1 00:00:00,000 --> 00:00:01,590 - Today, we have Gaurav Keerthi, 2 00:00:01,590 --> 00:00:02,850 Pete Cooper and Lily Newman, 3 00:00:02,850 --> 00:00:05,700 talking about Global Challenges And Global Approaches 4 00:00:05,700 --> 00:00:06,810 In Cybersecurity Policy. 5 00:00:06,810 --> 00:00:07,950 Let's give them a warm welcome. 6 00:00:07,950 --> 00:00:09,093 Thank you. 7 00:00:09,093 --> 00:00:12,093 (audience applauds) 8 00:00:13,237 --> 00:00:14,600 - Hey, everyone. 9 00:00:14,600 --> 00:00:15,933 Can you hear me? 10 00:00:17,160 --> 00:00:17,993 Oh. 11 00:00:19,320 --> 00:00:20,463 Booming voice. 12 00:00:21,660 --> 00:00:25,080 Well, I'm so happy to see all of you here today. 13 00:00:25,080 --> 00:00:26,700 I'm Lily Hay Newman. 14 00:00:26,700 --> 00:00:30,450 I'm a senior writer at WIRED magazine, 15 00:00:30,450 --> 00:00:31,410 and this is 16 00:00:31,410 --> 00:00:35,970 Global Challenges, Global Approaches In Cyber Policy. 17 00:00:35,970 --> 00:00:39,630 And I'm just gonna introduce my other two panelists here, 18 00:00:39,630 --> 00:00:41,400 and then I'm gonna let them talk a little bit 19 00:00:41,400 --> 00:00:42,720 about what they do, 20 00:00:42,720 --> 00:00:45,960 because I think if I give too much of a preamble, 21 00:00:45,960 --> 00:00:47,667 we'll just go straight into it, 22 00:00:47,667 --> 00:00:50,610 and I wanna get a chance for you all to meet them. 23 00:00:50,610 --> 00:00:55,500 So, Pete Cooper is the Deputy Director of Cyber Defense 24 00:00:55,500 --> 00:00:57,210 in the UK Cabinet Office, 25 00:00:57,210 --> 00:00:59,490 and he's to my immediate right. 26 00:00:59,490 --> 00:01:01,140 And then, Gaurav Keerthi 27 00:01:01,140 --> 00:01:03,540 is the Deputy Chief Executive Officer 28 00:01:03,540 --> 00:01:06,330 of the Cybersecurity Agency of Singapore. 29 00:01:06,330 --> 00:01:08,400 So Gaurav, maybe we can start with you. 30 00:01:08,400 --> 00:01:10,380 Tell us what you do. 31 00:01:10,380 --> 00:01:11,213 - Thanks, Lee. 32 00:01:11,213 --> 00:01:12,270 So hi, everyone. 33 00:01:12,270 --> 00:01:14,640 My first time at DEF CON, super excited, 34 00:01:14,640 --> 00:01:16,590 and super excited for the policy track. 35 00:01:17,490 --> 00:01:18,720 Quick self-introduction. 36 00:01:18,720 --> 00:01:19,590 So I'm Gaurav. 37 00:01:19,590 --> 00:01:23,070 I am currently the Deputy Chief Executive 38 00:01:23,070 --> 00:01:24,090 of this organization called 39 00:01:24,090 --> 00:01:26,100 the Cybersecurity Agency of Singapore. 40 00:01:26,100 --> 00:01:27,510 It's a government agency. 41 00:01:27,510 --> 00:01:29,130 It straddles a number of roles. 42 00:01:29,130 --> 00:01:30,840 So we have an operational responsibility. 43 00:01:30,840 --> 00:01:33,480 Singapore's SERT, the emergency response team, 44 00:01:33,480 --> 00:01:34,560 comes under us. 45 00:01:34,560 --> 00:01:35,700 We also have a team 46 00:01:35,700 --> 00:01:38,040 that does development and infrastructure protection, 47 00:01:38,040 --> 00:01:40,470 so CISA's kind of roles comes under us. 48 00:01:40,470 --> 00:01:42,060 We also have an economic function, 49 00:01:42,060 --> 00:01:44,220 so we make sure that the talents 50 00:01:44,220 --> 00:01:45,870 are well-trained for cybersecurity. 51 00:01:45,870 --> 00:01:48,330 We look at the developing industry 52 00:01:48,330 --> 00:01:50,730 and the ecosystem around cybersecurity. 53 00:01:50,730 --> 00:01:52,920 So it straddles a number of different agencies, 54 00:01:52,920 --> 00:01:54,330 but it's all squeezed into one, 55 00:01:54,330 --> 00:01:56,530 and I'm the Deputy Chief Executive for that. 56 00:01:57,480 --> 00:01:58,650 My personal background, 57 00:01:58,650 --> 00:02:01,380 I studied computer science way back in the 90s, 58 00:02:01,380 --> 00:02:05,130 tripped and fell, became an Air Force pilot for 20 years. 59 00:02:05,130 --> 00:02:05,990 Loved it. 60 00:02:05,990 --> 00:02:07,260 And then the last part of my career, 61 00:02:07,260 --> 00:02:10,290 I ended up doing this thing called network security, 62 00:02:10,290 --> 00:02:12,030 which then led to cybersecurity, 63 00:02:12,030 --> 00:02:13,830 which is how I ended up here. 64 00:02:13,830 --> 00:02:15,270 And I love it. 65 00:02:15,270 --> 00:02:17,610 Specifically, my role in the organization 66 00:02:17,610 --> 00:02:20,370 is to bring tech and policy together. 67 00:02:20,370 --> 00:02:22,740 So I'm in charge of development, 68 00:02:22,740 --> 00:02:24,780 I have engineering teams that work for me. 69 00:02:24,780 --> 00:02:26,250 But a large part of what I end up doing 70 00:02:26,250 --> 00:02:28,800 is trying to translate the technical work, 71 00:02:28,800 --> 00:02:31,350 the technical challenges and the technical opportunities 72 00:02:31,350 --> 00:02:35,430 with emerging technology and the risks thereof into policy. 73 00:02:35,430 --> 00:02:37,620 And I'll talk a little bit more about that as we go along. 74 00:02:37,620 --> 00:02:38,453 That's me. 75 00:02:39,870 --> 00:02:41,490 - Pete, go for it. 76 00:02:41,490 --> 00:02:42,930 - So hi, I'm Pete Cooper. 77 00:02:42,930 --> 00:02:46,080 So I'm currently Deputy Director of Cyber Defense 78 00:02:46,080 --> 00:02:48,210 within the UK Cabinet Office, 79 00:02:48,210 --> 00:02:51,870 within the organization that looks after security 80 00:02:51,870 --> 00:02:53,340 for the whole of the UK government. 81 00:02:53,340 --> 00:02:56,940 So I look over basically all of the government departments 82 00:02:56,940 --> 00:02:58,980 and bits of the public sector, 83 00:02:58,980 --> 00:03:01,650 and on everything from cyber operations, 84 00:03:01,650 --> 00:03:05,700 so how we respond to Log4j, for example, 85 00:03:05,700 --> 00:03:10,700 through to strategy, policy, red team, standards, assurance 86 00:03:10,890 --> 00:03:14,073 and everything else in between. 87 00:03:15,510 --> 00:03:19,170 I also founded the Aerospace Village, 88 00:03:19,170 --> 00:03:21,090 so I know the DEF CON community. 89 00:03:21,090 --> 00:03:21,923 And actually, 90 00:03:21,923 --> 00:03:26,923 my journey with DEF CON started back in DEF CON 08 in 2000. 91 00:03:27,300 --> 00:03:30,690 Anybody in the room at DEF CON 08 in 2000? 92 00:03:31,710 --> 00:03:33,510 Okay, no- - Oh, I saw some hands. 93 00:03:33,510 --> 00:03:34,470 - Oh, I saw some hands. 94 00:03:34,470 --> 00:03:35,303 Okay. 95 00:03:35,303 --> 00:03:37,140 So my previous life before I got into cyber 96 00:03:37,140 --> 00:03:40,530 was I was also a pilot, but enjoyed all the technology. 97 00:03:40,530 --> 00:03:42,870 And I was actually doing a Flag up at Nellis, 98 00:03:42,870 --> 00:03:45,570 and DEF CON 08 rocked into the same hotel 99 00:03:45,570 --> 00:03:47,098 where we were staying. 100 00:03:47,098 --> 00:03:48,810 So for three days, 101 00:03:48,810 --> 00:03:50,760 I basically got drunk with all the hackers, 102 00:03:50,760 --> 00:03:51,720 and going, this is amazing. 103 00:03:51,720 --> 00:03:53,310 And they wanted to talk about flying 104 00:03:53,310 --> 00:03:54,300 and I wanted to talk about hacking, 105 00:03:54,300 --> 00:03:56,103 and then my DEF CON journey started. 106 00:03:57,090 --> 00:04:01,233 So it's just been a fantastic journey all the way through, 107 00:04:02,340 --> 00:04:05,790 and then getting involved with the Village. 108 00:04:05,790 --> 00:04:07,440 But again, fantastic to be here 109 00:04:07,440 --> 00:04:10,290 talking about how we do this better 110 00:04:10,290 --> 00:04:11,670 and pull the community together, 111 00:04:11,670 --> 00:04:14,010 either for policy, technology and security. 112 00:04:14,010 --> 00:04:15,060 - And Lily, before you continue, 113 00:04:15,060 --> 00:04:17,730 one random trivia fact which you might not know. 114 00:04:17,730 --> 00:04:22,730 So the previous speaker, Mr. Chris Inglis, was also a pilot. 115 00:04:22,740 --> 00:04:24,840 So if you ever wanna get into cyber policy, 116 00:04:24,840 --> 00:04:26,610 now the way to get in. 117 00:04:26,610 --> 00:04:28,680 - And actually I did say right at the start of this 118 00:04:28,680 --> 00:04:30,780 that whenever people talk about 119 00:04:30,780 --> 00:04:31,800 doing anything in cybersecurity, 120 00:04:31,800 --> 00:04:33,215 it always starts with a pilot study. 121 00:04:33,215 --> 00:04:35,220 So that's why you find so many pilots. 122 00:04:35,220 --> 00:04:37,560 That's my only joke, by the way. 123 00:04:37,560 --> 00:04:39,578 - Earlier, he said it was his worst joke. 124 00:04:39,578 --> 00:04:40,578 - Yeah, it is, yeah. 125 00:04:43,080 --> 00:04:44,430 - Thank you both, 126 00:04:44,430 --> 00:04:47,520 and would love to hear more stories about DEF CON 8 127 00:04:47,520 --> 00:04:48,453 at some point. 128 00:04:49,586 --> 00:04:50,836 - Probably not. 129 00:04:52,620 --> 00:04:57,090 - As we think about the daily grind 130 00:04:57,090 --> 00:05:00,600 of information security, of defense, 131 00:05:00,600 --> 00:05:04,650 this is network defense, institution defense, 132 00:05:04,650 --> 00:05:07,833 defense of individuals in cyberspace, 133 00:05:08,670 --> 00:05:12,210 you all out there are very familiar 134 00:05:12,210 --> 00:05:15,270 and involved daily with that. 135 00:05:15,270 --> 00:05:16,890 And I'm wondering if we could start 136 00:05:16,890 --> 00:05:21,840 by just talking about how, this is a big question, 137 00:05:21,840 --> 00:05:24,630 but how do we marry policy with that 138 00:05:24,630 --> 00:05:29,100 and how do we approach policies 139 00:05:29,100 --> 00:05:34,023 that resonate with that daily work? 140 00:05:36,982 --> 00:05:37,815 - Should we go for it? 141 00:05:37,815 --> 00:05:39,060 - Yeah, let's try. 142 00:05:39,060 --> 00:05:43,980 So how do we do policy for cyber defense broadly, I guess? 143 00:05:43,980 --> 00:05:48,980 - Or policy that aids and works together 144 00:05:49,830 --> 00:05:51,330 with that daily work, 145 00:05:51,330 --> 00:05:54,780 rather than imposing something or making things harder? 146 00:05:54,780 --> 00:05:56,220 How do we make things easier? 147 00:05:56,220 --> 00:05:59,610 - So I mean, it's an important question 148 00:05:59,610 --> 00:06:01,560 because I think part of the history 149 00:06:01,560 --> 00:06:03,150 of cybersecurity agencies 150 00:06:03,150 --> 00:06:06,240 came from regulatory authorities, audit inspection. 151 00:06:06,240 --> 00:06:07,470 And so there's always this fear 152 00:06:07,470 --> 00:06:10,530 that when a cybersecurity agency thinks about technology, 153 00:06:10,530 --> 00:06:12,390 they think of it from an audit perspective, 154 00:06:12,390 --> 00:06:14,160 from a regulatory governance perspective, 155 00:06:14,160 --> 00:06:16,950 how do I clamp down on their great idea 156 00:06:16,950 --> 00:06:19,380 and make it as cumbersome as possible? 