1
00:00:08,400 --> 00:00:11,200
Thank you.

2
00:00:54,460 --> 00:00:54,820
How's this?

3
00:00:56,300 --> 00:00:56,780
Oh, sir.

4
00:00:57,500 --> 00:00:58,460
Probably going to play it for you guys, too.

5
00:00:58,960 --> 00:00:59,340
How's this?

6
00:01:00,000 --> 00:01:00,900
All right, great.

7
00:01:00,940 --> 00:01:01,200
Thank you.

8
00:01:01,720 --> 00:01:04,440
I want to start with, like, a really brief catch-up.

9
00:01:04,640 --> 00:01:06,280
There was an incident in 2021.

10
00:01:07,820 --> 00:01:09,180
Maybe some of you guys have heard of it.

11
00:01:09,220 --> 00:01:10,120
It's called Colonial Pipeline.

12
00:01:10,620 --> 00:01:12,040
There's a ransomware attack.

13
00:01:13,700 --> 00:01:14,540
You guys have heard.

14
00:01:14,800 --> 00:01:15,220
That's right.

15
00:01:18,000 --> 00:01:19,420
That prompted a series of regulations.

16
00:01:20,340 --> 00:01:26,700
Can you give us a very quick overview of the regulations

17
00:01:27,120 --> 00:01:29,160
that you have kind of overseen?

18
00:01:30,000 --> 00:01:36,820
two years since then sure so um as you mentioned may 2021 early may ransomware attack east coast

19
00:01:36,820 --> 00:01:42,540
pipeline had systemic impact across the east coast what we did in working with our partners in sisa

20
00:01:43,120 --> 00:01:47,160
was immediately put out a requirement that any owner and operator of critical infrastructure

21
00:01:47,160 --> 00:01:53,020
had to report any significant cyber incident because when this one occurred company asked

22
00:01:53,020 --> 00:01:57,660
hey how many other pipelines have suffered this kind of attack and we didn't have that answer

23
00:01:57,660 --> 00:02:02,900
um so we put that regulation out first that came out uh in the very same month in may but

24
00:02:02,900 --> 00:02:08,660
interestingly and i think really importantly for our talk this this afternoon is that reporting

25
00:02:08,660 --> 00:02:14,480
went to sisa not to tsa intentionally because we're trying to centralize reporting we're trying

26
00:02:14,480 --> 00:02:18,380
to make it easier on the owners and operators of critical infrastructure in the country

27
00:02:18,800 --> 00:02:23,380
you can imagine if you have a reporting requirement to several different federal agencies

28
00:02:23,380 --> 00:02:27,640
every agency is going to hear it a little bit differently

29
00:02:27,660 --> 00:02:32,340
um and so there that that introduces an element potentially of confusion so having

30
00:02:32,340 --> 00:02:38,660
a report go in at the same time one central location and then having sisa push it out to

31
00:02:38,660 --> 00:02:43,740
all of the affected agencies has really been my view of best practice um the other thing that we

32
00:02:43,740 --> 00:02:49,840
didn't know at the time but certainly now is part of the national cyber strategy is to harmonize

33
00:02:49,840 --> 00:02:54,240
our reporting requirements across the federal government and this was really the very first

34
00:02:54,240 --> 00:02:57,640
attempt to do that and i would credit um sisa for

35
00:02:57,660 --> 00:03:02,780
doing just a fabulous job of giving us in near real time reports of those incidents

36
00:03:02,780 --> 00:03:04,720
and it's really i think worked out incredibly well

37
00:03:10,560 --> 00:03:14,120
i have more questions but if you have a follow on that that's cool

38
00:03:16,740 --> 00:03:21,300
uh we've done several kind of pre-briefing chats and these two are so chummy

39
00:03:22,760 --> 00:03:26,640
sorry no no no it's it's you know government working um

40
00:03:27,660 --> 00:03:31,160
i want to ask you like really point blank that was such a high profile the most high profile

41
00:03:31,160 --> 00:03:35,280
i work in news i can say that definitively the most high profile ransomware incident

42
00:03:35,280 --> 00:03:42,260
ever and there has not been anything like it in any of the jurisdictions for the csa um

43
00:03:42,880 --> 00:03:46,640
is that why these regulations and the partnership with sisa is that why

44
00:03:46,640 --> 00:03:51,320
i would love to be able to claim that i can't um but you know one of the things that we did

45
00:03:51,320 --> 00:03:54,920
do as well i mean that was the reporting requirement what was important that we did right

46
00:03:54,920 --> 00:03:55,980
after that in july

47
00:03:57,660 --> 00:04:01,440
was that we had some requirements for the owners of critical pipeline infrastructure so that's

48
00:04:01,440 --> 00:04:05,280
important it wasn't all pipeline infrastructure it was critical pipeline infrastructure

49
00:04:06,380 --> 00:04:13,020
to implement certain measures to protect their systems um a future attack not necessarily

50
00:04:13,020 --> 00:04:16,740
ransomware but a future attack on their information or operating systems

51
00:04:17,460 --> 00:04:20,760
as many of you might remember when we did issue that directive

52
00:04:20,760 --> 00:04:27,500
because it was so specific as to what was required we got a good deal of pushback on that

53
00:04:27,660 --> 00:04:33,460
because the industry would say that um hey you know you're asking us to put things in place that

54
00:04:33,460 --> 00:04:37,440
are going to replace things we're already doing that actually we think it's to the point you want

55
00:04:37,440 --> 00:04:43,540
to get to better than what you're requiring and you haven't fully considered the impact on our

56
00:04:43,540 --> 00:04:49,440
business model and so what we did in working with sisa and the fbi and the pipeline hazardous

57
00:04:49,440 --> 00:04:54,440
material safety agency over in dot and the department of energy was we had a series of

58
00:04:54,440 --> 00:04:57,300
roundtables with industry just to talk through this

59
00:04:57,660 --> 00:05:03,980
um net result was we went from a very prescriptive activities-based requirement to a performance

