So we have a pretty interesting talk today.
We have Jen Easterly and our own Dark Tangent.
They're going to give us a little discussion
about how Aerosmith and Run DMC
can tell us about the future of cybersecurity.
So enjoy.
Okay.
Hi, thanks for coming to our talk.
And I'm going to reveal our agenda.
This is what we'll be covering.
That's blank.
Because this is going to be a more unscripted conversation
between Jen and myself.
And we have a couple of things we want to cover.
But really, we wanted to have
a sort of an authentic conversation,
not a scripted thing where I have to make sure
I ask a specific question and so on and so forth.
So it might not be totally smooth,
but it'll be totally interesting.
And then at some point,
we're going to start involving the audience
with some questions.
And so you can listen to us,
maybe work through some of your questions.
And before we get started,
I have to deconflict
myself.
I actually am on the CISA advisory board.
And so I'm going to be repping my Keep CISA Weird shirt.
So just to remind the director that,
you know,
just because it's government doesn't mean it has to be boring.
Exactly.
Love it.
I should have brought mine.
Now I feel kind of guilty.
Yeah, look at that.
In the Blade Runner font.
For those of you wondering what that font is.
You should show them the back.
Oh, I can't read that.
What does that say?
It says,
how about a nice game of chess?
Yes.
Nice game of chess.
Which Kenneth Gears is running the chess competition at DEFCON.
In case you want to have a nice game of chess.
All right, let's kick it off.
Why are you here?
Yeah.
Well,
let's see a show of hands.
How many people know what CISA is?
Wow.
It's pretty good.
How many of you work for CISA?
Well, maybe I can leave.
My job is done here.
Yeah.
You've converted them all to employees.
Exactly.
So, as you know, CISA is the newest agency in the federal government.
Founded by our mutual friend, Chris Krebs, about three and a half years ago.
And I think events like this, especially with the folks who are here,
are so important for us to develop trusted partnerships with.
And so you and I, before I was confirmed,
had a great conversation about the importance of this community.
And certainly from my past in the Army, at the NSA,
and even at Morgan Stanley, where we sent folks here,
realized that this is such an important community for us to connect to.
So I was excited to come hang out with you.
Yeah.
And have some fun.
You're all important.
We're going to talk about that, I think, a little bit.
It's interesting because when I started with DEFCON,
and it was all about the technical, and it was all about the party,
and it was all about the hack, and the social grew up around it.
And we'd always talk about keeping true to the core of DEFCON meant that
you had to stay kind of hacker.
And all the things that weren't hacker, that's fine too.
But if you lost that core, you might drift, right?
And then you're not quite sure what your identity is.
And one of the things we do with DEFCON now is when we're reviewing papers,
is we say,
we're a hacking conference.
And there's difference.
Here, it's maybe the joy of discovery, spontaneous learning.
Infosec may be advancing your career or honing a technique that will help you in your job.
Have you really thought through what is the core of CISA?
Like, what is your guiding stone where everything else kind of orients?
Because we've had 30 years to figure it out and you've had a year and a half.
Right.
Plus what Chris had.
Well, a year and a couple of weeks.
Yeah.
Yeah.
Well, it's a good question because one of the first things that I looked at when I got there is,
you know, what's our culture?
What are our core values?
What do we expect from each other?
And what do we aspire to be as an organization?
And because we were built off the back of a staff element,
we really didn't have any of that defined.
I was curious, what's, if you can share the numbers,
like what's average turnover in like a government agency or in CISA?
What's retention even like in that?
Yeah, I mean, it's actually pretty good.
Retention, our turnover, our attrition,
and I separate attrition from regretted attrition
because not all attrition is necessarily a bad thing for the organization.
But it's under probably like 10%.
So, you know, maybe in some case under 5%, but it's low.
Compared to say Amazon at 40%, not looking so bad.
Yeah, but I have a different philosophy.
I mean, so attracting and retaining,
retaining talent is really predicated on developing a great culture.
And that's why we've laid out what the core values of CISA are,
what our core principles are.
But if somebody wants to come in to defend the nation for a period of time
and then go back out to a critical infrastructure owner or operator,
you become part of the collective defense of the nation.
So I'm totally cool with that.
You know, come learn what it's like to work in the federal government.
We are probably as much like the private sector as any place in the federal government.
And so I think it's about building the capability for the nation.
I remember when I was spending time in D.C.,
there was always like the politicos, the full-time employees, and the contractors.
And there were these three communities, and they're all working at the same agency,
but, you know, they're different.
And they have different interests and different motivations and everything.
And originally, at big DHS, they had quite a large number of contractors.
And I remember having a conversation with one of them,
and I remember having a conversation with some leadership back in the day,
saying, if like 60% of your workforce are contractors,
that means the remaining 40% have to be really good at managing contractors.
Right? You have to have those expert skills.
But if your 40% is just like those 60%,
so does it mean that as you're building that culture,
you have to have the culture of managing contractors?
Or is it you treat everybody identically,
knowing you have to have different skill sets for the, you know,
because it's not like managing corporate America.
For me, we are just riffing here.
Yeah, yeah.
For me, I really don't see a distinction.
I mean, there is a distinction in terms of certain rules,
a way a contract is handed.
So, for example, you know, I'm a big mental health advocate.
So we made 2022 the year of mental health and employee well-being.
But really, everybody well-being, obviously,
if you contribute to the mission of CISA.