157 00:06:19,380 --> 00:06:21,990 That is not ideal for everybody. 158 00:06:21,990 --> 00:06:22,980 Like I said at the start, 159 00:06:22,980 --> 00:06:25,620 we also have an economic function in my agency, 160 00:06:25,620 --> 00:06:28,020 so I have to make that balance internally as well. 161 00:06:28,020 --> 00:06:29,190 I wanna support innovation. 162 00:06:29,190 --> 00:06:31,110 I wanna support emerging technologies. 163 00:06:31,110 --> 00:06:32,970 I want 5G, I want AI, 164 00:06:32,970 --> 00:06:34,290 I want all those cool, fun things 165 00:06:34,290 --> 00:06:35,970 that are happening outside, 166 00:06:35,970 --> 00:06:37,260 I just want them to be secure. 167 00:06:37,260 --> 00:06:39,750 And that's a shared mission that we have at DEF CON as well. 168 00:06:39,750 --> 00:06:41,430 We were excited by autonomous vehicles, 169 00:06:41,430 --> 00:06:43,320 we just want them to be secure. 170 00:06:43,320 --> 00:06:45,120 How do you marry it together? 171 00:06:45,120 --> 00:06:47,790 Part of it involves having conversations like this. 172 00:06:47,790 --> 00:06:50,610 Part of it involves having people with the technology, 173 00:06:50,610 --> 00:06:53,610 not just background, but passion, coming into policy 174 00:06:53,610 --> 00:06:56,310 and people with the policy background coming into tech. 175 00:06:56,310 --> 00:06:58,080 We see that more and more. 176 00:06:58,080 --> 00:07:01,680 And especially in smaller countries, 177 00:07:01,680 --> 00:07:04,110 I use Singapore as the obvious example, 178 00:07:04,110 --> 00:07:06,570 we don't have the depth of talent 179 00:07:06,570 --> 00:07:08,370 to have multiple organizations 180 00:07:08,370 --> 00:07:10,620 focusing on different parts of the conversation, 181 00:07:10,620 --> 00:07:13,320 so we just squash them all to one place. 182 00:07:13,320 --> 00:07:16,110 And what was actually a limitation 183 00:07:16,110 --> 00:07:17,550 now becomes an opportunity. 184 00:07:17,550 --> 00:07:20,700 You're too small to have 11 agencies looking at cyber, 185 00:07:20,700 --> 00:07:23,310 so that one agency now has that centralized focus 186 00:07:23,310 --> 00:07:25,200 and that trade-off inside. 187 00:07:25,200 --> 00:07:26,520 Two quick points on that. 188 00:07:26,520 --> 00:07:29,103 The first is, how do we do policy? 189 00:07:30,060 --> 00:07:32,190 It starts by recognizing that defending a country 190 00:07:32,190 --> 00:07:34,320 is not the same as defending an enterprise. 191 00:07:34,320 --> 00:07:35,910 A lot of CSOs come into, 192 00:07:35,910 --> 00:07:37,890 or we have conversations with CSOs are they're like, 193 00:07:37,890 --> 00:07:39,210 well, I'm really good at defending 194 00:07:39,210 --> 00:07:41,790 a multinational corporation, a big enterprise. 195 00:07:41,790 --> 00:07:42,990 It's not the same. 196 00:07:42,990 --> 00:07:44,160 You don't control the assets, 197 00:07:44,160 --> 00:07:45,990 you don't control the network topology, 198 00:07:45,990 --> 00:07:48,480 you don't control anything actually as a country. 199 00:07:48,480 --> 00:07:50,220 You just inherit whatever's around you 200 00:07:50,220 --> 00:07:52,170 and it's connected to whatever it's connected to, 201 00:07:52,170 --> 00:07:54,720 and you have to grapple with that. 202 00:07:54,720 --> 00:07:57,540 And you don't get to boss people around either. 203 00:07:57,540 --> 00:07:59,220 I can't disconnect my citizens, 204 00:07:59,220 --> 00:08:00,990 I have to deal with the citizens that I have. 205 00:08:00,990 --> 00:08:03,900 And as much as I'd love them to use strong passwords, 206 00:08:03,900 --> 00:08:05,280 if they don't want to, 207 00:08:05,280 --> 00:08:06,930 that is still a choice that they make. 208 00:08:06,930 --> 00:08:09,000 And so there's a whole bunch of differences. 209 00:08:09,000 --> 00:08:11,700 And you have to understand the ecosystem, 210 00:08:11,700 --> 00:08:14,760 the people, the individuals, the technology well 211 00:08:14,760 --> 00:08:16,173 in order to do policy well. 212 00:08:17,310 --> 00:08:19,043 - Yeah, I mean, I'd agree with that. 213 00:08:21,180 --> 00:08:23,733 You can have the best tech idea in the world, 214 00:08:26,130 --> 00:08:27,810 but if you wanna roll out at scale, 215 00:08:27,810 --> 00:08:30,660 you can only do that if you marry it with amazing policy. 216 00:08:31,800 --> 00:08:36,240 And that's where there has got to be a good dialogue 217 00:08:36,240 --> 00:08:38,730 so that we can actually put the right things in place 218 00:08:38,730 --> 00:08:39,723 that roll out. 219 00:08:41,130 --> 00:08:42,990 And on your point, I completely agree, 220 00:08:42,990 --> 00:08:44,970 is that enterprise-scale change 221 00:08:44,970 --> 00:08:46,650 is different to sector-scale change, 222 00:08:46,650 --> 00:08:49,620 which is what we look at from a government perspective. 223 00:08:49,620 --> 00:08:52,413 So if you are trying to change an entire sector, 224 00:08:53,550 --> 00:08:54,383 when you sit in the center 225 00:08:54,383 --> 00:08:55,290 and you look around and you think, 226 00:08:55,290 --> 00:08:57,120 well, the levers have changed, they're are amazing. 227 00:08:57,120 --> 00:08:58,620 It's like, they're really not. 228 00:08:59,460 --> 00:09:00,450 They're really challenging 229 00:09:00,450 --> 00:09:01,683 because it's about behavior change, 230 00:09:01,683 --> 00:09:04,323 it's about helping make people do the right thing. 231 00:09:05,640 --> 00:09:08,160 And that's one of the mantras that we had 232 00:09:08,160 --> 00:09:08,993 in the Cabinet Office 233 00:09:08,993 --> 00:09:11,070 doing a lot of the change around the government, 234 00:09:11,070 --> 00:09:14,610 which was, if we build the right thing, people will come. 235 00:09:14,610 --> 00:09:17,070 So if we have really poor policies, 236 00:09:17,070 --> 00:09:19,710 if we put really poor standards out there, 237 00:09:19,710 --> 00:09:22,290 nobody's gonna be interested, everyone's gonna fight back. 238 00:09:22,290 --> 00:09:24,300 And therefore, what we put in place 239 00:09:24,300 --> 00:09:25,950 has to work for everybody. 240 00:09:25,950 --> 00:09:27,570 But the way that we get there 241 00:09:27,570 --> 00:09:30,540 is by having a really good, diverse community of people 242 00:09:30,540 --> 00:09:31,800 feeding into it. 243 00:09:31,800 --> 00:09:33,870 So not just from the government space, 244 00:09:33,870 --> 00:09:37,440 but also from the hacker community, also from industry, 245 00:09:37,440 --> 00:09:38,400 and getting everyone to come in 246 00:09:38,400 --> 00:09:40,110 and talk about what good looks like, 247 00:09:40,110 --> 00:09:42,390 so we can actually lift our head to the horizon 248 00:09:42,390 --> 00:09:43,680 instead of running when looking at our feet 249 00:09:43,680 --> 00:09:45,090 when it comes to technology. 250 00:09:45,090 --> 00:09:48,363 So for the development of the UK government Cyber Strategy 251 00:09:48,363 --> 00:09:50,160 that we launched back in January, 252 00:09:50,160 --> 00:09:52,170 got signed-off by the Prime Minister, 253 00:09:52,170 --> 00:09:55,050 we had a challenge panel that basically, 254 00:09:55,050 --> 00:09:56,550 I brought a whole bunch of people in, 255 00:09:56,550 --> 00:09:58,590 including people from the hacker community, 256 00:09:58,590 --> 00:10:02,970 and I've never quite heard so many F-bombs on a call before 257 00:10:02,970 --> 00:10:04,590 from a government call, 258 00:10:04,590 --> 00:10:06,510 but it was great to have the perspectives in there. 259 00:10:06,510 --> 00:10:08,790 And we ended up getting some really good dialogue 260 00:10:08,790 --> 00:10:10,950 because we broadened out those perspectives, 261 00:10:10,950 --> 00:10:14,850 because your worldview, your horizon, 262 00:10:14,850 --> 00:10:17,220 the more you can expand that by talking to amazing people 263 00:10:17,220 --> 00:10:18,540 and having amazing conversations, 264 00:10:18,540 --> 00:10:21,900 the better solutions you have, be they technical or policy. 265 00:10:21,900 --> 00:10:23,670 - And actually, 266 00:10:23,670 --> 00:10:25,830 so Singapore shamelessly copies from other countries 267 00:10:25,830 --> 00:10:28,440 because other countries do so much thinking, 268 00:10:28,440 --> 00:10:29,460 they don't wanna reinvent the wheel. 269 00:10:29,460 --> 00:10:32,760 So a lot of what UK's put into the thinking 270 00:10:32,760 --> 00:10:34,380 for their strategy, we look at it and we'll say, 271 00:10:34,380 --> 00:10:36,810 okay, a multi-stakeholder approach makes so much sense. 272 00:10:36,810 --> 00:10:38,070 We should do the same thing. 273 00:10:38,070 --> 00:10:39,240 US is doing the same thing. 274 00:10:39,240 --> 00:10:42,180 And I want to add one dimension to it 275 00:10:42,180 --> 00:10:45,213 that has challenged government a little bit. 276 00:10:46,140 --> 00:10:51,120 In most domains of governance, aviation for example, 277 00:10:51,120 --> 00:10:53,970 government owns the airspace above the country. 278 00:10:53,970 --> 00:10:57,330 As a government, I can dictate what happens in the airspace, 279 00:10:57,330 --> 00:10:58,830 what flies, what doesn't fly, 280 00:10:58,830 --> 00:11:01,953 because we the government own that airspace. 281 00:11:03,000 --> 00:11:07,260 In the sand, the sea, all the natural domains, 282 00:11:07,260 --> 00:11:09,420 they existed before companies existed 283 00:11:09,420 --> 00:11:12,480 and they will exist after companies long cease to exist. 284 00:11:12,480 --> 00:11:14,520 That's not true for the Internet. 285 00:11:14,520 --> 00:11:19,353 In the Internet, the government doesn't own most things. 286 00:11:20,220 --> 00:11:21,930 Most of the infrastructure, most of the hardware, 287 00:11:21,930 --> 00:11:24,240 most of the software, is owned by private companies. 288 00:11:24,240 --> 00:11:26,910 So it's unlike soil, it's unlike sea. 289 00:11:26,910 --> 00:11:28,590 The second part that's different 290 00:11:28,590 --> 00:11:31,950 is that, actually, it's not even in your country. 291 00:11:31,950 --> 00:11:34,860 The infrastructure that you want to govern is international. 292 00:11:34,860 --> 00:11:37,560 That is the definition and the nature of the Internet. 293 00:11:37,560 --> 00:11:38,820 And so when you want to govern it 294 00:11:38,820 --> 00:11:40,620 in your geographical boundary, 295 00:11:40,620 --> 00:11:42,090 the network topology of the Internet 296 00:11:42,090 --> 00:11:44,060 doesn't fit neatly with that. 297 00:11:44,060 --> 00:11:47,280 So you have to unlock many of the traditional mental models 298 00:11:47,280 --> 00:11:48,750 that governments have had about, 299 00:11:48,750 --> 00:11:51,390 I am going to govern my geographical boundary, 300 00:11:51,390 --> 00:11:52,740 because you can't do that with the Internet, 301 00:11:52,740 --> 00:11:54,090 you have to work with other people. 