60
00:05:03,980 --> 00:05:11,100
based model which i think is far superior what we were doing before and and a huge credit to our

61
00:05:11,100 --> 00:05:18,580
industry partners for working with us on that so we made really 180 degree pivot on our approach

62
00:05:18,580 --> 00:05:25,080
to this particular regulation and i think that's a forbearer of change we'll make to regulations

63
00:05:25,480 --> 00:05:27,460
in the future for tsa so instead of

64
00:05:27,660 --> 00:05:32,400
saying hey achieve these certain activities and report on those activities we said

65
00:05:32,400 --> 00:05:39,160
there are certain outcomes we want you to achieve you come back to us on our operator and

66
00:05:39,160 --> 00:05:44,340
tell us how you intend to achieve that outcome and then we'll work with you to approve that

67
00:05:44,340 --> 00:05:49,620
implementation plan and then the follow-on to that is and this is really important this is where

68
00:05:49,620 --> 00:05:56,100
the stage we're at today is come back to us also after your implementation plan is approved and tell

69
00:05:57,660 --> 00:06:02,240
us how you are achieving those outcomes so it's not just tell us how you're doing and implementing

70
00:06:02,240 --> 00:06:08,120
those particular measures that you proposed and we approved but also how are those measures and

71
00:06:08,120 --> 00:06:11,740
the accomplishment of those measures uh contributing to the achievement of the

72
00:06:11,740 --> 00:06:16,900
outcome that's really important that's the stage uh that we're at today and and uh i'm really

73
00:06:16,900 --> 00:06:20,680
optimistic on how this is going to work because we've already seen some of the original initial

74
00:06:20,680 --> 00:06:24,940
plans and they look pretty good so we're going to be working through that over the course of the

75
00:06:24,940 --> 00:06:25,700
next couple of weeks

76
00:06:27,660 --> 00:06:34,200
the us did not have any kind of cyber regulation like this kind of infamously for years until this

77
00:06:34,200 --> 00:06:42,580
point um this is america a lot of businesses don't care for care for uh you know government

78
00:06:42,580 --> 00:06:50,640
regulation um is it the case when you speak with the leaders of these companies are they

79
00:06:50,640 --> 00:06:54,660
completely on board are there some that would like more regulation there's some that would

80
00:06:54,660 --> 00:06:55,860
like things to be done a little differently

81
00:06:57,660 --> 00:07:04,300
um you raised an important point kevin is uh when you speak and and um i would i would um offer that

82
00:07:04,300 --> 00:07:11,240
we speak frequently um to our industry partners um to the companies that we regulate um i would

83
00:07:11,240 --> 00:07:15,860
i would say that there's a more robust exchange of information as a result of this approach

84
00:07:16,160 --> 00:07:20,160
than there was before one of the things that we did at the very beginning when

85
00:07:20,520 --> 00:07:26,840
we saw this threat that is not simply a ransomware threat it's it's much more significant than that

86
00:07:27,660 --> 00:07:33,260
that we needed to work really quickly um to close vulnerabilities that we had across our

87
00:07:33,260 --> 00:07:39,800
critical infrastructure in the country and and so um we felt it was important that we bring the

88
00:07:39,800 --> 00:07:45,580
chief executive officers of those companies in for a classified briefing on the threat

89
00:07:45,580 --> 00:07:51,360
because we really wanted them to understand this is the threat that we see from the intelligence

90
00:07:51,360 --> 00:07:56,200
community in the united states which is incredible in their capability to inform

91
00:07:57,660 --> 00:08:03,040
decision makers like jen and me and so we we brought the ceos in for those threat briefs they

92
00:08:03,040 --> 00:08:09,400
were in the white house it was really the start of a very good relationship because they saw

93
00:08:09,400 --> 00:08:15,460
what we were seeing and the ceos knew that their cio and their sister was going to come to them

94
00:08:15,460 --> 00:08:20,580
shortly with a resource request maybe some procedural changes certainly a request for

95
00:08:20,580 --> 00:08:25,800
more people and the ceos knew what what was behind that what was the reasoning for that

96
00:08:25,800 --> 00:08:27,580
but you can't just do it

97
00:08:27,660 --> 00:08:33,500
once it's this can't be a one and done um exchange of information and so what we've established and

98
00:08:33,500 --> 00:08:39,740
and jen can speak to the processes that parallel ours but are very complementary um to what we do

99
00:08:39,740 --> 00:08:45,800
in terms of making sure there's good robust exchanges of information between us but we have

100
00:08:45,800 --> 00:08:51,360
regular updates to the ceos and then regular updates to the cios and the cissos these

101
00:08:51,360 --> 00:08:55,400
companies as this threat evolves and and you know one of the things that you always think about is

102
00:08:55,400 --> 00:08:57,580
hey i heard the threat i understand it i see

103
00:08:57,660 --> 00:09:02,260
it is it still present today um and this just reaffirms to them yes it's still present today

104
00:09:02,260 --> 00:09:06,720
actually in many ways it's more concerning today than it was yesterday and so we need to really

105
00:09:06,720 --> 00:09:13,260
work very hard um to close the vulnerabilities that we might have yeah i mean jump in with a

106
00:09:13,260 --> 00:09:18,660
couple of things first of all you know um great to be here with you all um kevin mentioned that dave

107
00:09:18,660 --> 00:09:24,880
and i are chummy um look at the end of the day this is what you you want uh your government to be

108
00:09:24,880 --> 00:09:26,700
you want your government to be

109
00:09:28,020 --> 00:09:28,580
you want your government to be

110
00:09:28,580 --> 00:09:33,260
and so i think it's a really good news story and one that has evolved

111
00:09:33,260 --> 00:09:39,360
in terms of how collaborative we all are working together and i think it was a really

112
00:09:39,360 --> 00:09:45,380
good news story of how closely our teams work after colonial pipeline i was not actually in