But one of the things that we did was we got Headspace,
the mindfulness app.
Do you use that?
I recommend it to you.
So it's good for meditation and mindfulness.
So we got that for all of our employees.
We couldn't get it for the contractors.
So there's certain like legal things.
There's training that we offer that we can ask a contractor's company
to offer to them.
If we give days off, we can work with that vendor.
But otherwise,
I just see everybody as part of Team CISA,
same values, collaboration, innovation, service, accountability,
all of us same principles.
And we have a culture council that we stood up
to make sure that we are guarding our culture and embracing it.
Are people in other agencies looking at you like,
what the hell is Jen doing?
Or are they like, that's awesome.
We want to imitate that.
That.
Okay.
I don't know.
I think people see that we're having a lot of success
with bringing in talent.
Yeah.
And so that's good.
I mean, partially that is the culture that we're building,
but it's also because we were uniquely given authorities
as America's cyber defense agency.
I mean, the Congress went all in on us.
They gave us more money, more authorities.
They gave us something called the cyber talent management system,
which allows us to hire much more agilely and pay more.
Like one thing that always drove me bananas was,
you know,
you have to have a bachelor's degree or a master's degree or a PhD.
I mean, and then you get a PhD and come in as like a GS11 or something.
Right.
Doing malware analysis.
Exactly.
Like I don't really care whether you have a college degree or not.
My most technical person at Morgan Stanley,
my head of cyber analytics, had no college degree.
And so I think it's really about aptitude and attitude.
And that's why I think the culture piece is so important
because you might be the most technical person in the world,
but if you're an asshole, like that's not going to be good
for the culture that we're trying to build.
And so, you know, aptitude and attitude is what we need to do.
And the CTMS takes us there.
It also helps us pay closer to market,
not what I paid the guys at Morgan Stanley, but closer.
The CTMS she's mentioning.
Oh yeah, you started that, right?
Well, like eight years ago or more,
we did some recommendations on hiring in DHS and how to retain, attract.
We were really big on this question.
We had this concept of verification of talent.
So you have to prove your skills.
Demonstration of skill, I think, is what we called it.
And then that way you would hire.
It doesn't matter what your education is.
If you can demonstrate the skill, then you're qualified.
And it was a good report.
People agreed with it.
And then nothing for it until just last year, seven years.
Yeah, 2021.
And so speed of government.
But now that it's happened,
now you can run with it.
And so, yeah, it's like slow, fast.
In our world, in hacking, you expect things to happen very quickly.
But in government world, sometimes things are slow.
And I kind of use that to balance both sides of my personality, right?
But it's the bureaucracy.
I mean, people ask often, what keeps you up at night?
You know, the adversaries are out there,
and they're really sophisticated and increasingly complex threat landscape.
But for me, it's battling the bureaucracy,
both so we can attract and retain new talent,
but also be able to do the mission.
We have to be able to move at the speed of cyber and not at the speed of bureaucracy.
You can't get a PhD in bureaucracy, can you?
Or government.
Yeah, or government, yeah.
And so, you know, that's the thing that I worry the most about.
And that's the thing that we're fighting against is,
how can we do things much more like the private sector
and battle the government bureaucracy?
And we're starting to have a lot of good success.
And part of it is what we've been talking about since over a year ago,
is like, how do you build those trusted partnerships?
It's this whole talk predicated on unlikely but powerful partnerships,
the Run DMC and Aerosmith, 1986, Walk This Way.
I like the DMC, I'll take that.
That'll be good.
One of the things, I think we talked about this,
is that, and I'm curious, by show of hands,
how many people trust an organization versus trust an individual?
Like, you don't trust, say, the FBI, you trust your buddy at FBI.
Or you don't trust Microsoft, you trust your buddy.
So, show of hands, who would trust the organization?
And who would trust an individual that you have a relationship with?
Right, and so I think knowing that,
I trust no one.
And so I think that means that we have to organize,
you have to build a way for people to build those relationships
with your organization, and then maybe over time
they trust the organization more and more and more.
But until you have that kind of continuity of trust,
because I think when the shit hits the fan,
they're going to call up their buddy.
They're not going to call the switchboard.
No, I mean, that answers your question, right?
And that's why I'm here.
And that's why I spend so much time engaging with people
and on the road and going to various events to meet people.
Right.
But behind you, you have to have a team or a group of people.
Yeah, I've got an awesome team.
A lot of them, as you know.
A lot of them are here.
But, no, you and I talked about this, right?
And I just came from a discussion around elections.
And, you know, the word, the operative word for all of this is trust.
Right.
At the end of the day.
And so the question is, how do you actually build trusted partnerships
between the federal government
and all of the partners that we need to work with?
Because we're a voluntary agency.
We're not a regulator.
And our job is to defend critical infrastructure.
And we don't own the vast majority of critical infrastructure.
Right.
So you have to have trusted partnerships so we can work together
to make sure that everybody has the guidance and the resources
and the tools to be able to defend the nation.
Right.
And so, again, it's about trust.
And, again, what we talked about and what we've been trying to do
through the Joint Cyber Defense Collaborative
as you know, through our Cybersecurity Advisory Council,
through the Technical Advisory Council,
and I really want you to talk about that,
through the CSRB, the Cyber Safety Review Board,
that you and Rob Silvers and Heather Atkins talked about,
is creating trust between the federal government
and all of the stakeholders to include industry.