302 00:11:54,090 --> 00:11:55,290 And those other people are companies, 303 00:11:55,290 --> 00:11:57,526 they're hackers, they're other countries. 304 00:11:57,526 --> 00:12:00,243 And there's so much more depth in that conversation. 305 00:12:01,500 --> 00:12:02,333 - Yeah. 306 00:12:02,333 --> 00:12:03,300 No, thank you for bringing that up 307 00:12:03,300 --> 00:12:06,031 because I was going to say, 308 00:12:06,031 --> 00:12:10,740 I wanna make this concrete a little more by asking you both 309 00:12:10,740 --> 00:12:13,530 to talk a little bit about maybe some examples 310 00:12:13,530 --> 00:12:15,330 of triumphs or fails, 311 00:12:15,330 --> 00:12:18,690 things that you learned from in policy 312 00:12:18,690 --> 00:12:21,732 or things that are working really well. 313 00:12:21,732 --> 00:12:24,570 You already started giving one example, 314 00:12:24,570 --> 00:12:27,220 but I think it's great to frame it 315 00:12:28,915 --> 00:12:31,590 in that way you were saying, Gaurav, that, 316 00:12:31,590 --> 00:12:34,170 how do you make the triumphs 317 00:12:34,170 --> 00:12:36,450 so that everyone is being served 318 00:12:36,450 --> 00:12:40,230 and everyone is able to come together on that? 319 00:12:40,230 --> 00:12:42,000 So yeah, maybe give us some examples 320 00:12:42,000 --> 00:12:44,703 just 'cause this can all be very abstract, I think. 321 00:12:45,567 --> 00:12:48,120 - Yeah, I mean, I think one of the examples 322 00:12:48,120 --> 00:12:50,730 that I'm most proud of that I did before I joined government 323 00:12:50,730 --> 00:12:54,360 was I got involved in, 324 00:12:54,360 --> 00:12:58,950 how do we make aviation aerospace a lot more secure? 325 00:12:58,950 --> 00:13:00,450 And one of those questions that we got into 326 00:13:00,450 --> 00:13:02,730 was that the relationship between 327 00:13:02,730 --> 00:13:05,670 a lot of the aerospace industry type world 328 00:13:05,670 --> 00:13:07,620 and the researcher hacker community 329 00:13:07,620 --> 00:13:09,360 was actually quite an adversarial one. 330 00:13:09,360 --> 00:13:11,370 So that's one of the reasons that we built the Village 331 00:13:11,370 --> 00:13:13,110 and started building bridges and communities 332 00:13:13,110 --> 00:13:14,160 and things like that. 333 00:13:15,420 --> 00:13:17,220 But for me, 334 00:13:17,220 --> 00:13:20,430 whenever I'm trying to look at how do we make things better, 335 00:13:20,430 --> 00:13:23,160 it's, what's biggest scale we can go 336 00:13:23,160 --> 00:13:24,420 to have the most impact? 337 00:13:24,420 --> 00:13:28,410 Because we can fiddle around at lower levels, 338 00:13:28,410 --> 00:13:29,700 but the more that we can get impact 339 00:13:29,700 --> 00:13:31,860 and lay out what good looks like at senior level, 340 00:13:31,860 --> 00:13:32,700 the better. 341 00:13:32,700 --> 00:13:35,650 So at one point I found myself on the keyboard 342 00:13:37,290 --> 00:13:42,290 writing the ICAO, which is the UN body for aviation, 343 00:13:42,389 --> 00:13:44,310 and they were writing their first ever 344 00:13:44,310 --> 00:13:46,470 Global Aviation Cybersecurity Strategy. 345 00:13:46,470 --> 00:13:48,660 So think, 193 different nations 346 00:13:48,660 --> 00:13:50,310 signed off by the Secretary General, 347 00:13:50,310 --> 00:13:52,140 industry bodies and everything like that in there as well, 348 00:13:52,140 --> 00:13:53,280 and they wanted to get a view 349 00:13:53,280 --> 00:13:55,560 of what good looks like for states 350 00:13:55,560 --> 00:13:58,060 when it comes to aviation aerospace cybersecurity. 351 00:13:59,460 --> 00:14:01,863 And I managed to get a line in there which was, 352 00:14:02,910 --> 00:14:05,460 states are encouraged to set up appropriate mechanisms 353 00:14:05,460 --> 00:14:08,760 for cooperation with good faith security research. 354 00:14:08,760 --> 00:14:09,840 Because we've got to start 355 00:14:09,840 --> 00:14:12,810 driving this top-down at scale internationally, 356 00:14:12,810 --> 00:14:13,860 to start normalizing 357 00:14:13,860 --> 00:14:16,410 the fact that if you're in your organization, 358 00:14:16,410 --> 00:14:18,600 you don't have all of the answers. 359 00:14:18,600 --> 00:14:20,970 You've gotta be working collaboratively and positively 360 00:14:20,970 --> 00:14:23,340 with the security research and hacker community. 361 00:14:23,340 --> 00:14:25,200 So we managed to get that line in 362 00:14:25,200 --> 00:14:27,960 and get it signed off by UN body, 193 different nations, 363 00:14:27,960 --> 00:14:29,610 and then start cascading out 364 00:14:29,610 --> 00:14:32,190 so when these states are thinking about their strategies, 365 00:14:32,190 --> 00:14:34,380 they've got this in the forefront of their mind. 366 00:14:34,380 --> 00:14:36,750 But having the right people in the room 367 00:14:36,750 --> 00:14:39,120 when those sorts of discussions are happening, 368 00:14:39,120 --> 00:14:40,410 so the policies and the strategies, 369 00:14:40,410 --> 00:14:43,110 have the right people in the room to get these perspectives, 370 00:14:43,110 --> 00:14:44,100 is really critical. 371 00:14:44,100 --> 00:14:46,980 And we can only really do that by building bridges, 372 00:14:46,980 --> 00:14:47,940 being really collaborative 373 00:14:47,940 --> 00:14:50,340 and being really open with our conversations. 374 00:14:50,340 --> 00:14:51,870 - Yeah, no, I love that. 375 00:14:51,870 --> 00:14:53,100 Again, 376 00:14:53,100 --> 00:14:55,953 so the aviation industry is a much more mature industry 377 00:14:55,953 --> 00:14:58,590 when it comes to thinking about safety and security 378 00:14:58,590 --> 00:15:00,960 because the consequences of not taking those seriously 379 00:15:00,960 --> 00:15:02,763 are pretty disastrous. 380 00:15:03,780 --> 00:15:05,700 And the conversations that he mentioned, 381 00:15:05,700 --> 00:15:08,160 ICAO, which is that UN body, 382 00:15:08,160 --> 00:15:10,380 are very similar to the conversations 383 00:15:10,380 --> 00:15:12,480 that we're having at the UN now as well. 384 00:15:12,480 --> 00:15:14,070 So there is an open-ended working group 385 00:15:14,070 --> 00:15:16,590 that discusses the norms of responsible behavior 386 00:15:16,590 --> 00:15:17,850 on the Internet. 387 00:15:17,850 --> 00:15:19,200 It has a long complicated name, 388 00:15:19,200 --> 00:15:22,113 but roughly it's basically about cybersecurity. 389 00:15:23,160 --> 00:15:25,140 Singapore happens to chair it for this cycle, 390 00:15:25,140 --> 00:15:26,970 and it's a fascinating conversation 391 00:15:26,970 --> 00:15:29,340 because you have 193 different countries. 392 00:15:29,340 --> 00:15:32,280 Some of these countries are just getting on the Internet. 393 00:15:32,280 --> 00:15:34,710 They're trying to figure out what the Internet is 394 00:15:34,710 --> 00:15:36,270 and what it means to them. 395 00:15:36,270 --> 00:15:38,790 Some of these countries are extremely sophisticated, 396 00:15:38,790 --> 00:15:40,560 very advanced users of the Internet. 397 00:15:40,560 --> 00:15:42,780 How do you define baseline norms of security? 398 00:15:42,780 --> 00:15:45,690 How do you encourage good behavior on the Internet 399 00:15:45,690 --> 00:15:48,510 for 193 vastly different countries? 400 00:15:48,510 --> 00:15:51,360 And so one of the successes and failures 401 00:15:51,360 --> 00:15:53,940 is that this is a really complicated process, 402 00:15:53,940 --> 00:15:55,800 made even more complicated 403 00:15:55,800 --> 00:15:57,930 by current geopolitical realities, 404 00:15:57,930 --> 00:16:01,170 that the world is not all wonderful and peaceful. 405 00:16:01,170 --> 00:16:03,480 So that conversation is really difficult, 406 00:16:03,480 --> 00:16:04,470 but it's a really important one 407 00:16:04,470 --> 00:16:06,540 because if you can get these lines in, 408 00:16:06,540 --> 00:16:09,150 if you can start shaping subtle behaviors on the ground 409 00:16:09,150 --> 00:16:11,160 at each country, at each region's level, 410 00:16:11,160 --> 00:16:13,260 you've got a huge opportunity to move forward. 411 00:16:13,260 --> 00:16:15,660 And so Singapore does sometimes put up ideas. 412 00:16:15,660 --> 00:16:18,180 We have a massive government bug bounty program, 413 00:16:18,180 --> 00:16:19,800 very proud of it. 414 00:16:19,800 --> 00:16:20,790 It took a lot of effort 415 00:16:20,790 --> 00:16:22,937 from my colleagues over at the Government Technology Agency 416 00:16:22,937 --> 00:16:23,820 to get it through 417 00:16:23,820 --> 00:16:26,520 because there's this natural aversion to, 418 00:16:26,520 --> 00:16:29,070 well, if we're opening ourselves up to the hackers 419 00:16:29,070 --> 00:16:30,000 then it's terrible. 420 00:16:30,000 --> 00:16:31,590 We will find all these vulnerabilities. 421 00:16:31,590 --> 00:16:33,390 It's better that the good guys find it 422 00:16:33,390 --> 00:16:34,920 before the bad guys find it. 423 00:16:34,920 --> 00:16:36,180 We all know that, 424 00:16:36,180 --> 00:16:38,430 policymakers take some time to understand it. 425 00:16:38,430 --> 00:16:42,570 I'm just gonna give two examples of, I think, successes. 426 00:16:42,570 --> 00:16:43,403 The first one 427 00:16:43,403 --> 00:16:46,350 is that we had a huge challenge with passwords, 428 00:16:46,350 --> 00:16:48,270 and I think every country does. 429 00:16:48,270 --> 00:16:51,090 So what we did in a typical civil servant response 430 00:16:51,090 --> 00:16:53,340 was we put up these billboards all over the country, like, 431 00:16:53,340 --> 00:16:56,040 Use Strong Passwords, Use Long Passwords. 432 00:16:56,040 --> 00:16:57,210 And we told everybody. 433 00:16:57,210 --> 00:16:58,410 And so when we did our surveys, 434 00:16:58,410 --> 00:16:59,970 everybody's like, yeah, 435 00:16:59,970 --> 00:17:00,803 we would ask them, 436 00:17:00,803 --> 00:17:02,340 do you know what a strong password looks like? 437 00:17:02,340 --> 00:17:03,870 And it was 90%, that would go like, 438 00:17:03,870 --> 00:17:05,670 yeah, we know what a good password looks like. 439 00:17:05,670 --> 00:17:06,503 Do you use them? 440 00:17:08,280 --> 00:17:09,630 Sometimes I add an exclamation mark 441 00:17:09,630 --> 00:17:10,560 to the password one two three 442 00:17:10,560 --> 00:17:12,420 if I really want it to be very strong. 443 00:17:12,420 --> 00:17:13,950 And we had this problem every year. 444 00:17:13,950 --> 00:17:15,420 People knew what a strong password was, 445 00:17:15,420 --> 00:17:17,310 they just refused to use it. 446 00:17:17,310 --> 00:17:18,960 Eventually, we gave up. 447 00:17:18,960 --> 00:17:21,270 We decided, look, as a government, 448 00:17:21,270 --> 00:17:22,290 all of the government websites, 449 00:17:22,290 --> 00:17:24,180 we just won't use passwords anymore. 