00:51:32,850 So let's take the last question. 1267 00:51:32,850 --> 00:51:34,083 Gentlemen in the blue. 1268 00:51:34,990 --> 00:51:37,389 - [Audience 6] It's a quite an impression 1269 00:51:37,389 --> 00:51:39,150 (inaudible) just things. 1270 00:51:39,150 --> 00:51:44,104 Some lectures with the disposal that there is a cyber leak 1271 00:51:44,104 --> 00:51:47,247 in our governments and it's through (inaudible). 1272 00:51:47,247 --> 00:51:51,893 One, was the danger of that I'm holding the professor 1273 00:51:51,893 --> 00:51:55,890 title by myself, a very normal scientist 1274 00:51:55,890 --> 00:51:58,589 and she said that she's (inaudible) 1275 00:51:58,589 --> 00:52:02,400 of the power of the data and knowledge, 1276 00:52:02,400 --> 00:52:06,279 not of the government, but of the private sector 1277 00:52:06,279 --> 00:52:09,397 because a lot of data about everybody 1278 00:52:09,397 --> 00:52:11,410 and it relates to something you said earlier 1279 00:52:11,410 --> 00:52:15,377 about those companies like Microsoft, for example, 1280 00:52:15,377 --> 00:52:18,990 are not from anybody, not for anyone 1281 00:52:18,990 --> 00:52:22,672 but Microsoft that leaks the clause 1282 00:52:22,672 --> 00:52:27,434 that is not customers, it just provides them IT. 1283 00:52:27,434 --> 00:52:32,100 But other companies tend to become competitors 1284 00:52:32,100 --> 00:52:33,930 with their own customers. 1285 00:52:33,930 --> 00:52:35,830 You won't see a bank that (inaudible), 1286 00:52:37,080 --> 00:52:38,850 you might see it in other companies 1287 00:52:38,850 --> 00:52:41,220 that provide everybody IT. 1288 00:52:41,220 --> 00:52:46,220 That's one thing to think about as danger. 1289 00:52:48,981 --> 00:52:53,981 But another lecture was interesting by professor (inaudible) 1290 00:52:55,380 --> 00:52:59,343 from (inaudible) in machine learning, AI etcetera, 1291 00:53:00,600 --> 00:53:03,230 is a professor (inaudible) 1292 00:53:06,390 --> 00:53:08,500 and he said publish some research 1293 00:53:09,588 --> 00:53:14,040 that from the dangers of AI, so the machine learning. 1294 00:53:14,040 --> 00:53:18,570 So it's not just the supervised machine learning etcetera, 1295 00:53:18,570 --> 00:53:21,333 but we have to moderate it afterwards. 1296 00:53:21,333 --> 00:53:24,783 You can't give the machine learning in general 1297 00:53:24,783 --> 00:53:26,190 a good job. 1298 00:53:26,190 --> 00:53:27,559 - Right, so I think make. 1299 00:53:27,559 --> 00:53:29,070 - [Audience 6] Make everybody happy. 1300 00:53:29,070 --> 00:53:29,903 - I think that. 1301 00:53:29,903 --> 00:53:31,983 - [Audience 6] If you wanted to get everybody happy, 1302 00:53:31,983 --> 00:53:33,318 just make them stupid. 1303 00:53:33,318 --> 00:53:35,982 So stupid, not (inaudible) happy. 1304 00:53:35,982 --> 00:53:36,838 - Well I think the... 1305 00:53:36,838 --> 00:53:37,723 - [Audience 6] Machine learning, 1306 00:53:37,723 --> 00:53:40,080 if you put it into execution in a big scale 1307 00:53:40,080 --> 00:53:44,501 might become like making everybody stupid, not productive, 1308 00:53:44,501 --> 00:53:48,018 and it's a great venture for the future. 1309 00:53:48,018 --> 00:53:49,860 - I'm convinced that machine learning 1310 00:53:49,860 --> 00:53:52,380 is used for all these algorithmically generated 1311 00:53:52,380 --> 00:53:55,950 YouTube videos that are just pursuing maximum clicks, 1312 00:53:55,950 --> 00:53:58,570 which probably do produce a high stupidity quotient 1313 00:53:59,850 --> 00:54:04,143 that maybe one day will rise to a national security threat. 1314 00:54:05,100 --> 00:54:07,470 But that sounds like there's the AI and the quantum, 1315 00:54:07,470 --> 00:54:09,510 there seems to be these larger, bigger things 1316 00:54:09,510 --> 00:54:11,910 out there on the horizon. 1317 00:54:11,910 --> 00:54:14,970 And sometimes, private sector is not equipped 1318 00:54:14,970 --> 00:54:15,803 to deal with them. 1319 00:54:15,803 --> 00:54:16,860 And that's where I think again, 1320 00:54:16,860 --> 00:54:19,680 role of government plays a role. 1321 00:54:19,680 --> 00:54:20,891 - Totally. 1322 00:54:20,891 --> 00:54:22,391 - So you get the last word in. 1323 00:54:23,550 --> 00:54:24,600 - Gratitude. 1324 00:54:24,600 --> 00:54:25,560 - Yeah, thank you. 1325 00:54:25,560 --> 00:54:26,400 - Thank you for having me, 1326 00:54:26,400 --> 00:54:28,200 thank you for the great questions and the time 1327 00:54:28,200 --> 00:54:31,190 and if you wanna learn more about CISA, 1328 00:54:31,190 --> 00:54:33,480 if you wanna work with us, if you wanna be part of us, 1329 00:54:33,480 --> 00:54:34,830 please reach out. 1330 00:54:34,830 --> 00:54:39,240 And for those of you who use our products, 1331 00:54:39,240 --> 00:54:41,370 please continue to give us feedback. 1332 00:54:41,370 --> 00:54:42,480 We really wanna make sure 1333 00:54:42,480 --> 00:54:45,210 that those are as helpful as possible. 1334 00:54:45,210 --> 00:54:49,380 And so we are really leaning forward into responsiveness 1335 00:54:49,380 --> 00:54:50,700 and value added. 1336 00:54:50,700 --> 00:54:53,460 So thanks very much everybody. 1337 00:54:53,460 --> 00:54:54,377 - Thank you. 1338 00:54:54,377 --> 00:54:57,544 (audience applauding)