113
00:09:45,380 --> 00:09:49,280
government then i was still at morgan stanley at that point in time but certainly saw it

114
00:09:49,280 --> 00:09:53,860
from the perspective of being in the private sector and frankly being in a highly regulated

115
00:09:53,860 --> 00:09:56,860
industry um a couple things i'll say is

116
00:09:57,660 --> 00:10:02,420
you know it really was a watershed moment in many ways it certainly led to the security

117
00:10:02,420 --> 00:10:08,100
directives that dave talked about but i don't think we would have gotten uh

118
00:10:08,620 --> 00:10:14,580
what's called cercia the cyber incident reporting for critical infrastructure act if colonial

119
00:10:14,580 --> 00:10:20,960
pipeline had not happened and it really is a watershed piece of legislation that frankly the

120
00:10:20,960 --> 00:10:26,140
congress had been trying to pass for more than a decade that was about mandating critical

121
00:10:27,660 --> 00:10:32,620
infrastructure god illuminated the court the cisa if there was a significant cyber incident and

122
00:10:32,620 --> 00:10:38,420
we're in the final stages of writing the rule it uh the notice of uh rulemaking should come out

123
00:10:38,420 --> 00:10:43,620
early next year and will hopefully implement it by next year but it's really really important

124
00:10:43,620 --> 00:10:49,380
why because you know you read so much about ransomware going up ransomware going down

125
00:10:49,380 --> 00:10:56,360
my general belief is we just don't know you know we just don't have a really good handle

126
00:10:57,660 --> 00:11:04,680
scale of the ecosystem of cyber incidents because frankly it's not mandatory for reporting across

127
00:11:04,680 --> 00:11:10,700
the board so i think for the first time we'll actually be able to understand what the scope is

128
00:11:10,700 --> 00:11:16,280
of incidents and whether all the work that we've been doing across the federal government across

129
00:11:16,280 --> 00:11:23,320
industry across state and local across the globe is actually leading to reduce risk because at the

130
00:11:23,320 --> 00:11:30,000
end of the day that's what we're trying to do we're not trying to create punishments we're

131
00:11:30,000 --> 00:11:34,680
really trying to work with industry in a collaborative consultative way to ensure

132
00:11:34,680 --> 00:11:40,780
that we can help them reduce risk and you know the last thing i'd say to kevin's question is when i

133
00:11:40,780 --> 00:11:45,940
first came on board which was in july we did actually hear a lot of pushback from the industry

134
00:11:45,940 --> 00:11:52,300
groups about one of the directives and i will tell you we recently dave and i had a meeting

135
00:11:52,300 --> 00:11:53,160
with ceos

136
00:11:53,760 --> 00:11:59,400
where they could not have been more complimentary about the evolution of working with them in a

137
00:11:59,400 --> 00:12:05,200
consultative way i think part of that was the threat briefing but part of that was just freaking

138
00:12:05,200 --> 00:12:11,540
listening and that's why you see people like me and dave because we realize how important it is to

139
00:12:11,540 --> 00:12:17,420
listen to listen to industry to listen to the hacker community because we sure can't do this

140
00:12:17,420 --> 00:12:22,700
on our own i want to be clear here when you talk about this threat briefing are we talking this was

141
00:12:23,320 --> 00:12:27,960
related to colonial are we talking more recently no we've done threat briefings certainly for

142
00:12:27,960 --> 00:12:35,540
pipelines it wasn't related to the ransomware attack specifically it was related to hey what

143
00:12:35,540 --> 00:12:40,040
is the overall threat picture for critical infrastructure particularly for transportation

144
00:12:40,040 --> 00:12:45,060
infrastructure and energy infrastructure in the country same brief essentially very very

145
00:12:45,060 --> 00:12:52,780
similar to the rail sector the transit sector and now to air carriers and airports so you know across

146
00:12:53,320 --> 00:12:58,600
transportation sector we've been able to provide this level of visibility to the uh the top owners

147
00:12:58,600 --> 00:13:07,660
and operators of these systems um and you're you know you've got this what seems like what you're

148
00:13:07,660 --> 00:13:13,020
saying is an extremely effective partnership that works for you uh what other sectors would you

149
00:13:13,020 --> 00:13:17,700
like to have that kind of if you know if the red tape was not as much of an issue you know i'm

150
00:13:17,700 --> 00:13:22,600
thinking i'm reporting all the time on the ransomware attacks on hospitals they're diverting

151
00:13:22,600 --> 00:13:26,140
ambulances that are you know and bring care there's schools that are still being shut down

152
00:13:26,140 --> 00:13:32,660
all the time so one of the things that we did um last year when we were thinking about what

153
00:13:32,660 --> 00:13:38,700
are our priorities for the upcoming year was one of those sectors we called target rich cyber poor

154
00:13:39,460 --> 00:13:44,680
to kevin's point who were getting hit with ransomware in a way in a pretty bad way

155
00:13:44,680 --> 00:13:51,960
that could actually have very significant impacts so my mom is 90 and she's in and out of the

156
00:13:52,600 --> 00:13:56,940
hospital right and i am always very very concerned as i have in the back of my mind

157
00:13:56,940 --> 00:14:01,000
all of these hospitals that have been hit with ransomware you saw the recent one

158
00:14:01,740 --> 00:14:06,980
prospect medical hospitals i think for medical holdings where we've seen hospitals across the

159
00:14:06,980 --> 00:14:13,660
country that had to divert patients or or change elective surgeries it's really scary and so we

160
00:14:13,660 --> 00:14:19,720
actually picked priority sectors that we knew fell into this so hospitals in particular rural

161
00:14:19,720 --> 00:14:22,040
hospitals pay through 12 schools

162
00:14:22,700 --> 00:14:28,180
and water facilities because that's a sector that i'm particularly concerned about and then we also

163
00:14:28,180 --> 00:14:34,060
have a big focus over this year going into next on local election offices and we did it for a couple

164
00:14:34,060 --> 00:14:38,700
reasons so one of the roles we of course were set up to be america's civilian cyber defense