450 00:17:24,180 --> 00:17:26,640 We will just build a big-ass app 451 00:17:26,640 --> 00:17:29,130 that does national biometric authentication 452 00:17:29,130 --> 00:17:31,530 for the whole country and use that. 453 00:17:31,530 --> 00:17:34,170 So it's no longer, use strong passwords, use long passwords, 454 00:17:34,170 --> 00:17:36,450 it's just, look at your phone. 455 00:17:36,450 --> 00:17:37,283 That's it. 456 00:17:37,283 --> 00:17:39,420 Just look at your phone and we'll log you into your taxes, 457 00:17:39,420 --> 00:17:41,820 we'll log you into your vehicle, 458 00:17:41,820 --> 00:17:43,500 we'll log you into your education records. 459 00:17:43,500 --> 00:17:45,840 Whatever you need to do, just look at your phone. 460 00:17:45,840 --> 00:17:48,120 And this solved so many of our problems 461 00:17:48,120 --> 00:17:50,490 because if we tackled the policy problem 462 00:17:50,490 --> 00:17:52,230 purely on a policy approach 463 00:17:52,230 --> 00:17:53,550 without thinking of the opportunities 464 00:17:53,550 --> 00:17:55,860 that technology could bring to the conversation, 465 00:17:55,860 --> 00:17:57,540 we'd keep banging our head against the wall, like, 466 00:17:57,540 --> 00:17:58,770 oh, these users are terrible. 467 00:17:58,770 --> 00:18:00,420 They're all using weak passwords. 468 00:18:00,420 --> 00:18:02,370 They're all getting accounts compromised. 469 00:18:02,370 --> 00:18:05,280 But when you think about how technology can fix that, 470 00:18:05,280 --> 00:18:07,030 there's so much potential in there. 471 00:18:08,790 --> 00:18:11,310 - Yeah, there's a bunch of things I wanna jump off of 472 00:18:11,310 --> 00:18:12,390 from what both of you said. 473 00:18:12,390 --> 00:18:14,610 But first, I'm thinking about, 474 00:18:14,610 --> 00:18:15,780 you were both talking about 475 00:18:15,780 --> 00:18:17,790 incorporating different perspectives, 476 00:18:17,790 --> 00:18:22,790 regional perspectives, different levels of digitization 477 00:18:23,820 --> 00:18:27,990 or a state that the population 478 00:18:27,990 --> 00:18:32,190 is more predominantly on mobile, all these differences. 479 00:18:32,190 --> 00:18:33,360 Can you talk a little more 480 00:18:33,360 --> 00:18:37,170 about how do we get the right people in the right rooms? 481 00:18:37,170 --> 00:18:40,050 How do we do the bridge-building? 482 00:18:40,050 --> 00:18:41,943 Let's dive into that a little more. 483 00:18:43,710 --> 00:18:45,330 - It's hard. 484 00:18:45,330 --> 00:18:47,850 You've gotta get the right person in the room first 485 00:18:47,850 --> 00:18:50,730 that says there needs to be way more people here, 486 00:18:50,730 --> 00:18:53,190 and this needs to be a much more open discussion. 487 00:18:53,190 --> 00:18:54,810 I mean, you look at any of the work 488 00:18:54,810 --> 00:18:57,720 that Beau and Josh have done around I Am The Cavalry 489 00:18:57,720 --> 00:19:00,063 and creating amazing communities 490 00:19:00,063 --> 00:19:04,410 to talk about and pushing on medical device security, 491 00:19:04,410 --> 00:19:05,700 and then bringing in companies to say 492 00:19:05,700 --> 00:19:06,870 look, we need to talk about this, 493 00:19:06,870 --> 00:19:09,240 and creating that safe space to go, 494 00:19:09,240 --> 00:19:12,330 this is not gonna be us criticizing you. 495 00:19:12,330 --> 00:19:15,060 Or, this is about talking about these honestly, 496 00:19:15,060 --> 00:19:15,990 and realistically, 497 00:19:15,990 --> 00:19:18,060 where are we in building the bridge? 498 00:19:18,060 --> 00:19:18,893 But a lot of that 499 00:19:18,893 --> 00:19:20,370 will come down to getting the terminology right 500 00:19:20,370 --> 00:19:22,650 so that people have the right perspectives 501 00:19:22,650 --> 00:19:24,780 when they're going into that conversation. 502 00:19:24,780 --> 00:19:26,460 And you and I have spoken about this, 503 00:19:26,460 --> 00:19:30,690 that I have a real love-hate relationship 504 00:19:30,690 --> 00:19:32,160 around the word Hacker, 505 00:19:32,160 --> 00:19:36,480 because I see it used so many times as a term of bad. 506 00:19:36,480 --> 00:19:37,470 I mean, how many headlines do you see, 507 00:19:37,470 --> 00:19:39,180 Hackers have done this? 508 00:19:39,180 --> 00:19:41,790 We don't turn around and look at the headline saying, 509 00:19:41,790 --> 00:19:43,680 All Drivers Cause Crashes, 510 00:19:43,680 --> 00:19:46,080 All Drivers Are Drunk Drivers. 511 00:19:46,080 --> 00:19:48,600 Why on earth do we let people 512 00:19:48,600 --> 00:19:51,000 use the word Hacker as a bad thing most of the time. 513 00:19:51,000 --> 00:19:53,310 So we've gotta get the to terminology right 514 00:19:53,310 --> 00:19:55,920 and we've gotta have the discussions framed in such a way 515 00:19:55,920 --> 00:19:57,690 that it's a positive one, 516 00:19:57,690 --> 00:19:58,770 not seen as a bad one. 517 00:19:58,770 --> 00:20:00,960 Because then it starts breaking down the barriers 518 00:20:00,960 --> 00:20:01,980 a little bit more 519 00:20:01,980 --> 00:20:04,860 and it turns into a productive one 520 00:20:04,860 --> 00:20:07,230 where you can say to organizations, 521 00:20:07,230 --> 00:20:09,360 it's like, the worldview you have 522 00:20:09,360 --> 00:20:12,360 isn't quite the worldview you think you have. 523 00:20:12,360 --> 00:20:13,470 And actually here's some people here 524 00:20:13,470 --> 00:20:15,690 that can talk about what reality really looks like 525 00:20:15,690 --> 00:20:17,790 and what the adversary sees about your network. 526 00:20:17,790 --> 00:20:19,563 It can be as simple as that. 527 00:20:20,880 --> 00:20:21,720 - Yeah. 528 00:20:21,720 --> 00:20:25,980 So we live in an unusual neighborhood in ASEAN, 529 00:20:25,980 --> 00:20:27,960 the Association of Southeast Asian Nations. 530 00:20:27,960 --> 00:20:29,640 There are 10 countries. 531 00:20:29,640 --> 00:20:31,590 Every different type of political system 532 00:20:31,590 --> 00:20:34,200 that you can think of, we have that. 533 00:20:34,200 --> 00:20:37,470 Every stage of economic development, we've got that. 534 00:20:37,470 --> 00:20:39,390 And each country actually has a different language. 535 00:20:39,390 --> 00:20:42,240 So we are a very diverse region. 536 00:20:42,240 --> 00:20:43,500 And yet, 537 00:20:43,500 --> 00:20:46,650 we're also the only region to subscribe to the norms 538 00:20:46,650 --> 00:20:49,200 of responsible behavior from the UN. 539 00:20:49,200 --> 00:20:52,590 We're also the only region that has, for 17 years, 540 00:20:52,590 --> 00:20:57,390 run exercises across the countries, SERT to SERT. 541 00:20:57,390 --> 00:21:00,390 And it has now become operationally a habit. 542 00:21:00,390 --> 00:21:03,960 If I see Log4j IOCs, 543 00:21:03,960 --> 00:21:05,760 I will immediately tell my SERT 544 00:21:05,760 --> 00:21:07,350 to pick up the phone and call 545 00:21:07,350 --> 00:21:09,090 all of the other regional SERTs 546 00:21:09,090 --> 00:21:10,890 and let them know this is what we're seeing. 547 00:21:10,890 --> 00:21:12,510 It takes 17 years. 548 00:21:12,510 --> 00:21:14,370 It takes regular practice. 549 00:21:14,370 --> 00:21:15,840 So despite all of the difference, 550 00:21:15,840 --> 00:21:18,510 it is possible to bring diverse countries together. 551 00:21:18,510 --> 00:21:20,790 But let me share a little bit about how and why 552 00:21:20,790 --> 00:21:22,680 that happens and how it works. 553 00:21:22,680 --> 00:21:23,513 You have to start 554 00:21:23,513 --> 00:21:25,290 by recognizing that countries are coming at the problem 555 00:21:25,290 --> 00:21:26,520 from a very different lens 556 00:21:26,520 --> 00:21:28,500 or a very different angle each time. 557 00:21:28,500 --> 00:21:30,870 You take Costa Rica as a perfect example. 558 00:21:30,870 --> 00:21:31,703 Six months ago, 559 00:21:31,703 --> 00:21:34,110 I think they wouldn't be interested in cybersecurity, 560 00:21:34,110 --> 00:21:35,010 they wouldn't be in this room, 561 00:21:35,010 --> 00:21:38,070 they wouldn't be at all part of the conversation. 562 00:21:38,070 --> 00:21:39,000 And to some extent, 563 00:21:39,000 --> 00:21:44,000 when we think about talking about cyber threats, 564 00:21:44,130 --> 00:21:46,260 the language that we used, and going back to terminology, 565 00:21:46,260 --> 00:21:47,460 the language that we used 566 00:21:47,460 --> 00:21:49,170 in the previous era of cybersecurity 567 00:21:49,170 --> 00:21:51,150 was state-sponsored threats. 568 00:21:51,150 --> 00:21:53,280 Big, bad guys going after your country. 569 00:21:53,280 --> 00:21:55,320 And if you're Costa Rica, you're relatively harmless. 570 00:21:55,320 --> 00:21:56,790 No big bad guys are going after you 571 00:21:56,790 --> 00:21:58,620 so you don't really care about cybersecurity. 572 00:21:58,620 --> 00:22:00,331 But ransomware isn't like that. 573 00:22:00,331 --> 00:22:01,800 Ransomware is just going after anybody, 574 00:22:01,800 --> 00:22:03,210 anybody who's willing to pay. 575 00:22:03,210 --> 00:22:05,880 And so in some perverse, ironic way, 576 00:22:05,880 --> 00:22:08,310 ransomware has actually democratized the conversation 577 00:22:08,310 --> 00:22:11,703 about cyber defenses, about protecting your country, 578 00:22:12,660 --> 00:22:16,053 even more so because smaller countries have less depth. 579 00:22:17,310 --> 00:22:19,440 A big country like US has, I don't know, 580 00:22:19,440 --> 00:22:22,050 100 power grids, 100 different water stations, 581 00:22:22,050 --> 00:22:23,550 100 everything else. 582 00:22:23,550 --> 00:22:26,430 Singapore is tiny, we're 40 kilometers by 20 kilometers. 583 00:22:26,430 --> 00:22:28,410 I don't have 100 power grids. 584 00:22:28,410 --> 00:22:31,170 I don't have the buffer and the redundancies 585 00:22:31,170 --> 00:22:34,380 to allow seven or eight of my power grids to get hacked. 586 00:22:34,380 --> 00:22:38,220 And so each station, each essential service 587 00:22:38,220 --> 00:22:39,870 becomes so much more critical. 588 00:22:39,870 --> 00:22:42,000 And that conversation for ransomware now, 589 00:22:42,000 --> 00:22:43,320 you put those two together, 590 00:22:43,320 --> 00:22:45,900 small countries take cybersecurity much more seriously 591 00:22:45,900 --> 00:22:47,010 in an incident. 592 00:22:47,010 --> 00:22:49,920 And understanding that, framing that for them, 593 00:22:49,920 --> 00:22:54,360 making them realize that Costa Rica wasn't targeted, 594 00:22:54,360 --> 00:22:57,900 it was just a target, that changes the way 595 00:22:57,900 --> 00:22:59,190 that developing countries think about it, 596 00:22:59,190 --> 00:23:01,830 because then they realize that they don't have a choice. 