And I see, you know, the most important things is you've got to approach it
with, first of all, humility.
We certainly can't solve this problem as a government.
We don't have all the answers.
And so humility, I think, is truly important.
I think vulnerability is something.
It's interesting, right, because vulnerabilities are such a negative word
in our technical community.
But I think vulnerability is an incredibly important thing
when you're talking about building a trusted relationship.
I think transparency is something we always talk about.
Transparency builds trust.
And that's huge for me.
And then finally, like, gratitude.
Bringing together the community and sort of figuring out
how we can appreciate what every side is bringing to the table.
So you mentioned a couple words that really resonate with me.
One is transparency.
Just because DEF CON, we've done so much work trying to build.
We were the first conference to use, like, a transparency report
to try to tell people what happened.
That's a little painful because you don't like revealing the bad things that happen,
but the good that comes out of it outweighs the bad.
Right?
And the other thing I think is, you know, this is a global game now.
And so things you do are setting a standard or an expectation
with all the partners and allies and, frankly, you know, opponents.
And so it's almost like if you could set up your organization to play.
So what is team rule of law's strengths?
It's transparency.
It's accountability.
Like, team authoritarian doesn't want to play.
They don't want to be transparent.
They don't want to be accountable.
So it's like the more we can emphasize and highlight that contrast between both sides,
team undecided in the middle, they can make a more informed decision
of which team they maybe want to associate with.
And so I think the more that you or I or any of our organizations
can operate in a transparent or an accountable way,
it makes it that much harder for your opponents to say,
oh, well, we're transparent, too.
Oh, look how accountable we are.
No, we might have other things that are similar,
but draw the contrasts.
And it might be hard for a government to do that
because you're so used to not or the liability of being transparent, right?
You might have laws against it.
It's really interesting.
So I spent the first 27 years of my career in the Army,
a good portion at the National Security Agency.
I was at the White House under the Bush administration,
then under the Obama administration,
then went off to Morgan Stanley for four and a half years.
And when you think about the first half of that,
being in the intelligence community,
it was a little bit counterintuitive to say,
okay, we want to be really transparent with everything.
Not because we didn't believe in transparency,
but because there's always a fear of sources and methods getting compromised
and then not being able to do the mission for the nation.
But I think increasingly, and this was after 2013,
there was a real embrace of transparency
because ultimately government has to be accountable to the American people.
And so I've seen a very good evolution in the embrace of transparency.
And frankly, at CISA, because we are such an outward-facing agency,
every day is working with private sector or state and local election officials.
It is about, we know that unless we're transparent,
unless people can be transparent,
unless we can understand why we're doing what we're doing,
the products that are going out, we're asking for feedback from them,
unless we're being completely transparent,
you know, the model breaks down.
I don't have a badge where I can show up,
you know, I don't have, like, subpoena power.
And so it's all about, okay, why should you trust CISA
because we add value, because we're responsive,
because we have great expertise.
So it's all carrots, no sticks, kind of.
Not really.
I mean, we have very, very small
regulatory power on the chemical facilities,
anti-terrorism side.
There's a physical security.
So it has to be voluntary.
But it's all voluntary.
Which, like, frankly, I embrace.
Because I think if we were a regulator,
we would not be able to create the trusted partnerships.
You'd be in court, like, every other minute.
You wouldn't get anything done.
Yeah, that we needed.
When I was in finance, it's not like,
hey, let's go rush to tell the regulators
when something bad happens.
When we discovered something.
Yeah.
So, yeah.
And, you know, for the stuff that we talk about,
you guys did some great work.
And I really want you to talk about this
on coordinated vulnerability disclosure.
You have to have a relationship
where you can have that trust with the researchers
and then ultimately be able to put information out
that people are going to have confidence in,
believe it, understand it,
be able to mitigate vulnerabilities.
And it's just incredibly important.
So can you talk a little bit about the TAC?
Yeah.
So, okay.
So Jen constituted a security advisory committee for CISA.
And it looks at, you know, I think we have, what, seven or?
Oh, like, yeah, probably seven big things.
It's about how do you build the agency?
How do you evolve America's cyber defense agency?
So it's a very eclectic group.
Right.
But I really want, and not everybody's technical, right?
Some people come from.
Yeah, and you're doing infrastructure and energy and misinformation.
You know, we have different.
Finance, energy, exactly.
Yeah, finance.
And so out of that spectrum of subgroups,
I'm chairing a technical advisory committee.
And the part that was really cool is I can bring people in from other countries.
Clearances aren't necessary.
All of our reports become public.
And we just published two reports,
one on threat intelligence and one on vulnerability disclosure.
And we'll be producing more reports.
In the future.
And so I had a lot of leeway to attract a diverse group of people.
And it's been really amazing because unlike the big H-SAC reports that would take a long time and be very large and there was no immediate impact.
We delivered our first reports.
They were voted on by the overall committee.
They were approved by the director.
And two weeks later, we're having calls with people inside CISA from those teams.
And threat intel digesting our report,
excited that we've given recommendations,
already making changes inside the organization.
What's going on here?
I'm not used to that.
That's not your daddy's government.
No.
And they're excited.
And they're like, wow, you gave us a great idea.
And that reinforces this other thinking that we need to tie a connection between just not the threat intel.
We need to start enriching it with metadata because the people in OT,
they want to know, do I really have to turn off my vaccine processor to patch this?