165
00:14:38,700 --> 00:14:45,060
agency but in statute we also play this role of national coordinator for critical infrastructure

166
00:14:45,060 --> 00:14:49,760
security and resilience what does that mean it means that we sort of sit at the center

167
00:14:49,760 --> 00:14:52,500
of working with departments and agencies that have

168
00:14:52,600 --> 00:14:58,300
a role to be the sector risk management agency so dave is the sector tsa is the sector risk

169
00:14:58,300 --> 00:15:05,080
management agency for oil and natural gas pipelines for rail for aviation and we work with

170
00:15:05,080 --> 00:15:12,420
him and all of the other departments and agencies to ensure that sector risk management agencies and

171
00:15:12,420 --> 00:15:18,880
industry have the risk guidance the information the resources the capabilities the best practices

172
00:15:18,880 --> 00:15:21,920
that we all need to be able to reduce risk

173
00:15:22,600 --> 00:15:25,800
critical infrastructure that americans rely on every hour

174
00:15:25,800 --> 00:15:33,680
of every day so a really really important role that we play and with respect to the target rich

175
00:15:33,680 --> 00:15:40,060
resource poor it's why we've been working hand in hand with hhs so my deputy nitin not a rajan

176
00:15:40,060 --> 00:15:46,100
who's fantastic started out as a as a medic and spent a lot of time in hhs so he's been

177
00:15:46,100 --> 00:15:52,420
working hand in hand with hhs and the american hospital association to put resources in place

178
00:15:52,600 --> 00:15:56,600
to reduce risk in hospitals we've been working with k through 12. there was a big white house

179
00:15:57,140 --> 00:16:01,800
event earlier this week where we had interrupted by superintendents say again interrupted by a

180
00:16:01,800 --> 00:16:07,100
tornado interrupted by a tornado but like amazing that we were able to actually flip it a day and

181
00:16:07,100 --> 00:16:11,100
it was so important to the first lady that she actually rearranged her whole schedule to be there

182
00:16:11,100 --> 00:16:15,940
we had all these superintendents so that we could work together with schools we're doing the same

183
00:16:15,940 --> 00:16:20,660
thing with water and then again local election offices and so you know part of this just goes

184
00:16:22,600 --> 00:16:26,740
back to the fact that we have a lot of technical expertise we've got a lot of it here so hopefully

185
00:16:26,740 --> 00:16:31,600
you're meeting our assistant colleagues but those departments and agencies have incredible technical

186
00:16:31,600 --> 00:16:36,840
expertise in those sectors that we don't have about rail about aviation about hospitals about

187
00:16:36,840 --> 00:16:41,460
water and so when you bring that together along with our partnerships with industry

188
00:16:42,020 --> 00:16:51,280
you really can collaborate to reduce risk do you feel like you have enough in terms of policy

189
00:16:51,280 --> 00:16:51,720
allowance

190
00:16:52,680 --> 00:16:58,720
to address those specific sectors or would you like more yeah i mean i feel like i'm always

191
00:16:58,720 --> 00:17:04,900
grateful to the cyberspace solarium commission folks and dave was on there as well so some of

192
00:17:04,900 --> 00:17:11,060
you might know it was a commission uh set up by congress several years ago it was chaired by

193
00:17:11,060 --> 00:17:16,040
angus king of maine and mike gallagher of wisconsin it had senior leaders from across

194
00:17:16,040 --> 00:17:21,100
the federal government you know i often say so the government sets up commissions all the time

195
00:17:21,100 --> 00:17:22,580
and some of the

196
00:17:22,600 --> 00:17:28,480
them like meet a lot and don't really get much done in my 30 plus years in government i've seen

197
00:17:28,480 --> 00:17:35,520
two commissions that actually got done one was the 911 commission the second was the

198
00:17:35,520 --> 00:17:41,300
cyberspace solarium commission that literally made 75 recommendations and more than half of them

199
00:17:41,300 --> 00:17:49,220
are in legislation and sisa benefited incredibly from those recommendations that got put into law

200
00:17:49,220 --> 00:17:52,580
in 2021 and i benefited when i came in as a non-reporting member so you very much, because she's gonna be your

201
00:17:52,580 --> 00:17:57,920
director and so some of the things that we would have wanted frankly several years ago that my

202
00:17:57,920 --> 00:18:02,860
great friend chris krebs may have wanted you know the ability to hunt persistently on federal

203
00:18:02,860 --> 00:18:08,460
networks the ability uh to work directly with our sector risk management agencies to actually put

204
00:18:08,460 --> 00:18:13,760
measures in place to keep sectors safe uh the authorities we have to stand up the joint cyber

205
00:18:13,760 --> 00:18:18,860
defense collaborative i feel like we're in and then cercea of course they feel like we're in a

206
00:18:18,860 --> 00:18:24,340
very positive place with respect to our authorities you know i often get asked well do

207
00:18:24,340 --> 00:18:29,760
you want regulatory authorities and i always say no this doesn't want to be a regulator we work

208
00:18:29,760 --> 00:18:35,800
very closely with regulators but at the end of the day the magic of sisa is our ability through

209
00:18:35,800 --> 00:18:40,920
our technical expertise and our trusted partnerships to be able to work across industry

210
00:18:40,920 --> 00:18:47,620
in a way that you know frankly is a little bit harder um with regulators so so i think we're cool

211
00:18:48,220 --> 00:18:48,480
okay

212
00:18:50,200 --> 00:18:58,620
um i don't know probably most of you can't see this but jen's arm she has what appears to be a

213
00:18:58,620 --> 00:19:04,880
temporary tattoo or is this is this a full thing okay this one's real and these are temporary but

214
00:19:04,880 --> 00:19:10,100
if since you brought it up here's a funny story so we are recruiting for technical experts right

215
00:19:10,100 --> 00:19:16,660
and i was like i'm so into it because we've hired like 1330 people since i came on board i'm gonna