597 00:23:01,830 --> 00:23:03,960 You don't get to pick if you're a target, 598 00:23:03,960 --> 00:23:07,440 and you don't get to pick how, when, why, where. 599 00:23:07,440 --> 00:23:09,360 But you have to be ready for it and you have to be prepared. 600 00:23:09,360 --> 00:23:10,980 And then they're a bit more receptive 601 00:23:10,980 --> 00:23:12,600 to having that conversation. 602 00:23:12,600 --> 00:23:16,260 So I think there are enough crises in the world. 603 00:23:16,260 --> 00:23:19,920 We should use them and bring those stories out 604 00:23:19,920 --> 00:23:23,640 to the countries that might not realize how important it is. 605 00:23:23,640 --> 00:23:26,460 Use the right terminology, use the right language 606 00:23:26,460 --> 00:23:29,630 and get them engaged in the conversation. 607 00:23:29,630 --> 00:23:33,240 - Yeah, I think ransomware is a great example 608 00:23:33,240 --> 00:23:35,880 recently as something that has, 609 00:23:35,880 --> 00:23:38,820 in addition to spurring countries 610 00:23:38,820 --> 00:23:43,820 to rethink or reconsider some of their posture, 611 00:23:44,280 --> 00:23:49,050 it's also spurred a lot of global collaboration, 612 00:23:49,050 --> 00:23:50,500 law enforcement collaboration 613 00:23:51,570 --> 00:23:54,540 in cybersecurity and in policy. 614 00:23:54,540 --> 00:23:57,360 But how do we reconcile, 615 00:23:57,360 --> 00:23:59,490 Gaurav, you were giving some great examples 616 00:23:59,490 --> 00:24:03,660 about the pros and cons in Singapore, 617 00:24:03,660 --> 00:24:05,250 that on the one hand, 618 00:24:05,250 --> 00:24:09,480 you don't have all these massive land mass 619 00:24:09,480 --> 00:24:13,050 of interlocking power grids or these things to draw on, 620 00:24:13,050 --> 00:24:14,550 but on the other hand, 621 00:24:14,550 --> 00:24:18,236 there's a nimbleness that comes from that. 622 00:24:18,236 --> 00:24:19,890 And you were talking about the depth, 623 00:24:19,890 --> 00:24:22,110 not necessarily having the breadth and depth, 624 00:24:22,110 --> 00:24:23,003 but on the other hand, 625 00:24:23,003 --> 00:24:24,750 they're so concentrated 626 00:24:24,750 --> 00:24:29,370 and there's an ability to come together and act. 627 00:24:29,370 --> 00:24:33,150 But there's both poles of that, obviously, 628 00:24:33,150 --> 00:24:37,710 and so how do we, either, I don't know, 629 00:24:37,710 --> 00:24:41,130 learn from both things or reconcile both things 630 00:24:41,130 --> 00:24:43,590 as everyone is trying to work together 631 00:24:43,590 --> 00:24:45,810 on some of these global issues? 632 00:24:45,810 --> 00:24:46,710 - I mean, I'm not gonna pretend 633 00:24:46,710 --> 00:24:49,860 that the experience or the lessons that Singapore has 634 00:24:49,860 --> 00:24:51,330 are always right. 635 00:24:51,330 --> 00:24:53,070 They may not be applicable for most countries. 636 00:24:53,070 --> 00:24:58,070 They work for us sometimes, more than on occasion. 637 00:24:59,970 --> 00:25:02,730 We're a small country and that, as you pointed out, 638 00:25:02,730 --> 00:25:05,460 has its disadvantages. 639 00:25:05,460 --> 00:25:06,510 But one of the strengths of it 640 00:25:06,510 --> 00:25:08,073 is that we are a small country. 641 00:25:09,270 --> 00:25:10,800 Every country has bureaucracy. 642 00:25:10,800 --> 00:25:13,560 So government bureaucracy exists everywhere. 643 00:25:13,560 --> 00:25:15,930 Government bureaucracy is proportionate to the scale 644 00:25:15,930 --> 00:25:16,950 of the country, 645 00:25:16,950 --> 00:25:18,960 the bigger the country, the bigger the bureaucracy, 646 00:25:18,960 --> 00:25:21,630 the more levels and layers and friction 647 00:25:21,630 --> 00:25:23,010 and red tape there is. 648 00:25:23,010 --> 00:25:26,280 Having a tiny country actually is an advantage. 649 00:25:26,280 --> 00:25:29,070 We don't have multiple cybersecurity agencies 650 00:25:29,070 --> 00:25:30,300 because we were too small 651 00:25:30,300 --> 00:25:32,490 to create multiple cybersecurity agencies. 652 00:25:32,490 --> 00:25:34,740 But that smallness now becomes an advantage. 653 00:25:34,740 --> 00:25:37,380 I don't need to deal with that friction 654 00:25:37,380 --> 00:25:40,020 that comes with dealing with multiple layers. 655 00:25:40,020 --> 00:25:43,020 And that allows us to move a little bit more quickly, 656 00:25:43,020 --> 00:25:44,280 a little bit more nimbly. 657 00:25:44,280 --> 00:25:49,260 In some senses we like to try to be the world's policy lab. 658 00:25:49,260 --> 00:25:52,290 If you guys have a great idea for a good policy, 659 00:25:52,290 --> 00:25:54,660 and we regularly do this from UK and US, 660 00:25:54,660 --> 00:25:55,950 they have a great idea and a strategy, 661 00:25:55,950 --> 00:25:57,690 we're like, we'll do that. 662 00:25:57,690 --> 00:25:58,523 And we do. 663 00:25:58,523 --> 00:26:00,720 And then, because we're small enough to pull it off, 664 00:26:00,720 --> 00:26:02,640 we sometimes get it through a little bit earlier, 665 00:26:02,640 --> 00:26:04,290 a little bit faster. 666 00:26:04,290 --> 00:26:05,640 We don't claim credit for the idea 667 00:26:05,640 --> 00:26:07,230 because many of the best ideas 668 00:26:07,230 --> 00:26:10,110 came from that conversation across different countries, 669 00:26:10,110 --> 00:26:11,790 different organizations, 670 00:26:11,790 --> 00:26:14,310 but we do have the ability to implement faster. 671 00:26:14,310 --> 00:26:16,830 And that implementation sometimes gives us great lessons 672 00:26:16,830 --> 00:26:18,240 which we then share back. 673 00:26:18,240 --> 00:26:20,820 Sometimes the policy ideas work out, 674 00:26:20,820 --> 00:26:22,680 sometimes they're a catastrophic failure 675 00:26:22,680 --> 00:26:24,150 and then we just pivot. 676 00:26:24,150 --> 00:26:27,180 We have a Cybersecurity Act, it's four years old, 677 00:26:27,180 --> 00:26:28,350 and we are reviewing it already 678 00:26:28,350 --> 00:26:31,293 because we realized that, oh wait, we forgot the cloud. 679 00:26:32,370 --> 00:26:34,200 We should put that in there somewhere. 680 00:26:34,200 --> 00:26:35,689 And now we're thinking, 681 00:26:35,689 --> 00:26:38,760 how do you put cloud into a Cybersecurity Act? 682 00:26:38,760 --> 00:26:40,260 So we look around at, what's Australia doing? 683 00:26:40,260 --> 00:26:41,093 What's UK doing? 684 00:26:41,093 --> 00:26:42,330 What's US doing? 685 00:26:42,330 --> 00:26:44,010 So all of this stuff 686 00:26:44,010 --> 00:26:46,950 allows us to experiment a little bit faster. 687 00:26:46,950 --> 00:26:49,530 I would like to talk about one other specific thing 688 00:26:49,530 --> 00:26:52,590 that we did, which is the labeling scheme. 689 00:26:52,590 --> 00:26:56,010 Which, again, was a very bright idea from the UK 690 00:26:56,010 --> 00:26:59,580 which was talking about principles for IoT devices. 691 00:26:59,580 --> 00:27:01,440 What are the principles of security that you'd want 692 00:27:01,440 --> 00:27:03,750 or expect to have in an IoT device? 693 00:27:03,750 --> 00:27:05,280 We took that basic idea and we said, 694 00:27:05,280 --> 00:27:08,430 look, I need to change two types of behavior. 695 00:27:08,430 --> 00:27:10,770 The first type of behavior is consumer behavior. 696 00:27:10,770 --> 00:27:13,230 Today people are buying baby cameras because they're cheap 697 00:27:13,230 --> 00:27:15,270 and they're looking for the cheapest possible baby camera 698 00:27:15,270 --> 00:27:16,103 they can find. 699 00:27:16,103 --> 00:27:17,130 Nobody cares about security 700 00:27:17,130 --> 00:27:18,990 because they don't know what it is. 701 00:27:18,990 --> 00:27:19,975 The second type of behavior 702 00:27:19,975 --> 00:27:21,750 we wanted to change was manufacturers. 703 00:27:21,750 --> 00:27:24,180 Manufacturers are building the cheapest kind of baby cameras 704 00:27:24,180 --> 00:27:25,013 they can build 705 00:27:25,013 --> 00:27:27,543 because consumers aren't demanding for anything more. 706 00:27:28,620 --> 00:27:29,453 So we realized that 707 00:27:29,453 --> 00:27:31,650 if we were to put a sticker on the side of the box 708 00:27:31,650 --> 00:27:34,560 with the one, two, three or four-star rating, 709 00:27:34,560 --> 00:27:36,360 no one knows what the rating is. 710 00:27:36,360 --> 00:27:37,620 The Cybersecurity Agency of Singapore 711 00:27:37,620 --> 00:27:40,800 just magically does it, we have the system for it, 712 00:27:40,800 --> 00:27:42,330 we just put that sticker on the side of the box 713 00:27:42,330 --> 00:27:43,950 and suddenly now there's a premium device 714 00:27:43,950 --> 00:27:46,920 that's a four-star baby camera, and parents are like, 715 00:27:46,920 --> 00:27:49,290 oh well, I wanna buy the four-star baby camera 716 00:27:49,290 --> 00:27:50,123 for my princess 717 00:27:50,123 --> 00:27:53,070 because I don't want her pictures to end up on the dark web. 718 00:27:53,070 --> 00:27:55,050 And they're prepared to pay five bucks more, 719 00:27:55,050 --> 00:27:56,610 four bucks more. 720 00:27:56,610 --> 00:27:59,910 Once a consumer is prepared to pay $5 more 721 00:27:59,910 --> 00:28:02,100 for a four-star rated baby camera, 722 00:28:02,100 --> 00:28:04,020 guess what the manufacturers do? 723 00:28:04,020 --> 00:28:06,120 We should build more four-star devices 724 00:28:06,120 --> 00:28:09,030 'cause you can get a bit more money from the consumers 725 00:28:09,030 --> 00:28:11,490 just by not having a default password. 726 00:28:11,490 --> 00:28:13,890 And so all of this behavioral nudges, 727 00:28:13,890 --> 00:28:16,380 again, the UK has an entire nudge unit 728 00:28:16,380 --> 00:28:17,670 that thinks about nudging consumer 729 00:28:17,670 --> 00:28:19,380 and manufacturer behavior, 730 00:28:19,380 --> 00:28:21,420 we just put it in into practice and launch the policy. 731 00:28:21,420 --> 00:28:23,400 So we're the world's policy lab. 732 00:28:23,400 --> 00:28:26,400 We'd love to have more ideas from DEF CON's policy group 733 00:28:26,400 --> 00:28:27,660 if you have any, 734 00:28:27,660 --> 00:28:29,310 we're happy to try them out and see if they work. 735 00:28:29,310 --> 00:28:31,583 And if they don't, we'll also give you feedback. 736 00:28:32,640 --> 00:28:33,870 - Pete, I wanna turn to you. 737 00:28:33,870 --> 00:28:37,413 But I like the idea of having the nudge agency, 738 00:28:38,478 --> 00:28:40,500 that it's like a series of nudges 739 00:28:40,500 --> 00:28:43,680 towards getting all of this where it needs to go. 740 00:28:43,680 --> 00:28:44,513 Anyway, go ahead. 741 00:28:44,513 --> 00:28:45,346 - Well, I mean, 742 00:28:45,346 --> 00:28:48,210 but that does touch on it because this is about people. 