Or can I just put in a firewall rule?
Like, yes, you said this is a critical nine.
But what does that mean to me, right?
And so we want to create one of our recommendations was essentially creating a way to enrich these with metadata in a community portal where people,
the other vaccine manufacturers can say, no, no, no, we're running that Phillips gear.
Just do this other thing.
And then we're missing that.
And what that does is without that metadata, people are frozen with indecision and they're running all these risks, right?
So we can speed up that loop, making the threat intel more valuable faster.
And so there's other interesting recommendations like that.
But just the speed at which they got it and they wanted to implement it.
And so I think for the rest of the technical advisory committee,
that have never interacted really with government for this.
A lot of them, this is their first chance ever being on an advisory committee.
It's really empowering to them.
They're really excited.
Like, they listened to us.
They did something.
Like, this is not how it's supposed to be.
And I'm hoping that through this experience, more and more people want to get involved.
And so, for example, we would interview 20 different people on a report.
So even though you're not on the tech, if you're a subject matter expert in something we're looking at,
we might call you up and you might come and give us your opinion.
And because of that, we get people across the whole industry,
you know, small manufacturers and energy, giant southern corporation style, huge companies.
And we're really focused on diversity of opinion because what we're finding, too,
is there's no one single use case, especially in vulnerability disclosure.
There's some people that are out of business.
Companies are out of business.
But they're widely adopted.
How do you disclose that to the manufacturer if they're gone?
Who can bless that it's okay for you to reveal that publicly?
There's no law.
So you can run into these thorny issues.
And CISA, acting as sort of a governance mediator, I argue that they should take on more of a coordination role.
And get between sometimes, between the researcher and the company,
because a lot of researchers, we don't want to spend the rest of our lives arguing with the company.
We found the bug.
We want the right thing done.
But I'm not willing to sacrifice three months of pain.
And that's exactly what we're doing.
We have the platform.
And recently we did this for elections, actually.
Folks might have seen a report we did working with a researcher and working with Dominion.
And that was a really complicated coordinated vulnerability disclosure.
Yeah.
And so we spent very, you know, a lot of rigor, very deliberate efforts to do that.
And sometimes, you know, it's hard to necessarily mediate the middle of that.
And the interesting thing is people say, well, what's the role of government?
And it seems like role of government is to get involved in these sticky issues that don't have a clear business solution, right?
It's like a conflict between sort of commercial and civil society.
Yeah.
And you need a disinterested third party to make those hard calls.
Yeah.
And disinterested is an important word because we are only, I mean, our North Star is defense, which is kind of pure to me.
Like having been on the offense side, I actually like the defense better.
And I think defense is the new offense.
But, you know, it's a pure mission.
And so I think that's really important when you think about we are only in it to defend.
To defend the nation.
But I want to pick up on something you said because this morning I got to just chat with some of the researchers that we built relationships with over the past six months.
And it's kind of funny.
The one was Jags, if you know Jags.
And then Silas Cutler.
Yeah, Silas is always fun.
Yeah.
And then I saw Marcus over at the EFF poker tournament with Kurt.
So that was fun too.
But, you know, I met those two guys because they reached out to me on Twitter.
Like actually with some critical questions.
Yeah.
Like, you know, Jags had some, he was unhappy about something that we, decisions we had made.
And he just sends me this like DM.
And I said, well, let me give you a call.
What's your phone number?
I didn't know who he was.
Yeah.
You didn't know who he was.
Bold move.
Bold.
And he like talked it out.
And actually he was, we talked through it.
And he was the one who said, well, you know, it's because it started out with Ignite the Hackers.
Yeah.
And he's like, no, what you really need is this technical advisory council.
And I said, well, I've got, you know, Jeff Moss.
He's like, well, he's fabulous.
I said, yes, I know.
Thank you.
But, you know, I am such a fan of the incredible power of researchers.
Yeah, the community.
I've seen the power on the government side.
But on the private sector side, I mean, we are really leaning into working with everybody who wants to be part of this community.
And, you know, Silas worked with us on the Maui ransomware report that we did.
Doing some fantastic reverse engineering.
Jags worked with us on the hermetic wiper stuff for you.
Ukraine.
And so these types of collaborations are just so absolutely critical.
And I think we're making some really good progress.
So talk a little bit, like, I'm always curious on, since it's a global nature, like, when you're talking to our partners or others, how do they, do they come up and say, hey, how is this working?
Are they lessons that can be imitated?
Or is their, you know, society so different that we're kind of like a unicorn?
Yeah.
Other feds, you mean?
Yeah.
Or other countries.
Australia, UK, anywhere.
Oh, yeah.
European.
Like, you know, I saw you signing an MOU with.
With Ukraine.
With Ukraine.
Yeah.
Victor was here.
So what is.
Yeah.
So what is the MOU?
Like, how do they see CISA in the U.S. government?
It's not an MOU with the FBI or NSA, right?
Right.
It's the defensive agency.
All defense.
But that's the beauty of it, right?
Because every country has different things on encryption.
Yeah.
Different things in terms of authorities they can do on the offensive side.
Different things that they're doing on the foreign intelligence side.
But defense is pretty much the same around the world.
And so we have fantastic relationships with over 100 CERTs, because we're U.S. CERT and
ICS CERT.
Yeah.
We have what's called the International Watch and Warning Network, which is 16 nations
across the country.