216
00:19:16,660 --> 00:19:18,520
tattoo our temporary

217
00:19:18,860 --> 00:19:25,860
i would do it if i if somebody had time so so so so my guys like we made these temporary tattoos

218
00:19:26,600 --> 00:19:31,200
and they put it on like yeah let's let's go for it and like it just doesn't work

219
00:19:31,200 --> 00:19:35,940
it was like this morning let's do another one and it doesn't work so we have the qr

220
00:19:35,940 --> 00:19:39,600
code separately my whole body is going to be tattooed with these temporary tattoos so

221
00:19:40,080 --> 00:19:46,380
but we're hiring we're hiring people so come see us we have real qr codes that work not on my body

222
00:19:46,900 --> 00:19:48,620
this really was this was my lead-in

223
00:19:48,860 --> 00:19:52,100
to let you guys kind of make the pitch for i think a substantial reason why

224
00:19:53,100 --> 00:19:56,980
you guys are here but also i've been coming to defcon for almost 10 years

225
00:19:57,460 --> 00:20:01,080
there are a lot more federal officials giving talks these days and this for a reason i think

226
00:20:01,720 --> 00:20:07,700
well i you know i would say the the key reason is you have uh in in the audience uh expertise

227
00:20:07,700 --> 00:20:12,060
that we desperately need you have perspective we desperately need them and you heard about the

228
00:20:12,060 --> 00:20:17,520
work that we're doing um i would want to make sure that the work we do is based on the very best

229
00:20:17,520 --> 00:20:18,760
information that we can get

230
00:20:18,860 --> 00:20:24,680
um and so we're here to really seek your advice your counsel we have some mechanisms

231
00:20:24,680 --> 00:20:29,880
um to be able to do that and then the other one is just clearly like like jen said we're here

232
00:20:29,880 --> 00:20:36,080
because we're hiring you know we need talent and um i think i can tell you from my own experience

233
00:20:36,080 --> 00:20:41,280
working in the federal government i'm i'm six years into uh being the tsa administrator um

234
00:20:41,280 --> 00:20:47,740
the work we do together with sisa with the fbi with the department of transportation um the white house

235
00:20:48,860 --> 00:20:55,480
is incredibly rewarding i mean you you have impact at a scale that um is is just challenging

236
00:20:55,480 --> 00:21:01,620
at times but but the benefits are are incredibly rewarding and we had a great booth here at uh at

237
00:21:01,620 --> 00:21:10,740
defcon uh offered up a lot of decals offered up a lot of ways to approach tsa for positions but if

238
00:21:10,740 --> 00:21:15,240
you're interested please give it consideration and i think too that you know in my career you

239
00:21:15,240 --> 00:21:18,840
know the the ability to build a network is really important for you to be able to build a network

240
00:21:18,860 --> 00:21:22,480
success throughout your career and if you come into government you build a network inside

241
00:21:22,480 --> 00:21:26,860
government uh when you return to the private sector if you do you continue to keep that

242
00:21:26,860 --> 00:21:31,020
relationships and that network you have in the private sector very warm and i think that really

243
00:21:31,020 --> 00:21:36,780
helps the entire system uh work uh incredibly well so um that's what we'd really like to

244
00:21:37,320 --> 00:21:42,400
encourage you to do is if you know somebody who has has talent that you think we could benefit by

245
00:21:42,760 --> 00:21:48,440
please encourage them to look up sisa look up tsa look up any sector risk management agency quite

246
00:21:48,860 --> 00:21:55,240
because we all need um the talent um we also announced um earlier in this conference a

247
00:21:55,240 --> 00:22:00,940
project that um jen and i have together it's called chariot and so um you know we we we

248
00:22:00,940 --> 00:22:06,180
wrestled with the acronym um but we felt okay chariot is a transportation thing right and

249
00:22:06,180 --> 00:22:12,980
and this is a a transportation project and we are at caesar's so um the chariot and caesar sort of

250
00:22:12,980 --> 00:22:18,520
go together um but what chariot stands for is a critical ins uh infrastructure

251
00:22:18,860 --> 00:22:24,620
hardening achieved through risk reduction information and operational technology um

252
00:22:26,080 --> 00:22:35,160
way to go thanks um i've been practicing a lot um but um but basically what it stands for it's

253
00:22:35,160 --> 00:22:40,120
a partnership between um tsa between sisa between the department of homeland security

254
00:22:40,120 --> 00:22:45,980
science and technology directorate between the pipeline hazardous material safety administration

255
00:22:45,980 --> 00:22:47,860
and the federal railway administration

256
00:22:48,860 --> 00:22:52,440
and also the pacific northwest national laboratory and what we'd like to do

257
00:22:52,850 --> 00:23:00,300
is to um to get um more industry input and your input on uh hey if you looked at the rail sector

258
00:23:00,300 --> 00:23:05,040
or the pipeline sector how would you prioritize the risk as a hacker

259
00:23:05,040 --> 00:23:10,760
to those sectors and then the important uh the other important part is i mentioned we need to

260
00:23:10,760 --> 00:23:18,600
have an objective way to assure ourselves and to assure the public what we're doing is having an

261
00:23:19,700 --> 00:23:24,420
how do we have what we're doing with the people our clients in our campus and be ready to

262
00:23:24,420 --> 00:23:26,040
do what we have to do and push our efforts to make sure we are visualizing the storytelling

263
00:23:26,040 --> 00:23:27,840
of how we are using data to simulate or what happens uh one of my favorite medical

264
00:23:33,560 --> 00:23:37,620
Imagery plans in your app is the Aid for the Accidentluk database because when we use this data

265
00:23:37,620 --> 00:23:38,340
a lot of data takes time but having data will take time.

