thank you very much and welcome everybody uh to the panel on the future of nfts
sorry we all know what that is um so no this is the software resilience panel so welcome
um so we have got an a stellar lineup really as you can tell um and um i'm going to introduce
them from this end so first of all we have camille stuart bloster who's the deputy national cyber
director at the technology and ecosystem security division at the office of the national cyber
director at the white house in the united states that's the shortest job title i've ever heard
then we have charlie gladstone who's head of software resilience at the department for science
and technology in the uk um then we who's this who's this guy does anybody know this guy
it's your hands is anyone nobody dr alan friedman and he was the senior advisor and strategist at
the cyber security and infrastructure security agency cisa in the united states welcome uh and
myself uh so my name is david rogers and uh i advise the uk government on some security stuff
i'm the chair of the fraud security group at the the mobile industry association the gsm so um i'm
just here to kind of facilitate here and i'm also standing in for jen ellis who unfortunately can't
be here and we all send her our best wishes as well um and hopefully she's watching uh live now
hi jen so um so we're going to kind of split this up and we would like to have uh quite a
lot of audience participation so um please somebody's starting to fall asleep already
so yeah you get off your phone
hey that woke you up didn't it it's going to get better um so um we're going to talk about
a global approach to tackling software resilience because software resilience isn't the biggest
problem we've got in cyber for one of um networks yeah networks yeah cameras phones
yeah we'll all be in a job anyway for a few
years so um yeah so what we're going to do is we're going to kind of flip through the risks
well we'll spend a little bit of time on the risks then we'll talk about the challenges
then we'll talk about solutions and throughout this you can ask any question any question to the
panelists that you like i can't promise you that i'll answer them to the to the other panelists
and um yeah we'll see how we get on so so start
thinking about some of the questions that you'd like to ask the panelists you know you don't get
to meet these people every day uh thankfully but uh but but please do you know you now is
your opportunity so um i'm going to start with camille so welcome camille thanks for having me
hi everyone so what does the software resilience mean to you yeah i'm gonna i'm gonna start
you know what my office does how many of you are familiar with the office the next people hear you
okay can you hear me now okay how many of you are familiar with the office of the national cyber
director i love that as i do this over the last year more hands go up in a room
but just to level set for anyone who is not familiar the office of the national cyber director
is the newest office in the executive office of the president
organized to orient ourselves around the national cyber policy how do we set an agenda for
the united states around cyber
policy we aim to do that in four ways one drive federal coherence to embark on public private
partnerships and when i say private i mean in the broadest sense all non-federal partners state and
local international partners private sector industry everyone we want to align resources
to aspirations so we've got to make sure the money is there to do the work that we
said we want to do and we want to focus on future resilience and that's really where my division sits
focus on future resilience of people in technology and on the technology side which is most
of the priorities that we have set
as
a nation and in this international ecosystem and we recognize that there has to be a global endeavor
if you've taken a look at the national cyber security strategy you'll see global supply
chains called out explicitly but also what you'll notice is that supply chain security is a thread
throughout all of the pillars that's how we become more defensible it's how we move towards that
affirmative vision we said it's a piece of the puzzle as we think about shifting market forces
and all of those things and so it's a real priority for us as an organization and and as we
think about software in particular we've really honed in on what is the most atomic unit and
that's the code and so how do we make sure we have resilience in the code that it is defensible
and that you know raises two things one how are we thinking about open source software security
how are we focused on the most composable parts of the
of the ecosystem right so one of the greatest things about our software is that some really
smart and um generous people have decided to like make code and make it available to a bunch
of people that's something we want to incentivize but also means that there are inconsistent
standards that things are insecure and we really need to focus on making sure that security is a
part of the model when we develop code whether it's open source whether it's
proprietary and most proprietary code is built on open source code as well it includes some open
source code so when we think about that how are we going to advance the work there um we we really
want to focus on collaborating with our partners our international partners our private sector
partners to understand the scope of the problem and the opportunities and you'll see in the
national cyber security strategy two of the biggest way we do that is that open source