743 00:28:48,210 --> 00:28:50,460 So we're all here 'cause we love tech, 744 00:28:50,460 --> 00:28:53,340 but we're also here 'cause this is an amazing community. 745 00:28:53,340 --> 00:28:54,483 So this is about, 746 00:28:56,100 --> 00:28:58,950 if we're talking about people and diversity 747 00:28:58,950 --> 00:29:01,200 across multiple organizations, 748 00:29:01,200 --> 00:29:03,150 really that's about building trust. 749 00:29:03,150 --> 00:29:04,470 So how do we start building trust 750 00:29:04,470 --> 00:29:05,940 across those diverse communities 751 00:29:05,940 --> 00:29:10,740 so that we can have productive, proactive conversations 752 00:29:10,740 --> 00:29:13,650 instead of transactional, reactive conversations 753 00:29:13,650 --> 00:29:14,733 when bad happens? 754 00:29:15,750 --> 00:29:17,640 And it takes a long time to build up trust, 755 00:29:17,640 --> 00:29:18,930 especially if, 756 00:29:18,930 --> 00:29:22,830 I mean, some of the most challenging collaborations 757 00:29:22,830 --> 00:29:24,760 that I've worked on 758 00:29:26,601 --> 00:29:28,860 are where of the two parties are a long way apart 759 00:29:28,860 --> 00:29:29,820 right from the very start. 760 00:29:29,820 --> 00:29:32,610 And it's hard work to get people in the room 761 00:29:32,610 --> 00:29:34,770 and it's hard work to start bringing people closer together 762 00:29:34,770 --> 00:29:35,820 and build trust 763 00:29:35,820 --> 00:29:38,370 to the point where they can actually talk to each other. 764 00:29:38,370 --> 00:29:41,370 But because they are so diverse, 765 00:29:41,370 --> 00:29:42,203 when they get to the point 766 00:29:42,203 --> 00:29:44,220 of being able to talk to each other and trust each other, 767 00:29:44,220 --> 00:29:46,830 the value of that partnership is huge 768 00:29:46,830 --> 00:29:48,480 because they are now speaking 769 00:29:48,480 --> 00:29:50,430 from completely different perspectives, 770 00:29:50,430 --> 00:29:52,710 but are able to talk, they're able to learn from each other, 771 00:29:52,710 --> 00:29:54,360 they're able to collaborate. 772 00:29:54,360 --> 00:29:55,290 And one of the things 773 00:29:55,290 --> 00:29:56,970 that you'll see a lot of the work 774 00:29:56,970 --> 00:29:59,520 across both the international community, 775 00:29:59,520 --> 00:30:01,320 both government and also private sector, 776 00:30:01,320 --> 00:30:05,550 is large-scale adversaries. 777 00:30:05,550 --> 00:30:07,680 You see what's happening in Ukraine at the moment, 778 00:30:07,680 --> 00:30:11,160 the international community galvanizing public and private 779 00:30:11,160 --> 00:30:15,723 to help give as much support as possible and innovation. 780 00:30:16,770 --> 00:30:18,840 That activity has been fantastic. 781 00:30:18,840 --> 00:30:20,250 It's been coming for a long time 782 00:30:20,250 --> 00:30:22,080 with the conversations that have been happening 783 00:30:22,080 --> 00:30:23,370 up to that point. 784 00:30:23,370 --> 00:30:27,030 But the more and more that we actually have the exercises 785 00:30:27,030 --> 00:30:27,863 where we collaborate, 786 00:30:27,863 --> 00:30:31,380 we have policies that have some semblance of parity 787 00:30:31,380 --> 00:30:33,003 across different organizations, 788 00:30:34,380 --> 00:30:37,050 the better place we are gonna be in the future. 789 00:30:37,050 --> 00:30:37,883 And part of the challenge, 790 00:30:37,883 --> 00:30:39,990 and going back to your point about the cloud, 791 00:30:39,990 --> 00:30:42,840 it's we all talk about getting to this utopian vision 792 00:30:42,840 --> 00:30:44,730 in the future where we solved everything. 793 00:30:44,730 --> 00:30:46,170 We're not getting there. 794 00:30:46,170 --> 00:30:48,210 Because whenever you think in the policy world of, 795 00:30:48,210 --> 00:30:50,790 hey, we'll get to this point, we'll plant a flag, 796 00:30:50,790 --> 00:30:53,970 and it'll be great, and that's what we're aiming for, 797 00:30:53,970 --> 00:30:55,800 the world changes, the adversaries change 798 00:30:55,800 --> 00:30:57,420 and now we've gotta plant a new flag. 799 00:30:57,420 --> 00:30:59,460 So it's a continual evolution. 800 00:30:59,460 --> 00:31:02,370 The quicker and better we can do this evolution 801 00:31:02,370 --> 00:31:05,250 collaboratively across all the different stakeholders, 802 00:31:05,250 --> 00:31:06,300 the better we are 803 00:31:06,300 --> 00:31:09,540 and the quicker we get to that good position 804 00:31:09,540 --> 00:31:11,340 to reduce the risk to our countries, 805 00:31:11,340 --> 00:31:12,960 to reduce the risk to all of our stakeholders, 806 00:31:12,960 --> 00:31:14,760 and build this all global community. 807 00:31:16,320 --> 00:31:20,220 - So I think we would like to take some questions. 808 00:31:20,220 --> 00:31:23,160 We'd really love to hear what you all are thinking 809 00:31:23,160 --> 00:31:26,280 and what you'd like to know from Pete and Gaurav. 810 00:31:26,280 --> 00:31:29,970 I do not think there are mics, 811 00:31:29,970 --> 00:31:32,250 so you might need to, 812 00:31:32,250 --> 00:31:36,360 oh, I think I see a mic off in the distance 813 00:31:36,360 --> 00:31:38,013 coming towards us. 814 00:31:39,330 --> 00:31:41,280 - We have a dancing goon with two mics. 815 00:31:42,990 --> 00:31:44,400 - Yeah, so okay. 816 00:31:44,400 --> 00:31:47,280 Find a mic if you wanna ask a question. 817 00:31:47,280 --> 00:31:48,453 I see some hands. 818 00:32:07,480 --> 00:32:08,313 - [Audience Member 1] Thank you very much 819 00:32:08,313 --> 00:32:10,380 for a very insightful session. 820 00:32:10,380 --> 00:32:14,730 I particularly enjoyed the global aspect. 821 00:32:14,730 --> 00:32:18,480 So with the last portion of your conversation 822 00:32:18,480 --> 00:32:21,570 about the ever-changing landscape 823 00:32:21,570 --> 00:32:24,480 and the challenges of changing the policy 824 00:32:24,480 --> 00:32:27,813 ongoing because it's not a one-time set, 825 00:32:29,700 --> 00:32:31,230 what type of techniques did you use 826 00:32:31,230 --> 00:32:33,600 to make that communication effective? 827 00:32:33,600 --> 00:32:35,790 Because every time you're gonna change direction, 828 00:32:35,790 --> 00:32:40,140 every time you're gonna have to implement a new policy, 829 00:32:40,140 --> 00:32:42,960 it's wonderful to write it up and put it together, 830 00:32:42,960 --> 00:32:46,140 but how do you get it out there in time 831 00:32:46,140 --> 00:32:48,990 so people could actually, 832 00:32:48,990 --> 00:32:51,600 whether it was private sector or the public sector, 833 00:32:51,600 --> 00:32:54,753 be able to act on it and use it as a guidance? 834 00:32:58,092 --> 00:33:01,260 - So I think just to, it's slightly difficult here, 835 00:33:01,260 --> 00:33:04,300 but I think the best way to answer it is that 836 00:33:06,240 --> 00:33:08,193 if you're making incremental change, 837 00:33:09,540 --> 00:33:11,400 you're putting the flag slightly further ahead 838 00:33:11,400 --> 00:33:13,921 of where everyone is at the moment. 839 00:33:13,921 --> 00:33:14,760 And then yeah, okay, 840 00:33:14,760 --> 00:33:16,770 well, we've got a good likelihood of getting there 841 00:33:16,770 --> 00:33:17,790 but it's a small change, 842 00:33:17,790 --> 00:33:19,650 we know we're gonna have to come back to this. 843 00:33:19,650 --> 00:33:21,000 And there's a massive decision to make 844 00:33:21,000 --> 00:33:23,100 about how far ahead do you put the flag? 845 00:33:23,100 --> 00:33:25,530 How visionary are we going to be here? 846 00:33:25,530 --> 00:33:27,120 The further ahead you plant it, 847 00:33:27,120 --> 00:33:29,430 it's a proper long-term vision, 848 00:33:29,430 --> 00:33:30,453 it's going to be a big change, 849 00:33:30,453 --> 00:33:32,520 it's gonna make a massive difference. 850 00:33:32,520 --> 00:33:35,190 So to give you an example, 851 00:33:35,190 --> 00:33:38,904 the Cyber Strategy we pushed out in January, 852 00:33:38,904 --> 00:33:42,180 that's got a timeline out to 2030, 853 00:33:42,180 --> 00:33:46,110 because what we're looking at is long-term change 854 00:33:46,110 --> 00:33:48,870 to actually get all of the key foundational pieces 855 00:33:48,870 --> 00:33:51,000 that we need at scale. 856 00:33:51,000 --> 00:33:53,220 Because as soon as you bring out huge scale 857 00:33:53,220 --> 00:33:54,300 with the policy, it's like, 858 00:33:54,300 --> 00:33:56,100 so we're trying to do this huge amount of work 859 00:33:56,100 --> 00:33:59,938 in breadth and depth across a huge amount of organizations, 860 00:33:59,938 --> 00:34:01,200 so it's gonna be a massive change for them. 861 00:34:01,200 --> 00:34:02,400 Okay, we've just gotta accept 862 00:34:02,400 --> 00:34:04,620 this is gonna take a long time. 863 00:34:04,620 --> 00:34:07,230 And the way that I always think 864 00:34:07,230 --> 00:34:08,910 about trying to get that policy to work 865 00:34:08,910 --> 00:34:11,313 is make sure it's not shit. 866 00:34:12,150 --> 00:34:14,610 If it's a good policy and people want to do it 867 00:34:14,610 --> 00:34:16,350 because it's common sense, 868 00:34:16,350 --> 00:34:17,437 they're gonna come to you and say, 869 00:34:17,437 --> 00:34:19,140 "I really want to do this." 870 00:34:19,140 --> 00:34:21,540 So we, for example, 871 00:34:21,540 --> 00:34:23,400 we are looking at how we do assurance at scale 872 00:34:23,400 --> 00:34:26,400 across the whole of the government. 873 00:34:26,400 --> 00:34:29,520 So we've come up with what we think is an assurance process 874 00:34:29,520 --> 00:34:30,930 that will make life easier for people 875 00:34:30,930 --> 00:34:32,730 and give us much better data 876 00:34:32,730 --> 00:34:34,440 for both organizations, departments, 877 00:34:34,440 --> 00:34:35,793 and also at sector scale. 878 00:34:36,750 --> 00:34:38,010 And now we've got organizations 879 00:34:38,010 --> 00:34:39,427 within other organizations across come say, 880 00:34:39,427 --> 00:34:40,740 "We really wanna get involved in this. 881 00:34:40,740 --> 00:34:41,573 Can we do a pilot? 882 00:34:41,573 --> 00:34:42,720 Can we get in?" 883 00:34:42,720 --> 00:34:45,930 So it's build good stuff and then the policy's way easier. 884 00:34:45,930 --> 00:34:46,770 But you're only gonna do that 885 00:34:46,770 --> 00:34:49,230 if you have great dialogue beforehand. 886 00:34:49,230 --> 00:34:50,760 - Can I add two points? 887 00:34:50,760 --> 00:34:52,110 The first is, 888 00:34:52,110 --> 00:34:54,960 it sometimes requires you to have philosophical clarity 889 00:34:54,960 --> 00:34:56,340 about what the principles are. 890 00:34:56,340 --> 00:34:57,990 So for example, in Singapore, 891 00:34:57,990 --> 00:35:01,050 we treat access to secure, trusted Internet 892 00:35:01,050 --> 00:35:03,543 as a public utility, like drinking water. 