Really terrific information sharing partnerships.
Yeah.
And then, of course, we're very, very close with all of our Five Eyes partners.
And so the international piece is fantastic.
Whenever we talk about the JCDC, we lean into the private sector part.
But the JCDC includes all of our international relationships to include Ukraine.
Right.
And we had this terrific, as you said, meeting with the four different agencies across Ukraine.
We did this memorandum of cooperation, which is really about capacity building.
Yeah.
As well as ways to more agilely share information.
Is there the equivalent of if you see something, say something?
Yeah.
Is it sort of like, we're the U.S. government, we see something, we're going to say something
to the U.K. or Ukraine?
Is there sort of that kind of-
Yeah, like 100%.
Yeah.
We see, obviously, if there's an imminent threat, we will, whether it's private sector
or whatever, we have an obligation to ensure that we are getting that information out.
But sometimes it's just dots.
Right.
Suspicious activity.
Only in hindsight.
Yeah.
And so we will always lean forward, because we think-
So it's a bias toward-
It's always a bias towards action.
Yeah.
And we'd much rather be in the proactive space than in the reactive space.
Right.
Because left of boom is better than right of boom, which is-
Right.
The name of the game is resilience.
But a great example is Albania.
The whole thing happened, that came out.
And we have a good relationship with their cert.
And so we were able to help them based on researchers that came in to work with the
JCDC to do some malware analysis and to give back some really important information to
them.
And so it's really this community coming together-
Right.
For the global defense.
Well, that was...
Guys, there's so much to talk about.
Man, we could have beers.
We could be all night.
We have to ask questions.
Did you say beers?
Yeah.
I wish we had some beers.
Oh.
Yeah.
Because I can drink.
I don't know if you're technically on duty, but I don't know if-
Yeah.
I stopped drinking in 2021, which I think was a bad idea.
That's good.
Let's go for a question or two.
But I wanted to get back to your North Star.
You said that core principle, right?
You're like, we're a hack-a-con.
CISA is a defense organization.
And you are what?
Defend today, protect the-
Well, Chris and I talk about this.
It started out defend today, secure tomorrow.
And now it's defend today, protect the future.
Secure tomorrow.
Just sort of show, put out today's fires.
Yeah.
And secure the future.
But think longer term.
Sure.
I mean, the emerging tech piece is, we do the quantum piece, as you know, a lot of work
on that with NSA and NIST, and focus on 6G, focus on security of smart cities.
And so we're working-
So there's this longer term perspective.
You're not just a firefighting agency.
No.
And we don't want to be.
We want to actually ensure that all of our partners are building resilience.
Yeah.
And they're building resilience into their systems.
And that's one thing, you know, from a tech perspective.
We've talked about this-
Yeah.
At the Cybersecurity Advisory Committee.
You know, I spend a lot of time talking about things like multi-factor authentication, more
than a password, and all the basics.
But what I think we need to do is ensure that the big technology companies are actually
taking accountability for baking security into their systems.
Yeah.
That drives me crazy that-
So users don't have to actually ultimately worry about MSA.
Well, the people I think most responsible-
Yeah.
Are the people closest to the levers of power.
And if you're the manufacturer, you're Microsoft, not to beat on them, they do a great job.
But if you're Microsoft, you are in the best position to make the correction, not a third
party piece of software to run on top of your operating system.
And so I think there's that, you know, responsibility there.
And they've been acknowledging it in Apple and Google.
But I really think that the more that can be done it close to where the problem is,
that frees us up to do-
100%.
Yeah.
And I think they're recognizing that as well.
I mean, part of the executive order last year was to signal that use of the government's
purchasing power.
Right.
So if you have contracts with the government, some of these requirements-
Might, yeah.
Will become necessary to do business.
You must be this tall to sell to the government.
Right.
Sort of, exactly.
Yeah.
Exactly.
So we're getting there.
And then your other point about, you know, the federal partners.
I think the other really cool thing about the JCDC is it's the only federal cyber entity
that, by law, brings in CISA, NSA, FBI, DOD, DOJ, ODNI, the National Cyber Director's Secret
Service.
So by law, all on one platform.
So we stood this thing up.
Yeah.
Different than a fusion center, right?
No, exactly.
We stood this thing up.
But it's not CISA's.
It's a platform where industry can come to government and not have to have that PhD
in government to figure out how to interact.
Right.
Right.
Okay, let's go for some questions, guys.
Any questions?
No?
Who's got a question?
Can CISA influence how Congress appropriates money to go to state and locals for cyber
security?
Yeah.
Can I repeat the question?
Yeah.
The question, can we influence how money goes to state and locals?
And certainly, I have to say, we have been really blessed in terms of our engagement
with the Congress.
Cyber security, happily, is still a very bipartisan issue.
And so when I go up on the Hill, whether it's to talk about my budget, whether it's
to testify, just an update on what we're doing, the questions that I routinely get from the
House and the Senate are, what more can we do for you?
Which is not the question that you always get from Congress.
And so that's actually really, really encouraging.
And one of the things that I talk about the most are the importance of us being able to
work closely with state and local.
Yeah.
Who do all kinds of security, but a lot of focus on election security.
And so we are always advocating for state and local.
And the grant program that we're about to do, the NOFO, the Notice of Funding Opportunity,
I think will be really, really important for state and local.
I thought it was great.