software security initiative and software liability and thinking about that and i'm sure
that we'll get into that more as we have the conversation but just want to highlight those things
okay good start okay and over to you Charlie great uh can you guys hear me all right
super um i might actually steal your eye uh your idea Camille uh because i'm expecting
probably fewer people but uh could you guys raise your hands if you've heard of the uk department
for science innovation and technology okay actually you know pretty good i don't blame you
because uh dsit as we're known uh was only actually created about six months ago um and
it was a sort of a new department um based on a combination of uh uh that what was previously the
department for digital culture media and sport which is uh as you can imagine it's a pretty broad
department they basically took the d of dcms uh and merged it with uh some different aspects of
our department for business energy and industrial strategy to create a new department whose uh sort
of real overarching ambition is to really cement the uk's position as a science and technology
superpower in the world uh you know you've got a lot of work to do but i think it's a really good
practice that's still a an incredibly broad remit you know everything from sort of space policy
science and innovation artificial intelligence but also obviously cyber security
and cyber security is is split in terms of responsibilities across a few departments in the
british government so specifically dsit is responsible for uh developing the uk's cyber
ecosystem and actually growing sector helping to secure the technologies that we use on a day-to-day
responsible for organizational resilience when it comes to cybersecurity so you know obviously
quite a few of the different themes of that I think I'm definitely keen to discuss today so
in terms of what the UK is interested in I mean I think I imagine most of the crowd here appreciates
why software security is important you know it's the absolute lifeblood of the digital economy and
is absolutely key to driving innovation in the tech sector but also you know realistically in
modern day it's also key for all sorts of organizations productivity and in the UK we
are one sort of one of the largest consumers of software in Europe but we're also sort of have
a really significant developer presence so I think we're sort of interested in it from from
all sides our work sort of looking particularly software supply chains stemmed from a call for
views that we held in in 2021 looking at supply chain risks relating to cyber in general and
one of the key things that came out of that was that software supply chains weren't just the
biggest risk but they were actually something that really needed more investigation and really more
of a deep dive into it so in February this year we published a call for views looking specifically
at resilience and security about software used by businesses and organizations in the UK and there
we sort of set out some of the risks that we were identifying across the software lifecycle we also
asked for views on sort of what industry and and the sector is already doing to mitigate some of
those risks but crucially we also asked for views on what the government should actually do about it
so that closed in May and we've spent the last few months sort of listening to views and really
understanding the quite wide range of views that we heard through that through that corporate views
so today I'm really keen to sort of share some of those things that we've heard but also I'm
definitely here to listen as well so yeah as David said really keen for questions but also I would
want to just share their views on what the risks are in this space you know anything really I'm
definitely here to listen as well so yeah I mean thanks again to DEF CON for having me I think
hopefully this is going to be a really great conversation great you can tell that out of this panel I'm
the one that said he doesn't need a mic uh you shouldn't have a mic I guess feeling left out
all right s-bomb hi my name's Alan uh
we agreed that Alan's not allowed to talk about s-bomb on the panel this causes me physical pain
um but no right we won't talk about the specifics implementation unless folks want to get into it
but when you are starting to try to build this they're sort of a couple of phenomena which is
that one everyone in the world is now a software company right we all know this we have amazing
people from avionics and automotive and medical
uh in DC you say law firms are software companies and they're like don't be ridiculous and then you
say Panama Papers and they say oh right um so we we sort of have this model and so that means that
the solutions that we advocate have to scale for the entire ecosystem uh and that started off as
you start an initiative around different
challenges to advancing new technology new paths to transparency new tools we all start at the same
starting point so we actually can coordinate one of our fun challenges moving forward as we think
about resilience is we all advance at different paces so in the cloud native world s-bomb is kind
of solved it's boring there's a Docker command called s-bomb you know what it does it gives you
an s-bomb now there are several
people in this room that I've shared the stage with who hate when I use that example because
you know what that doesn't work for a new satellite addressable Transformer right they
the people that make OT the people that make the stuff that affects human safety
don't really use that kind of cloud native technology yet so we need to sort of understand