266
00:23:38,340 --> 00:23:48,840
As i said just a side note

267
00:23:48,840 --> 00:23:53,020
up and operating and so if you could really help us with giving us sort of a

268
00:23:53,020 --> 00:23:58,200
risk prioritization and also helping us develop those risks those those threat

269
00:23:58,200 --> 00:24:01,720
scenarios so we can play out those threat scenarios and we promise that

270
00:24:01,720 --> 00:24:06,620
what we will do in a future DEF CON is to provide you feedback as to is to how

271
00:24:06,620 --> 00:24:11,000
that went and I'm hoping that when I come back next year and I'll declare

272
00:24:11,000 --> 00:24:15,300
myself a new guy again next year so I can do the the shots it's not really my

273
00:24:15,300 --> 00:24:21,440
first I know nor Jen's but you know to give you some feedback is to hey how did

274
00:24:21,440 --> 00:24:26,580
that go what do we develop out of it we had a initial roundtable yesterday on

275
00:24:26,580 --> 00:24:30,360
this got some really good results so I just ask you to think of project chariot

276
00:24:30,360 --> 00:24:35,640
it's it's really a way for you to really help us out and to help the country out

277
00:24:35,640 --> 00:24:39,340
and help everybody that lives in the United States to make them feel more

278
00:24:39,340 --> 00:24:44,760
protected and Jen's point about the the hospital system I'm to make sure that

279
00:24:44,760 --> 00:24:45,100
the critical

280
00:24:45,100 --> 00:24:48,820
infrastructure that all of us depend on ourselves and for our families and for

281
00:24:48,820 --> 00:24:53,360
our friends in our communities is is back on its feet as quickly as it can if it's

282
00:24:53,360 --> 00:24:59,220
ever attacked a couple things about why we're here obviously recruiting is one

283
00:24:59,220 --> 00:25:04,900
but one of the really cool things that we've been focused on over the last year

284
00:25:05,480 --> 00:25:10,960
is creating a partnership with the hacker community to help us get ahead of

285
00:25:10,960 --> 00:25:13,340
the ransomware problem right this was also

286
00:25:13,340 --> 00:25:20,700
part of what we learned from Colonial Pipeline is we really need to be able to

287
00:25:20,700 --> 00:25:29,940
rely on partners who are seeing malware before it actually it's activated and so

288
00:25:29,940 --> 00:25:33,300
there's some fantastic researchers out there there's threat and tell people

289
00:25:33,300 --> 00:25:38,520
there's some industry folks who have been given are giving our team in the

290
00:25:38,520 --> 00:25:43,220
joint cyber defense collaborative essentially tips and so it's

291
00:25:43,340 --> 00:25:48,180
part of what we call our pre ransomware notification initiative and so we've

292
00:25:48,180 --> 00:25:53,460
been getting tips we take those tips when malware is laid down it could be

293
00:25:53,460 --> 00:25:59,800
you know anywhere between 5 to 48 hours before it's actually activated and data

294
00:25:59,800 --> 00:26:04,720
is encrypted and so we then use our field force so one of the other things

295
00:26:04,720 --> 00:26:08,860
we've been building over the past two years our cybersecurity advisors across

296
00:26:08,860 --> 00:26:12,760
the country so we have them in every state of the nation I think at this

297
00:26:12,760 --> 00:26:16,660
point in time and they then take these tips and then they've been reaching out

298
00:26:16,660 --> 00:26:21,380
to let people know hey it looks like you have something on your system you need

299
00:26:21,380 --> 00:26:26,600
to do something about it right away and we've done it now 600 plus times to

300
00:26:26,600 --> 00:26:31,860
schools to also internationally and we've really been able to make an

301
00:26:31,860 --> 00:26:37,400
impact and again the thing that I love most about this is is it's all based on

302
00:26:37,400 --> 00:26:40,840
trust I mean that's the most important currency is people reach out to us

303
00:26:40,840 --> 00:26:42,660
because they trust us with the information

304
00:26:42,760 --> 00:26:47,400
and they believe we're gonna do things about it so gonna do something good with

305
00:26:47,400 --> 00:26:52,360
it and so again that's really what this community is all about is how do we use

306
00:26:52,360 --> 00:26:57,700
our skills to make a difference to make an impact for the betterment of the

307
00:26:57,700 --> 00:27:03,600
nation speaking of that you know you've got got a four-year term I won't ask

308
00:27:03,600 --> 00:27:12,560
you to speculate right now on whether they'll going I don't want you can what would you like to see

309
00:27:12,760 --> 00:27:16,880
the ransomware defense landscape look like five years from now

310
00:27:19,780 --> 00:27:27,020
oh I mean more ransomware so look I appreciate you asking the question

311
00:27:27,020 --> 00:27:34,900
because I have long thought that we cannot keep doing the same thing that

312
00:27:34,900 --> 00:27:39,480
we're doing and expect a different outcome and it's one of the reasons we

313
00:27:39,480 --> 00:27:42,360
might my teammate Eric Goldstein who heads up cyber

314
00:27:42,760 --> 00:27:47,380
for CISA and I wrote this article earlier this year she's really trying to

315
00:27:47,380 --> 00:27:51,460
get out what is a more sustainable approach to cyber security one that can

316
00:27:51,460 --> 00:27:56,460
actually make a difference and we talked about sort of four things one is this

317
00:27:56,460 --> 00:28:00,480
concept of cyber civil defense one is our persistent operational collaboration

318
00:28:01,420 --> 00:28:05,920
one is corporate cyber responsibility but the one that we think can make the

319
00:28:05,920 --> 00:28:12,560
most difference in driving down the threat impact is secure by design

320
00:28:12,560 --> 00:28:17,340
technology you know we we now live in a crazy world where we've normalized the

321
00:28:17,340 --> 00:28:22,740
fact that technology products come off the line full of vulnerabilities that

322
00:28:22,740 --> 00:28:28,640
can be exploited by threat actors and so you we've accepted this and it's

323
00:28:28,640 --> 00:28:33,920
frankly perverse and we really need to change the paradigm where technology

324
00:28:33,920 --> 00:28:40,620
companies are not just focused on speed to market and cost and cool features but