That was in the last package, $1 billion, $200 million this year, hugely important.
And the other thing is, two other things.
So we are, over the next few years, really growing.
Our field force, which is one of the things I'm most excited about, to have more folks
out all across the nation.
Out of the Beltway.
Yeah, exactly.
It's where I love to be, out of the Beltway.
Working with state and local.
We've got cybersecurity coordinators working with every state CISO, state CIO.
And so we're really going to dig into that.
I've got my cybersecurity advisor for Region 9, which is based out of California, Joe
Oregon.
I think he's in here.
And David Rosado heads that.
But we are totally leaning in on that.
So please continue to give us feedback.
The other thing, we're trying to be creative in terms of, first, how we help small businesses.
Because they are really, as Josh Korman would say, often in the space of being target rich,
resource poor.
And so we've done a lot of work in terms of, how do we break things down to make it
simple for a small business to be able to protect itself?
Mm-hmm.
Yeah.
So we have a small business that's 10 people.
And so small businesses are out in everybody's jurisdiction.
And then also try and be creative.
We were, as part of the committee, working this really cool pilot, like a town gown,
right?
It's awesome.
This town gown pilot in Austin with Mayor Steve Adler and Bobby Chesney, who they're
both on our board, to try and-
Bobby made these shirts, so I blame him.
Yeah, Bobby made the shirts.
Yeah.
And so what we're trying to do is, Austin has this 311.
So people can call.
And if they've got an issue, somebody's on the other end of the phone to help them.
They turned out they get a lot of calls about cyber stuff.
And so now we're going to have students on the other end who are going to be trained
to how to respond to things.
And then that will also help them get-
It's the Cyber 9-11.
Experience.
Yeah, Cyber 9-11.
And so our 8-1-1, 6-1-1, you can call 3-1-1 and get some help.
Exactly.
So creative ways to build the bench throughout the nation and to raise skills.
Yeah.
Yeah.
Yeah.
Yeah.
Lots of acronyms at DHS.
But one of the things I like is it's a ground-up organization, grassroots.
It comes state, local.
But there's acronym SLTT, State, Local, Tribal, and Territorial, because we are more than
a nation of states, right?
And I always respected that because it was always the SLTT, the SLTT, because you never
hear people talk about the tribes and the territories.
I mean, some presidents don't even know that we have territories.
And so it's confusing, I understand.
But yeah, so it's really nice to see that DHS really recognized that, no, it's all
Americans.
Yeah.
This gentleman here, and then we'll go over to this gentleman here.
Hi, thank you.
Yeah, my question actually was about what you just talked about, and that is, what can
government do to help protect private enterprise?
So I personally, Kylie and I, work for a family-owned company.
But relatively large, we're spending an ever-increasing portion of our budget on cybersecurity tools.
So I think it's really important for us to be able to do that.
And I think we've talked about that a lot, whether it's software, services.
SOC is a service.
We don't have our own fire department.
We don't have our own police department.
We don't have our own army.
Yet we now have had to make a business plan to create our own.
And so my question to you is, has there been discussions about what role government can
play, whether it's federal or state and local?
I think you gave some great examples.
Yeah.
But where it's security as a service, almost like a tax dollar funded, you know,
providing service that a company can sign up for,
or the government is watching for them
and notifying the small and medium-sized business?
Yep, yep.
So if you are critical infrastructure,
and I don't know if, you know,
there are actually some small entities
that are critical infrastructure,
that is part of our core mission.
We are working with businesses large and small
as part of critical infrastructure
to ensure that they have tools and services.
And frankly, a lot of our stuff is free,
which is, you know, a great four-letter word.
So you think about,
and I would invite you to take a look at our website
because a lot of that information is there.
And we just updated what we call
a small business cybersecurity action plan
because we wanted to break it down as simple as possible
and then provide all of our no-cost services.
Some of the stuff is pro bono provided
from our industry JCDC partners.
So we realize that small businesses
and small entities don't have the wherewithal
to create these huge security teams
like I had it at Morgan Stanley.
And so we're spending a lot of time, again,
trying to make sure that the resources are out there
and broken down in a way that they can,
that all businesses can avail themselves.
And so I would say, like, follow up with us
because I'm really interested in particular
in feedback on what we're doing with small businesses
because the other part of critical infrastructure
is now it's also a blurry line
and it's a blurry line.
Because just given the interdependencies
on the supply chain,
you might not be the classic member
of critical infrastructure,
but you can very well be a vendor
for that critical infrastructure.
So what we're really trying to do
is have a very large blanket across the country
as we continue to grow our own capability
as America's cyber defense agency.
This gentleman over here.
At Black Hat, your predecessor, Chris Krebs,
talked about separating CISA from DHS
as a sub-cabinet agency.
What do you see the pros and cons
of a move like that or a recommendation like that?
Repeat the question.
All right.
He asked, Chris Krebs at Black Hat
was talking about several different things
that could be improvements
and one of the suggestions he's had
was potentially separating CISA
and creating its own standalone.
The question is, what are the pros, what are the cons?
Yeah.
I mean, I think over the last two decades,
when I think about federal cybersecurity,
there's probably two,
two big things that happened
that have really helped to change the landscape
in terms of America's capability.
One was on the offensive side
and that's when we stood up US Cyber Command.
So that was, you know, Paul Nakasone, TJ White,
working with Keith Alexander, Chris Inglis.