that so that's one of the the higher level challenges that we have in the policy space
is how do we work with the full richness of the software community and then the second piece of
course we haven't done a good job of defining resiliency and part of the problem is there's
a famous very popular internet pastime that was famously defined by the U.S Supreme Court
which is well we don't know how to define it but we know it when we see it uh and and
resiliency I think fits
you remember that time that I was in the panel at the White House
remember when they used to let me speak in public
so part of the problem and I think my approach at sisa where we look to our friends at the White
House and partner with them on the high level strategy but a lot of the work that we do at sisa
is identifying
what are concrete things that we can work on and build Coalitions around uh that make a tangible
difference and so of course we'll spend a lot of time today talking about the first step which is
transparency right you gotta know what you have you have to know what's out there and that also
creates some challenges so Camille talked about liability accountability and transparency play
terribly together but we need both of them right
to encourage good actors to talk about what they're doing and have visibility
not just from government regulators but from private contracts right everyone is
in the supply chain most of us are in the middle and so how do we have that
while still saying you know what if you don't do the basics if you don't do
accepted practices we're going to ask why and sometimes we're going to ask why
with teeth and so that's one of the other tensions that we need to resolve
okay so I feel like we're talking solutions already and we have we need to
rewind a little bit why are we all sat here like what what is it about software
resiliency that is a problem and why are we thinking about these solutions are
there any I'm happy for you to give examples or or specific sort of things
that you think are of concern so Camille's got the mic
yeah so much like what Charlie talked about we embarked on a journey in 2022 to
really understand the especially the open source software ecosystem but the
software ecosystem as a whole and see how the federal government should support the
evolution towards a more secure environment more secure software and we establish something on
the open source software security initiative that convenes partners like SZA that includes
DARPA and OMB
and a number of other partners throughout the federal government to really think about what
is the work that we're already doing where does the ecosystem need support and what are the
opportunities for us in the future to add to the evolution that we're talking about
we went to London and we launched that initiative after we had done this in-depth analysis and some
of the things that we found were that you know in addition to malign actors trying to leverage
software
software vulnerabilities to wage attacks right whether that is state actors or not
there were some opportunities right the opacity of the incentives for developers to incorporate
security into their development life cycle it it's not there right the transparency that Ellen
was talking about it is hard to incentivize that behavior particularly in the open source context
we need transparency better transparency into the code that's in our environments of every
organization whether that is a government or a private sector organization we saw that in spades
and log for Shell right there were a number of organizations that the biggest part of their
challenge was just figuring out what's in their code base and folks were scrambling to figure out
now what was it not only what the things that they had incorporated themselves but what their vendors
had incorporated such that they needed to remediate that that's a problem that that's
you know part of what Allen is trying to solve with s-bombs but something we all need to be
thinking about like how do we marry that up with the security vulnerabilities we need better data
and better connectivity between something like an s-bombs and the security vulnerabilities that
present themselves and how do we automate that and leverage that in a way that makes it actionable
and easy to implement quickly and then another thing that we really focused on especially in the
open source context but in general is memory safe languages
how do we advance transitioning from memory unsafe languages to memory safe languages
that is a huge opportunity for all of our governments to play a role in the evolution
of the ecosystem if we migrate large code bases from memory unsafe languages to memory safe
languages we remediate up to 70 percent of security vulnerabilities that is not the only solution but
that is a solution that we can advance in a very meaningful way so how do we do that how do we
be creative about the tools that we leverage to advance that is it cyber insurance is it the
liability structures that we're talking about is it some other incentive structure that encourages
this evolution and change in the market and environment so a lot of our work has been
collaborating with our international partners leveraging the insights they gain from some of
their engagement with industry and our engagement with industry like we have
a UI that we released this week on open source software security I hope all of you reply to it
we have one on regulatory harmonization that data that collaboration with our partners is
really key towards us better understanding the space and being able to advance not only things