893 00:35:04,440 --> 00:35:06,240 That is a big difference 894 00:35:06,240 --> 00:35:08,100 from treating it as a private service. 895 00:35:08,100 --> 00:35:10,470 Which means that every average individual 896 00:35:10,470 --> 00:35:15,120 who lives in a rented flat deserves to have secure Internet, 897 00:35:15,120 --> 00:35:17,910 regardless of whether they can afford a firewall 898 00:35:17,910 --> 00:35:20,310 or antivirus or everything else. 899 00:35:20,310 --> 00:35:22,020 That is a principle. 900 00:35:22,020 --> 00:35:25,260 And that changes how your policies then evolve over time. 901 00:35:25,260 --> 00:35:27,510 The second is, and I want to echo Pete, 902 00:35:27,510 --> 00:35:28,710 the conversation 903 00:35:28,710 --> 00:35:32,100 cannot be a post-implementation conversation. 904 00:35:32,100 --> 00:35:32,933 It cannot be like, 905 00:35:32,933 --> 00:35:35,520 oh, this is the new regulation and the new policy, 906 00:35:35,520 --> 00:35:37,560 now I will communicate it to you. 907 00:35:37,560 --> 00:35:38,730 As you're designing it, 908 00:35:38,730 --> 00:35:41,040 you should be having those conversations with the companies, 909 00:35:41,040 --> 00:35:44,580 with the stakeholders, so that by the time it goes public, 910 00:35:44,580 --> 00:35:45,420 they already were like, 911 00:35:45,420 --> 00:35:47,971 yeah, we were involved with like 90% of this. 912 00:35:47,971 --> 00:35:50,340 The wording's a little bit different, but that's fine. 913 00:35:50,340 --> 00:35:52,140 We roughly know where it came from. 914 00:35:52,140 --> 00:35:54,886 And if you're doing it only at the end, it's too late. 915 00:35:54,886 --> 00:35:56,313 - And also on that. 916 00:35:58,422 --> 00:36:01,410 If you're imposing a policy on people, 917 00:36:01,410 --> 00:36:04,080 it's not gonna work, unless it's really simple. 918 00:36:04,080 --> 00:36:06,570 So the more that they can collaborate and be involved 919 00:36:06,570 --> 00:36:09,600 and feel a stakeholder in it, it's way easier. 920 00:36:09,600 --> 00:36:12,317 And I mean, to give it one of the examples is, 921 00:36:12,317 --> 00:36:13,290 one of the other things 922 00:36:13,290 --> 00:36:17,040 is that sometimes a bit of vagueness helps, 923 00:36:17,040 --> 00:36:18,729 especially in the long-term. 924 00:36:18,729 --> 00:36:22,140 So on the strategy that we've got, we've got two pillars. 925 00:36:22,140 --> 00:36:24,710 One is really good resilience. 926 00:36:24,710 --> 00:36:26,400 So we all know that's a really good thing. 927 00:36:26,400 --> 00:36:28,890 We can get into the detail of what resilience looks like. 928 00:36:28,890 --> 00:36:30,750 And the other one is defend as one. 929 00:36:30,750 --> 00:36:32,790 So how do we better 930 00:36:32,790 --> 00:36:35,340 bring all of these different stakeholder organizations, 931 00:36:35,340 --> 00:36:37,410 all these departments, industry, 932 00:36:37,410 --> 00:36:38,400 how do we bring everyone together 933 00:36:38,400 --> 00:36:40,050 so we better defend as one? 934 00:36:40,050 --> 00:36:43,320 So if we're defending in stovepipes we will fail. 935 00:36:43,320 --> 00:36:45,900 'Cause adversaries don't attack in stovepipes, 936 00:36:45,900 --> 00:36:48,240 if we try defend them, we're gonna fall over. 937 00:36:48,240 --> 00:36:50,040 So how do we defend as one? 938 00:36:50,040 --> 00:36:51,570 And people kept on asking me, 939 00:36:51,570 --> 00:36:54,180 well, can you scope, defend as one? 940 00:36:54,180 --> 00:36:56,702 Give me a list of what defend as one looks like. 941 00:36:56,702 --> 00:36:57,780 And it's like, well, no, 942 00:36:57,780 --> 00:36:59,850 because I want people to start using this 943 00:36:59,850 --> 00:37:01,860 within their organizations, within their teams. 944 00:37:01,860 --> 00:37:04,080 How do we better defend as one within our team? 945 00:37:04,080 --> 00:37:06,870 How do we better defend as one within our department? 946 00:37:06,870 --> 00:37:08,520 And then if I'm having a conversation with industry, 947 00:37:08,520 --> 00:37:10,530 it's okay, so how do we better defend as one together? 948 00:37:10,530 --> 00:37:12,750 Because we're all on the same platforms. 949 00:37:12,750 --> 00:37:14,607 So trying to get that vision 950 00:37:14,607 --> 00:37:17,760 and that culture and that ethos of, 951 00:37:17,760 --> 00:37:20,280 right, we're in this together and working together, 952 00:37:20,280 --> 00:37:22,110 can be a really nice way of helping people 953 00:37:22,110 --> 00:37:23,510 come on that policy journey. 954 00:37:24,570 --> 00:37:26,160 - The English have an unfair advantage 955 00:37:26,160 --> 00:37:27,360 because they invented English. 956 00:37:27,360 --> 00:37:29,640 So communication is their strength, unfortunately. 957 00:37:29,640 --> 00:37:30,640 So we do learn a lot from them. 958 00:37:30,640 --> 00:37:32,025 - Not all the time. 959 00:37:32,025 --> 00:37:32,893 Not all the time. 960 00:37:32,893 --> 00:37:33,801 - So there's one more. 961 00:37:33,801 --> 00:37:35,989 - Yeah, another question. 962 00:37:35,989 --> 00:37:37,680 - [Audience Member 2] Yeah, thank you. 963 00:37:37,680 --> 00:37:39,630 I'm interested in your thoughts on 964 00:37:39,630 --> 00:37:43,890 how do you scale information sharing between, 965 00:37:43,890 --> 00:37:46,230 in particular between national governments? 966 00:37:46,230 --> 00:37:48,750 I mean, Gaurav, you mentioned having, 967 00:37:48,750 --> 00:37:49,717 picking up the phone and saying, 968 00:37:49,717 --> 00:37:52,260 "Hey sir, share this Log4j information 969 00:37:52,260 --> 00:37:53,918 with these other countries." 970 00:37:53,918 --> 00:37:56,010 That doesn't scale, 971 00:37:56,010 --> 00:37:58,530 traditional government methods of information sharing, 972 00:37:58,530 --> 00:38:00,000 especially in intelligence, 973 00:38:00,000 --> 00:38:03,120 don't scale very well and they don't move it 974 00:38:03,120 --> 00:38:06,180 at the speed it is required. 975 00:38:06,180 --> 00:38:09,030 ISACs sometimes work, 976 00:38:09,030 --> 00:38:12,000 sometimes they're something that companies can throw 977 00:38:12,000 --> 00:38:13,350 on their website. 978 00:38:13,350 --> 00:38:14,880 So do you have examples, 979 00:38:14,880 --> 00:38:16,530 have you guys seen examples 980 00:38:16,530 --> 00:38:18,630 of information sharing arrangements 981 00:38:18,630 --> 00:38:21,037 that scale at speed and you say, 982 00:38:21,037 --> 00:38:24,330 "That works, that's working better there than these others." 983 00:38:24,330 --> 00:38:25,803 And what's the secret sauce? 984 00:38:26,820 --> 00:38:27,653 - I'm gonna give you an answer 985 00:38:27,653 --> 00:38:29,883 that you're probably not gonna like. 986 00:38:30,900 --> 00:38:32,820 And the answer is that it takes hard work 987 00:38:32,820 --> 00:38:34,680 and there is no shortcut. 988 00:38:34,680 --> 00:38:39,540 Confidence building is incredibly difficult 989 00:38:39,540 --> 00:38:42,120 because it takes time. 990 00:38:42,120 --> 00:38:43,680 So even within our region, 991 00:38:43,680 --> 00:38:48,660 getting Vietnam, Philippines, Indonesia, Singapore, 992 00:38:48,660 --> 00:38:50,550 to come to a point where we are prepared 993 00:38:50,550 --> 00:38:52,080 to exercise together, 994 00:38:52,080 --> 00:38:55,500 discuss our operational processes with each other, 995 00:38:55,500 --> 00:38:57,840 that takes decades. 996 00:38:57,840 --> 00:38:59,730 And you can't just shortcut that. 997 00:38:59,730 --> 00:39:02,190 Unfortunately, information sharing arrangements 998 00:39:02,190 --> 00:39:04,410 will always exist as a function of the level of trust 999 00:39:04,410 --> 00:39:05,910 that you have in the other party. 1000 00:39:05,910 --> 00:39:08,730 If you don't trust them, you just won't. 1001 00:39:08,730 --> 00:39:10,560 And no matter what policies you put in place, 1002 00:39:10,560 --> 00:39:12,540 no matter what structures and processes you put in pace, 1003 00:39:12,540 --> 00:39:14,760 it will fail because the trust isn't there. 1004 00:39:14,760 --> 00:39:17,280 And if the trust is there to start with, 1005 00:39:17,280 --> 00:39:20,040 then actually you can layer on processes informally 1006 00:39:20,040 --> 00:39:20,873 and they work. 1007 00:39:20,873 --> 00:39:24,390 So even within us, we have processes, 1008 00:39:24,390 --> 00:39:26,520 I wouldn't say that they're super formal, 1009 00:39:26,520 --> 00:39:27,990 it's not the nature of our region 1010 00:39:27,990 --> 00:39:30,000 to be super formal about the processes, 1011 00:39:30,000 --> 00:39:31,413 Chris knows this very well, 1012 00:39:32,430 --> 00:39:36,273 but it is there because we trust each other. 1013 00:39:38,520 --> 00:39:41,253 And to reiterate the point, that takes time. 1014 00:39:42,180 --> 00:39:43,170 All of the things that you mentioned 1015 00:39:43,170 --> 00:39:44,211 about ISACs and SERTs, 1016 00:39:44,211 --> 00:39:47,400 they're all the right components of the answer, 1017 00:39:47,400 --> 00:39:49,803 but you have to start small and slowly build up. 1018 00:39:51,150 --> 00:39:53,970 - And I'll give a slightly different slot on that. 1019 00:39:53,970 --> 00:39:57,720 I mean, we've all got communities around, 1020 00:39:57,720 --> 00:40:00,930 or contacts and people we know and trust in different, 1021 00:40:00,930 --> 00:40:04,110 either countries or different organizations, 1022 00:40:04,110 --> 00:40:05,070 whenever something kicks off, 1023 00:40:05,070 --> 00:40:07,020 you can generally pick up the phone and speak to a friend 1024 00:40:07,020 --> 00:40:08,370 and go, "What's going on? 1025 00:40:08,370 --> 00:40:10,020 Have you got any really good information?" 1026 00:40:10,020 --> 00:40:12,870 So that's information sharing, but point-to-point. 1027 00:40:12,870 --> 00:40:14,520 And we've got quite a lot of that 1028 00:40:14,520 --> 00:40:17,550 across different people and friends and things like that. 1029 00:40:17,550 --> 00:40:21,420 But when you talk about institutional information sharing, 1030 00:40:21,420 --> 00:40:23,070 formal information sharing, 1031 00:40:23,070 --> 00:40:26,220 the first people that are gonna get involved are lawyers. 