And I think that was a really important capability
that now 10 years on is making a real difference.
And I think the most important thing
that happened in the last five years
was the establishment of CISA.
In 2018, you know, which really proved
that a name change and more money
and more authorities can make a real difference.
You know, I still have NPPD.
NPPD, right.
You know, there's no infrastructure in there
or even cyber.
And so building a cyber
and infrastructure security agency,
I think, was critical.
And then following onto that,
there were actually organizational changes
and more authorities that came with the NDAA 2021
out of the cyberspace solarium.
Right.
One of the things
was, you know, it was called the Joint Cyber Planning Office,
but JICPO sounded like a disease and a horrible acronym,
which is why JCDC, because it sounds like ACDC.
And who can argue with ACDC?
Who can argue with ACDC?
Exactly, right.
So, so many really important things have happened.
And my job, Tommy, is to make sure that I am all in
on what we are doing now.
And I don't, you know.
Well, if you split it off,
it's unclear what the benefits are immediately.
So I can see the turmoil and the bureaucratic churn
and the fighting for budgets and turf.
And even the concern would be, oh, well,
we've got an agency for that.
They're in charge now.
Oh, I'm, you know, OMB.
I don't have to do that.
That's their problem.
And so it's like, okay, well, if we put up with all that churn,
there better be a really big golden egg at the end of that.
And I don't know what the golden egg would be.
I think CISA, I feel like we're a golden egg.
You are a golden egg.
So, and the other thing is there are benefits to us being part
of DHS in terms of having that connection
to my friend Dave Pacosky, TSA, right, from an aviation security.
Deanne Criswell from a FEMA perspective.
So they're important connectivity secret service
that we've got there to have these colleagues
around the table as fellow components.
So, but, you know, I am like laser focused.
I'm focused on building America's cyber defense agency
to be the agency that America deserves.
And that's like no small endeavor as you know, given your role.
So, yeah, so I'm not sure, it's not clear to me,
it sounds like it's not clear to Jen what the benefit would be.
I just see economic, I mean, I just see bureaucratic churn.
But I like, I like the big thinking.
But I don't, if it is the time, it's not the time now, I don't,
I don't think.
I think it's gentleman in the back and then in the front.
So obviously you guys are doing a lot and we appreciate it.
Historically government has always been like one way capable
of like communicating to the community and it's very.
The FBI problem, we'll listen but never talk.
So what can the community here do to help CISA
and the nation's poll beyond DMs and Twitter help, you know,
with the problems that we have?
Yeah.
First of all, thank you for asking that question
because I think it's exactly the right question we should be asking.
What can we do to help and what can you do to help us?
So, you know, I think the DMs and Twitter is emblematic
of what folks probably thought, you know, about the federal government.
Hey, you know, these are just people kind of making decisions and.
But honestly, it's pretty cool.
Do you DM the head of the FBI and get a response?
Yeah.
You know, I noticed an organized crime group down the block.
He's not.
I think his DMs probably are not open.
Yeah, they're not open.
But what we have done to build on that is really leaning into this new thing that we stood up,
which is the Joint Cyber Defense Collaborative, which is working with all of the researchers
that want to come to the table with us, working with every company that wants to be a partner.
I just met with like the ESET guys this morning.
So we are really.
Really open for collaboration, open for business.
And I would just say if you are if you want to be part of the collective cyber defense of the nation,
which it sounds like you do reach out to us, you don't have to just come to the director.
Everybody, I think, is in fact approaching the collaboration with the humility, the vulnerability,
the transparency and and the gratitude and like, frankly, something that I think is important.
And that's like assume noble intent and treat feedback as a gift.
Right. I mean, that's like my operating principles in life.
And as an agency director, you kind of like you got you got to do that.
This gentleman in the front.
I mean, I know, you know, actually, I know you're trying hard and I've seen some of your talks and I think it's going to be as passionate as you care.
You know, we seem to care as much as you do.
But what is you know, what is this in action?
It's been, like you mentioned, three years.
So, you know, what's what's the next three years going to look like?
Are you going to get more or are you going to hire more security engineers to help you?
Yeah, I know there are a lot of people who are really pitch out and really care about this country and doing good work.
Right. Who are you willing to take?
Pay cuts.
Right. Do you want to come work for us?
Because let's talk after this.
All right.
Yeah. No, I know this feels like a congressional hearing, actually.
But that's good.
That's good. What's your name?
Jason. Jason.
Thank you for the question.
Yeah, man. Part of this is like dealing with bureaucracy and slaying the dragons of bureaucracy.
I mean, you know, it's a good thing that we have the CTMS system.
But we just started it and it's rolling out.
We are.
So you see that's like a year or two.
How long does it take to digest something like that?
Well, we're almost to the end of I mean, it started last November and putting a system in place, which is not even on the GS scale.
It's a completely different scale.
It's a completely different way of hiring, completely different way of paying.
So, you know, it's a little rocky getting these things stood up.
But to Jason's point, we are also reforming all of our HR.
Our processes.
It's one of the reasons why we're you know, I'm hiring a chief people officer.
We don't have those in government, but I felt like we actually need somebody to lead our human capital strategy to ensure that we can build a talent like a true talent management system, not just get people in the door, but bring people in the door more entry level because we're a very senior agency.
And I just think that's first of all, that's a strategic risk.
Yeah. So senior.
But I also really believe in creating career paths and ladders.