like funding and leveraging the per the federal purse to advance Behavior but what are the other
ways that we can be supporting the ecosystem to drive software security and software resilience
I'm going to try and not be too repetitive and I take it as a good sign that a lot of the issues
we've identified are also the ones that have been identified by the White House I think so in our
call for views we set out a sort of full risk framework looking at risks in software development
looking at sort of barriers to security and open source software risks around the distribution of
software and sort of software resellers and the unique challenges around that and also around sort
of customer organizations who sort of you know buying a new software um and somewhat unhelpfully
I'd say that the views we've heard is that all of those areas are important and need to be addressed
which is true um but I think in terms of sort of key threats at its core insecurely developed
software is still the most important thing and it's still the thing that we've heard from all
of the people we've spoken to uh that's the thing they're most concerned about and that actually a
lot of the organizations we spoke to through this call for views
um said that it was if not one of the most actually the most uh significant threats to
their organization's resilience uh you know it was either software that has accidentally introduced
vulnerabilities or intentionally introduced vulnerabilities so you know there are a lot of
different threats here but uh to some extent that the most fundamental one remains the the key issue
right um but we did also hear a lot of uh a lot of the same things that uh Camille was talking about
I think memory unsafe language came up a lot um as did the use of secure development environments
uh but at its core the the issue that I think a lot of people identified was uh as you were saying
that the market incentives just aren't there to prioritize secure development um and and
while this is a challenge for software vendors the actual the core problem is also that customers
and the organizations who buy this software fundamentally only care about two things it's you
know the product and how cheap is it um and security is often a second thought right and and if securely
developing your software isn't a thing that allows you to differentiate your product in the market
then it's it's not going to be something which companies are investing huge amounts of money
so I think it's a really massive challenge um and yeah I mean we'll get on to we'll get on to
solutions but I think you know we do need to think more about how the government can influence that
and try and address that that uh sort of that market failure so I just want to break that
down a little bit so um so what you're saying is about insecurely developed software but also
obviously the languages uh you know we we don't you know there's a lack of type safety and and
memory safety issues but we've started to see the languages come through but um surely there's an
education question for developers as well so most of us who've done software engineering degrees
um know that there's no mandatory security modules in and most of the software engineers that I work
with don't have a lot of security modules so I think it's important to think about that as well
I don't have a clue about secure development even though there's plenty of secure coding books out
there I'm one of my students I I showed him there was a so does anybody remember a stage fright the
vulnerability on Android 2015. and then I was I was looking for this secure coding book and it
said it was written in 2003 I think so stage fright was a integer overflow issue and it said
um you know here's how you solve integer overflow books and then it said by 2009
integer overflow books should be a thing of the past and over 2015. but um you know so how does
education and fit into this can I can I quickly jump in again um so I think this is a really
important thing and you know when when preparing for this talk I was thinking about both sort of
short-term things that the government can really do to quickly address this but also I think one of
the government's role is to really do that long-term investment piece right and um yeah as
you were saying I think a lot of the stakeholders we spoke to said
isn't this a core part of all software development courses and I think the UK is is making some inroads
at trying to change that so the um the National Cyber Security Center has a specific certification
regime for University degrees that uh include sort of core cyber essentials uh in in the
software development courses for both undergraduate and postgraduate um and also the the UK's Cyber
Security Council is working on the the sort of formal and structural professionalization of the
action which I think will really help but I think actually that long-term view is one of the most
important roles that government has uh because it will obviously take a long time for all those
people who are being trained to to make a difference in the in the actual market right
it takes a while for those skills to get through the system but um that doesn't mean that we
shouldn't be doing it I I think there probably is more that governments can do to make sure that
that security is uh almost sort of it's not an article right and that it's it's there from the
start I think I think we've already done some good stuff in the UK and I'm I'm hoping we'll be able
to expand that further I'm so glad you brought that up on Monday we released last Monday the