325
00:28:40,620 --> 00:28:42,540
first and foremost on creating a more sustainable and sustainable technology

326
00:28:42,540 --> 00:28:48,180
creating tech that is safe and secure I mean let's be real right there's a

327
00:28:48,620 --> 00:28:53,980
multi-billion dollar cyber security industry because technology companies

328
00:28:53,980 --> 00:28:58,420
have never had to focus first and foremost on security the incentives were

329
00:28:58,420 --> 00:29:03,360
all misaligned and so we've we're really trying to work with our partners across

330
00:29:03,360 --> 00:29:08,460
the government we did a workshop earlier today with our teammates at the National

331
00:29:08,460 --> 00:29:12,180
Cyber Director's office to really catalyze what I call a

332
00:29:12,180 --> 00:29:17,700
secure by design revolution and I would ask everybody if you haven't seen the

333
00:29:17,700 --> 00:29:22,360
stuff that we put out we put out a white paper it's on our webpage page please go

334
00:29:22,360 --> 00:29:27,320
to CISA.gov forward slash secure by design and take a look at that because

335
00:29:27,320 --> 00:29:31,620
you know we want feedback we want to refine this we want to bring in more

336
00:29:31,620 --> 00:29:36,340
partners because at the end of the day we want to ensure that we now have a

337
00:29:36,340 --> 00:29:42,000
market signal coming from customers that we all care about security for our

338
00:29:42,180 --> 00:29:43,480
teachers for our staff for our students, for our students,

339
00:29:43,480 --> 00:29:48,100
for our personal for our family for our communities for our businesses and I

340
00:29:48,100 --> 00:29:49,960
think frankly Kevin if we

341
00:30:12,180 --> 00:30:18,080
time and I had assumed the two giant threats that yeah I feel like I'm

342
00:30:18,080 --> 00:30:22,180
hearing about all the time or ransomware often from Russian related criminal

343
00:30:22,180 --> 00:30:29,360
groups and barrage of Chinese espionage and I hope you don't it's not a breach

344
00:30:29,360 --> 00:30:35,420
of confidence to to say you were kind of quick to to correct me I think I had

345
00:30:35,420 --> 00:30:42,040
maybe underestimated the extent to which maybe China won't you I'll let you define

346
00:30:42,040 --> 00:30:46,020
I don't want to yeah so you know I've talked about kind of the two epoch

347
00:30:46,020 --> 00:30:52,840
defining threats and issues that I'm concerned about one is AI I mentioned AI

348
00:30:52,840 --> 00:30:56,840
because you can't have a conversation without mentioning AI so that's done

349
00:30:56,840 --> 00:31:04,520
right and then let's talk about China I you know I think at the end of the day

350
00:31:04,520 --> 00:31:10,680
if you look at some of the information that the US government has put out over

351
00:31:10,680 --> 00:31:11,920
the past six months

352
00:31:12,040 --> 00:31:19,420
and then you look at what is happening across the geopolitical landscape I hope that people

353
00:31:19,420 --> 00:31:27,500
are taking seriously a pretty stark warning about the potential for China to use their

354
00:31:27,500 --> 00:31:34,160
very formidable capabilities in the event of a conflict in the Taiwan Straits to go after our

355
00:31:34,160 --> 00:31:38,740
critical infrastructure and I think we've seen a change and frankly you saw it in some of the

356
00:31:38,740 --> 00:31:43,980
products that we put out earlier this year a cybersecurity advisory that talked about

357
00:31:43,980 --> 00:31:50,720
Chinese state state-sponsored actors living off the land so not malware but actually using the

358
00:31:50,720 --> 00:31:58,080
native processes of a computer to hide in those systems and it wasn't for espionage or data theft

359
00:31:58,080 --> 00:32:04,880
which we've been seeing arguably for decades it was more likely for disruption and destruction

360
00:32:04,880 --> 00:32:08,720
and if you read the intelligence community annual threat assessment

361
00:32:08,720 --> 00:32:13,680
assessment, there's a pretty stark warning that talks about in the event of a conflict, China will

362
00:32:13,680 --> 00:32:21,540
almost certainly consider aggressive cyber attacks against U.S. critical infrastructure and is almost

363
00:32:21,540 --> 00:32:27,080
certainly capable of disruption or destruction when it comes to oil and natural gas pipelines

364
00:32:27,080 --> 00:32:33,640
and railroads. And so I really, what we've been talking about, Kevin, is we need to take this

365
00:32:33,640 --> 00:32:38,780
warning very seriously. And that's why we've been talking so much and, you know, Victor, Zora, and I,

366
00:32:38,820 --> 00:32:43,740
my counterpart in Ukraine, talked to Black Hat about the importance of resilience, expecting

367
00:32:44,280 --> 00:32:50,260
that there will be disruption and planning and preparing for it now, identifying your high-value

368
00:32:50,260 --> 00:32:56,320
assets, doing the exercises to be able to put in place manual overrides, manual controls to be able

369
00:32:56,320 --> 00:33:01,440
to operate in a degraded state, and then ensuring that you can recover as rapidly as possible

370
00:33:01,440 --> 00:33:03,420
to mitigate risk.

371
00:33:03,640 --> 00:33:09,380
So think about Ukraine as really a shining example of not just cyber resilience, but also operational

372
00:33:09,380 --> 00:33:14,720
resilience, dealing with all the barbaric kinetic attacks, and then very importantly, societal

373
00:33:14,720 --> 00:33:21,340
resilience, which I fear we have lost as a nation. If you look at the reaction to colonial pipeline,

374
00:33:21,620 --> 00:33:28,900
if you look at the reaction to the high-altitude balloons, at the end of the day, we need to be

375
00:33:28,900 --> 00:33:33,620
pretty pragmatic about the potential for these attacks, be prepared to meet the needs of the

376
00:33:33,620 --> 00:33:38,560
American people, and to meet them with resilience and, frankly, with unity as an American people.

377
00:33:40,180 --> 00:33:42,380
And I think too that...