1032 00:40:26,220 --> 00:40:28,740 So therefore, when's the last time that we had a lawyer 1033 00:40:28,740 --> 00:40:30,720 really coming in to talk about policy and things like that? 1034 00:40:30,720 --> 00:40:32,880 So it's you're having to diversify 1035 00:40:32,880 --> 00:40:33,713 who's in that conversation, 1036 00:40:33,713 --> 00:40:35,040 how do we share information properly 1037 00:40:35,040 --> 00:40:37,290 and what does that look like? 1038 00:40:37,290 --> 00:40:39,750 And also, if we look, 1039 00:40:39,750 --> 00:40:41,880 and I'll go right back to what's going on in Ukraine, 1040 00:40:41,880 --> 00:40:44,040 the information sharing that's flying around 1041 00:40:44,040 --> 00:40:45,450 with all of the stuff that's going on in Ukraine, 1042 00:40:45,450 --> 00:40:47,280 I mean, there's been some fantastic presentations, 1043 00:40:47,280 --> 00:40:49,890 both here and at Black Hat about, 1044 00:40:49,890 --> 00:40:51,360 here's what we did through open-source. 1045 00:40:51,360 --> 00:40:52,890 Here's what we crowdsourced. 1046 00:40:52,890 --> 00:40:54,750 Here's what we did and we published straight away 1047 00:40:54,750 --> 00:40:55,583 as soon as we saw it 1048 00:40:55,583 --> 00:40:57,570 to make sure that people have got the right information, 1049 00:40:57,570 --> 00:41:00,240 and we can verify it and actually then use it 1050 00:41:00,240 --> 00:41:01,890 and work on it together, 1051 00:41:01,890 --> 00:41:04,020 be it across the ISACs or across the SERTs 1052 00:41:04,020 --> 00:41:07,650 and actually collaborate for good by using that information. 1053 00:41:07,650 --> 00:41:10,200 Because we've gotta share the information 1054 00:41:10,200 --> 00:41:13,353 in a way that is actionable, reduces risk, reduces harm. 1055 00:41:15,210 --> 00:41:16,650 There are ways to do that 1056 00:41:16,650 --> 00:41:18,960 through the crowdsourcing side of it, 1057 00:41:18,960 --> 00:41:21,000 but it's also the signal from noise challenge. 1058 00:41:21,000 --> 00:41:22,320 So you can do that signal from noise 1059 00:41:22,320 --> 00:41:23,220 when you've got a friend and go, 1060 00:41:23,220 --> 00:41:25,230 you really need to know this. 1061 00:41:25,230 --> 00:41:28,920 So on the one hand, we've got that and we wanna scale it, 1062 00:41:28,920 --> 00:41:29,753 and then you go to Internet scale 1063 00:41:29,753 --> 00:41:32,190 and a whole bunch of stuff going off, there's so much noise. 1064 00:41:32,190 --> 00:41:34,590 How do you then distill that down? 1065 00:41:34,590 --> 00:41:36,540 And that goes back to your point of, 1066 00:41:36,540 --> 00:41:38,700 the more that you have exercised with them in the past, 1067 00:41:38,700 --> 00:41:40,920 the more that you've done stuff like this in the past, 1068 00:41:40,920 --> 00:41:41,753 I mean, look, 1069 00:41:41,753 --> 00:41:43,363 all of the new connections that have sprung up 1070 00:41:43,363 --> 00:41:45,810 because of what's been happening in Ukraine, 1071 00:41:45,810 --> 00:41:47,490 and all of those collaborations 1072 00:41:47,490 --> 00:41:50,100 means that if anything else of that scale happens again, 1073 00:41:50,100 --> 00:41:51,303 they exist already. 1074 00:41:54,450 --> 00:41:55,800 There is never a good answer, 1075 00:41:55,800 --> 00:41:57,990 apart from just galvanizing 1076 00:41:57,990 --> 00:42:01,710 and getting behind something that you see the need. 1077 00:42:01,710 --> 00:42:05,910 And you'll see an amazing amount of blockers in place 1078 00:42:05,910 --> 00:42:08,400 for really good information security sharing, 1079 00:42:08,400 --> 00:42:09,870 until something happens and all of a sudden 1080 00:42:09,870 --> 00:42:11,790 they magically disappear. 1081 00:42:11,790 --> 00:42:12,660 We need to get to the point 1082 00:42:12,660 --> 00:42:14,520 where we can disappear them way earlier 1083 00:42:14,520 --> 00:42:16,920 because we can articulate the need. 1084 00:42:16,920 --> 00:42:20,100 - There's a whole conversation buried inside that 1085 00:42:20,100 --> 00:42:22,080 about liabilities and responsibilities 1086 00:42:22,080 --> 00:42:24,360 that we could have another two-hour conversation on. 1087 00:42:24,360 --> 00:42:27,390 Because there are huge corporate challenges 1088 00:42:27,390 --> 00:42:29,880 in sharing information, for good reason, 1089 00:42:29,880 --> 00:42:31,470 which is why the lawyers are the first ones 1090 00:42:31,470 --> 00:42:34,410 to come out sometimes, which deserve to be unpacked. 1091 00:42:34,410 --> 00:42:36,210 And I think it'll take years for us to unpack them. 1092 00:42:36,210 --> 00:42:37,290 But those are important conversations 1093 00:42:37,290 --> 00:42:38,280 for us to have as well. 1094 00:42:38,280 --> 00:42:40,440 But like he said, in a crisis, 1095 00:42:40,440 --> 00:42:42,360 fortunately, many of the companies know 1096 00:42:42,360 --> 00:42:43,560 that they have to do the right thing. 1097 00:42:43,560 --> 00:42:46,923 And so those impediments do step away. 1098 00:42:48,300 --> 00:42:50,190 - I wanted to take one more question, 1099 00:42:50,190 --> 00:42:53,190 but just watching the time, I think instead, 1100 00:42:53,190 --> 00:42:55,650 I'm just gonna ask you to, 1101 00:42:55,650 --> 00:42:59,160 we brought up the word Resilience 1102 00:42:59,160 --> 00:43:00,840 and both of you mentioned it, 1103 00:43:00,840 --> 00:43:02,520 and I just was wondering if each of you 1104 00:43:02,520 --> 00:43:04,110 could talk a little bit about, 1105 00:43:04,110 --> 00:43:05,853 we talked about the word Scale, 1106 00:43:06,780 --> 00:43:10,320 that that's the real purpose and the goal in all of this, 1107 00:43:10,320 --> 00:43:13,500 is to develop policies that promote resilience. 1108 00:43:13,500 --> 00:43:15,720 And I just wonder if either of you have thoughts 1109 00:43:15,720 --> 00:43:19,740 from our conversation today or from your work about, 1110 00:43:19,740 --> 00:43:21,630 is that always what needs 1111 00:43:21,630 --> 00:43:23,340 to be driving these conversations, 1112 00:43:23,340 --> 00:43:24,683 and do you think, right now, 1113 00:43:24,683 --> 00:43:27,030 is that what's in everyone's minds? 1114 00:43:27,030 --> 00:43:28,953 I think it's in both of your minds. 1115 00:43:31,110 --> 00:43:32,520 - I could try. 1116 00:43:32,520 --> 00:43:36,720 So the morning speaker, Chris Inglis, 1117 00:43:36,720 --> 00:43:39,090 used the word Confidence rather than Resilience. 1118 00:43:39,090 --> 00:43:40,083 I like that word. 1119 00:43:41,398 --> 00:43:44,010 The reason why that word drives me 1120 00:43:44,010 --> 00:43:46,650 is because confidence in technology, 1121 00:43:46,650 --> 00:43:50,403 confidence in digitalization, in progress, is not a given. 1122 00:43:51,900 --> 00:43:55,110 Humans have invented and uninvented technologies 1123 00:43:55,110 --> 00:43:56,760 when they lost confidence in it. 1124 00:43:56,760 --> 00:43:58,050 I flew here from Singapore. 1125 00:43:58,050 --> 00:44:01,440 It is a 20-something hour flight. 1126 00:44:01,440 --> 00:44:03,240 It is a long flight. 1127 00:44:03,240 --> 00:44:06,000 In the 1980s, we invented the Concord. 1128 00:44:06,000 --> 00:44:09,450 We invented supersonic travel as a human species, 1129 00:44:09,450 --> 00:44:11,550 and then we couldn't find a way to make it safe, 1130 00:44:11,550 --> 00:44:13,590 we lost confidence in it 1131 00:44:13,590 --> 00:44:15,960 and we uninvented supersonic travel. 1132 00:44:15,960 --> 00:44:17,190 So now have to fly 20 hours. 1133 00:44:17,190 --> 00:44:19,650 It could have been a three-hour flight. 1134 00:44:19,650 --> 00:44:23,340 We have the capacity to uninvent really useful things 1135 00:44:23,340 --> 00:44:26,040 if we can't find a way to make it safe and secure. 1136 00:44:26,040 --> 00:44:29,490 If we can't find a way to give people confidence and trust, 1137 00:44:29,490 --> 00:44:31,410 if autonomous vehicles come out in the streets 1138 00:44:31,410 --> 00:44:34,680 and end up killing a whole bunch of families every week, 1139 00:44:34,680 --> 00:44:36,720 you're not gonna buy an autonomous vehicle. 1140 00:44:36,720 --> 00:44:39,210 Autonomous vehicles are gonna disappear from the market. 1141 00:44:39,210 --> 00:44:42,630 So the idea of giving people confidence in technology 1142 00:44:42,630 --> 00:44:43,650 is what drives us. 1143 00:44:43,650 --> 00:44:45,900 And all of the vulnerabilities that we find, 1144 00:44:45,900 --> 00:44:47,400 all of the risks, the issues, 1145 00:44:47,400 --> 00:44:50,280 the threats that we see in emerging technologies, 1146 00:44:50,280 --> 00:44:52,410 we want to address them as early as possible 1147 00:44:52,410 --> 00:44:55,740 so that people can grow up having faith, having confidence, 1148 00:44:55,740 --> 00:44:58,590 having trust that technology is here for good. 1149 00:44:58,590 --> 00:45:00,570 There are parts of it that have challenges, 1150 00:45:00,570 --> 00:45:03,690 but it's here for good and we should embrace it securely. 1151 00:45:03,690 --> 00:45:05,103 So that's what drives us. 1152 00:45:06,300 --> 00:45:08,184 - Well, you have something quick, Pete? 1153 00:45:08,184 --> 00:45:09,017 - Well, I was just gonna say, 1154 00:45:09,017 --> 00:45:11,010 so for me, resilience is about people. 1155 00:45:11,010 --> 00:45:12,660 So we talk about technology and resilience 1156 00:45:12,660 --> 00:45:13,493 and all that stuff, 1157 00:45:13,493 --> 00:45:15,960 but look how many people are actually really tired 1158 00:45:15,960 --> 00:45:17,670 close to the last two years that we've had. 1159 00:45:17,670 --> 00:45:21,480 And we need more people into the sector 1160 00:45:21,480 --> 00:45:23,250 from lots of different areas, 1161 00:45:23,250 --> 00:45:25,560 and that's why things like DEF CON are fantastic 1162 00:45:25,560 --> 00:45:28,080 because we are hopefully inspiring more people 1163 00:45:28,080 --> 00:45:29,820 to get really excited, playing in the Villages 1164 00:45:29,820 --> 00:45:30,750 and things like that. 1165 00:45:30,750 --> 00:45:32,820 That's the thing that gives us resilience. 1166 00:45:32,820 --> 00:45:35,520 Technology will always give us challenge and vulnerability. 1167 00:45:35,520 --> 00:45:38,130 It's the people that give us the resilience. 1168 00:45:38,130 --> 00:45:40,740 And I think we've always gotta keep an eye on that 1169 00:45:40,740 --> 00:45:44,670 because I'd much rather take an amazing team 1170 00:45:44,670 --> 00:45:45,960 rather than amazing technology. 1171 00:45:45,960 --> 00:45:49,023 The team will find a way, the team will give you resilience. 1172 00:45:49,023 --> 00:45:53,460 We almost hang off the technology way too much. 1173 00:45:53,460 --> 00:45:54,293 - Hear, hear. - Yeah. 1174 00:45:54,293 --> 00:45:55,830 Well, I think that's a great place to end. 1175 00:45:55,830 --> 00:45:57,450 Thank you both so much for doing this. 1176 00:45:57,450 --> 00:45:59,730 And if there's one thing I learned today, 1177 00:45:59,730 --> 00:46:02,763 it's make sure your policy is not shit. 1178 00:46:03,675 --> 00:46:04,508 - Fair. 1179 00:46:04,508 --> 00:46:05,341 - Thank you. 1180 00:46:05,341 --> 00:46:08,341 (audience applauds)