And, you know, we are kind of starting from not scratch, but we are starting from a place where I am very aggressively trying to reshape the organization.
So we're bringing in more junior people.
We're doing career ladders.
We're doing mentoring and coaching.
It's part of like the gift of having a startup agency and the burden of having a startup agency.
But, you know, if you are talented.
We are going to get you in the door.
So let's actually I'd like to talk after this.
But the other thing I'd say there are things that you can do to contribute to the collective defense of the nation without while you're waiting to come join the team.
And so if you talk to Jags, you can talk to Silas, people like that who have made a real contribution to the products that we're doing, the advisories that are being used around the world.
I think that's one way you can contribute in the in the near term.
But, you know, you're working to solve.
That problem.
So you're going for the for the hire the B team and turn them into the A team, not try to hire the A team because that's one you can't.
No, I agree with that.
But I don't like A and B.
I mean, I'm using it as an example.
If you don't have this law, like I'll just hire the best.
It's like it doesn't work that way.
You can't build a good culture if you're only trying to get a personality, general type.
No, a hundred percent.
And you need to.
What I want to do coming up is a ton of recruiting at schools around the country.
And you need to what I want to do coming up is a ton of recruiting at schools around the country.
And you need to what I want to do coming up is a ton of recruiting at schools around the country.
So you can bring in like the energy.
Well, like, what is it that NSA has a 20 centers of university?
Yes, NSA, DHS.
Right.
Yeah.
So you've got this as well.
The center is of academic excellence.
So what I'm trying to do is go visit all of the minority serving institutions around the country because we're also trying to aggressively diversify, which I think is a not just a national, not just a moral imperative, but a national security imperative.
When you think about.
Yeah.
The importance.
Diversity of perspective.
Yeah, diversity of perspective, diversity of thought, that's how we solve problems, whether it's neurodiversity, diversity of gender identity, sexual preference, race, national origin, all of that equals diversity of thought.
Right.
And that's not where the government, it's like the administration is leaning into that, but that's not necessarily where the government started out.
Right.
So we got work to do, but it's all high, my two priorities, people partnership.
Because I'm facing this way.
I'm getting all these people.
Is anybody over here, this is the question that I'm just not in my line of sight.
Okay, so I'll go back over here.
Oh, in the middle, middle, oh, okay, middle.
Where are you?
Oh, behind the camera.
.
.
.
.
.
.
.
.
.
.
.
.
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
first high school intern, you know, partnering with organizations like NPower, partnering
with Girls Who Code, partnering with Girl Scouts.
So we are doing these things entrepreneurially, which is cool, right, but what I'm trying
to do is to ensure we can do them systematically and at scale.
So if there are great ideas about how we can partner, because I know there's probably a
lot of great folks who are doing things like this, you know, please come and work with
us on it.
Okay.
We have time for one last question, and then we've got to call a wrap on this.
If you're interested in policy-type questions...
Oh, yeah, we're doing some afterwards.
Yeah.
After this, in the policy track, we're doing a little policy meet-and-greet with some beer,
and so hopefully we'll continue conversations that you have, not just with Jen, but with
other people.
If there are other people in the policy community, Jags will probably be there.
So let's take the last question.
Gentleman in the blue.
It's not quite a question, but just inside of some lectures that I've been exposed to
as well, and it's two different things.
One is the danger that I'm reporting that Professor Shafiq Goldblatt is a very known
scientist.
And she said that she's very interested in policy-type questions.
She's more afraid from the power of the big data and knowledge, not of the governments,
but of the private companies that holds a lot of data about everyone.
And it relates to something you said earlier about those companies, Microsoft, for example.
I'm not from anybody.
I don't work for anyone.
But Microsoft at least declares that it's not competing with its customers.
It just provides them IT.
While we know other companies tend to become competitors with their own customers.
Like, you won't see a bank that might do something little.
You might see it in other companies that provide everybody IT.
That's one thing to think about that's a danger.
But look out for it.
Another lecture was interesting by Professor Amon Shashua from Columbia University.
He's a professor, not just a Mobileye broker or founder.
And he said that he published some research from the dangers of AI and machine learning.
So it's not just supervised machine learning, etc.
But you have to also moderate it afterwards.
You can give machine learning in general a good role.
Right.
So I think...
Make everybody happy.
I think that...
The way to get everybody happy is to make them stupid.
So stupid, you know, not very happy.
Well, I think...
The machine learning, if you put it into execution in a big scale, might become, like,
making everybody stupid, unproductive, and it's a great danger for the future.
I'm convinced that machine learning is used for all these algorithmically generated YouTube videos
that are just pursuing maximum clicks.
Which probably do produce a high stupidity quotient that maybe one day will rise to
a national security threat.
But that sounds like there's, you know, the AI and the quantum, there seems to be these
larger, bigger things out there on the horizon.
And sometimes private sector is not equipped to deal with them.
And that's where I think, again, role of government plays a role.
Totally.
So you get the last word in.
Gratitude.
Thank you.
Thank you for having me.
Thank you for the great questions and the time.
And, you know, if you want to learn more about CISA, if you want to work with us,
if you want to be part of us, please reach out.
And for those of you who use our products, please continue to give us feedback.
We really want to make sure that those are as helpful as possible.
And so we are really leaning forward into responsiveness and value added.
So thanks very much, everybody.
Thank you.
Thank you.
Thank you.