378
00:33:48,000 --> 00:33:53,860
Time is not our friend in this quest, and we need to move very, very quickly. That's why we've moved

379
00:33:53,860 --> 00:33:59,620
so quickly, and so has our industry partners. I mean, you know, there's literally, we need to be

380
00:33:59,620 --> 00:34:03,600
ready now. And the more we can do to make sure that we are ready to meet the needs of the American people,

381
00:34:03,620 --> 00:34:11,720
that we're not worrying about how ready we are. We know how ready we are, and we know how we can

382
00:34:11,720 --> 00:34:19,660
manage any kind of attack on U.S. systems in a way that protects our ability to respond and in a way

383
00:34:19,660 --> 00:34:26,240
that protects our population and that allows our population to have confidence in its government

384
00:34:26,240 --> 00:34:31,340
and have confidence in its industry leaders that they've done everything they can to be ready for

385
00:34:31,340 --> 00:34:34,100
this. So preparedness is the name of the game here.

386
00:34:36,040 --> 00:34:44,240
Jen, you mentioned speaking with Victor Zora, your counterpart in Ukraine, and not just in cyber,

387
00:34:44,280 --> 00:34:51,020
in all kinds of ways, the U.S. government has provided really substantial assistance to Ukraine,

388
00:34:51,260 --> 00:34:55,840
an ally being bullied by a much larger antagonistic nation to the United States.

389
00:34:57,820 --> 00:35:01,100
There are some ways in which you can kind of map that onto China, Taiwan,

390
00:35:01,340 --> 00:35:08,640
but we have a more fraught diplomatic relationship with Taiwan. Does that impact the ability to share

391
00:35:09,280 --> 00:35:13,240
cyber threat information, things like that, in such a...

392
00:35:13,240 --> 00:35:19,200
Yeah, I mean, it's something we're frankly thinking really hard about, and I've been really encouraged.

393
00:35:19,320 --> 00:35:29,580
So we signed a memorandum of cooperation with Ukraine just about a year ago, and we very purposely put a lot of resources

394
00:35:31,340 --> 00:35:40,600
into it. How we could help build capacity, both in terms of threat hunting kits, how we share very detailed

395
00:35:40,600 --> 00:35:49,280
threat information, how we do exercises, a cyber incident response plan, working with other international partners

396
00:35:49,280 --> 00:35:57,080
like the Canadians who are going to do forensic training with them. And so really deliberately putting a lot

397
00:35:57,080 --> 00:36:00,840
into these lines of effort. And we have gotten probably...

398
00:36:01,340 --> 00:36:08,400
As much out of it as the Ukrainians have, because what they have learned over the past year and a half, obviously,

399
00:36:08,500 --> 00:36:18,280
but 10 years since Crimea, I think has incredible teachings for us as we think about both capacity building with Taiwan,

400
00:36:18,920 --> 00:36:28,380
which is something that I do think, to your point, Kevin, we can map some of that, and we certainly do share information with Taiwan CERT now.

401
00:36:28,840 --> 00:36:31,320
But we would want to figure out how to...

402
00:36:31,340 --> 00:36:40,340
How to help from a capacity building front to ensure that, again, the lessons that we're learning with respect to Russia's aggression

403
00:36:40,940 --> 00:36:43,640
over Ukraine can be applied. I think it's really important.

404
00:36:45,480 --> 00:36:52,780
We are nearly out of time. If you guys... Oh, we have five minutes. Do you have any closing remarks, anything last thing you want to share

405
00:36:52,780 --> 00:36:54,400
with this audience while you've got them captive?

406
00:36:54,780 --> 00:37:01,260
Sure. My closing comment is really just thank you. Thank you for the welcome that we've received.

407
00:37:01,340 --> 00:37:08,420
Over the last couple of days, we've had about 30 TSA people here, and really appreciate all the work that they have done.

408
00:37:08,880 --> 00:37:18,640
And all the education you have provided to all of us. So really, thank you. And I look forward to continuing to develop a very good relationship with DEFCON.

409
00:37:18,700 --> 00:37:24,360
So thank you very much. Awesome. So thanks, Kevin, for doing this. Really appreciate it. And thanks, Dave.

410
00:37:24,440 --> 00:37:31,100
Dave has been in the department for a long time. He was like the vice commandant of the Coast Guard, and the acting deputy secretary.

411
00:37:31,340 --> 00:37:34,860
and David I had not been in the Department of Homeland Security I was in

412
00:37:34,860 --> 00:37:38,360
DoD most of my career and then I was in the private sector and so Dave's kind of

413
00:37:38,360 --> 00:37:44,440
been my Sherpa since I got to DHS and has been a really great friend and

414
00:37:44,440 --> 00:37:49,020
teammate and colleague so I do want to thank you for your leadership and your

415
00:37:49,020 --> 00:37:54,460
partnership and and yeah I mean this is such a great community that's my favorite

416
00:37:54,460 --> 00:37:59,300
time of the year I love the energy I love the community I believe in what

417
00:37:59,300 --> 00:38:05,000
this community does and I really really think we can make a difference for the

418
00:38:05,000 --> 00:38:09,920
nation so for those who are interested in working at Team CISA please come

419
00:38:09,920 --> 00:38:16,340
chat with me and my teammates but really come work with us because we really want

420
00:38:16,340 --> 00:38:22,920
to collaborate leveraging all the skills you have and all the skills we have for

421
00:38:22,920 --> 00:38:26,700
the better of the nation so and the last thing I'd say is I'm also doing the

422
00:38:26,700 --> 00:38:29,280
next talk with my friend

423
00:38:29,300 --> 00:38:33,620
Scott Shapiro who's a professor at Yale who wrote a great book called fancy bear

424
00:38:33,620 --> 00:38:40,820
goes fishing we have renamed the talk beers and bears so go get your beer and

425
00:38:40,820 --> 00:38:44,480
meet us back here at 530 for a great talk thank you