National Cyber Workforce and Education strategy that addresses exactly this to your point yes the
government has a large role in driving towards educating developers or anyone about cyber
security and cyber in general and our strategy really wants to start at the beginning
and really wants to make sure that every person is equipped with some foundational cyber skills
that we can then build upon because we recognize that having skills-based hiring skills-based
training is going to be essential to doing exactly this right if when you became a developer you
didn't have security as part of your curriculum that should not mean that part of your
professional Evolution does not include training that focuses on security your skill set should
evolve with the
ecosystem and the things that we now recognize that we need and so we need to build an education
and training apparatus and a broader ecosystem that supports you on that professional journey
it is a it is a project for everyone though right we should not only look to our governments to drive
this but private sector community organizations all of us need to band together to really think
about what those pieces and parts are that said on the other side one of the things we talk about
in the National Cyber Security Strategy is that we should
be shifting the burden from the small players to the big players so in that education journey we
should be thinking about how we put more of the onus on the tools that developers use to build
security into the the cycle the life cycle the frameworks the tools that they use to develop code
and implement it into a code base as another Avenue for Advancing security outcomes so we
need to pair these things up but I encourage you to read that strategy because it talks
a lot the workforce strategy because it talks a lot about partnering with universities and
employers to better understand their needs and to drive education outcomes it talks about
accreditation bodies it is not an easy thing to change curriculum at any level whether it's K
through 12 or at the University level and so that is a long-term investment that we must make now
if we want to see the dividends paid out from that but we also as organizations whose demand
of and prepare our staff for those things I mean if we are going to do the things that we talked
about in terms of secure by design and driving towards a more secure ecosystem then that means
we have to equip the people to support that work and so recognizing that every profession
that works in the technology space which is why the the strategy is focused on cyber not
cyber security requires you to have some measure of security skills is something we articulate
very clearly in the strategy because
quite frankly our engineers our developers they should all understand what security is and how it
can be built into the things that they make while we still have cyber security practitioners who can
focus on endpoint security and some of the other things so since since they've got the important
high level views I will say that I know some developers I've been friends with a few of them
I'm
not I'm not going to say that they're not smart but I'm also not going to say that they're paying
attention they have to pay every two months there's a new framework every three months
there's a new platform they're busy trying to keep up with Tech and we've tried the next
generation definitely needs to be included but one of the things we're going to be doing is one
how do we make it so that they don't have to think about security this is the famous shift left
model this is the famous uh the second DevSecOps is what are the tools that we can bring into the
process so that you can't commit code that goes pulls from something that's known bad uh that your
repo that you're pulling from is actually maintained by the security team as well as the dev team
and so there are things that we can do today as we move towards this and then again also shifting to
better ecosystems you can't do a buffer overflow and go Lang actually it's not true I saw someone
try to figure out how but it was really hard like it was a very smart person to figure out so
um and that gets back to the model of what are we what are we trying to do with the
round threats and there are a couple things one of them is just known badness
and Rick Camille's talked a lot about vulnerabilities uh and we know that world
and it's not just the the public ecosystems it's not just the CDs they're private feeds but there
are other types of known madness so uh resilience is this huge issue in open source uh last
Christmas there was a great blog post by a French open source developer not in the security field
and the title of the blog post was I am not your supply chain
uh because
from his perspective he provides software as is any other problems you have are your problems
now that's not true for when the U.S government buys software it's our problem and it's our
supplier's problem and so that's the fun tension of thinking about that resilience what do we do
about I hate the term bus problem called the ukulele problem most people don't know that it's
a lot more fun to learn to play the ukulele
than it is to maintain open source software uh and so we need to make sure that projects won't
go away if someone decides to do something a lot more fun and then one more thing that I
also want to put on the table that's sort of in the known badness capability it's a little more
subtle is tech debt um right we have got to find a way of wrestling this and this is one of those
key for resilience models where if you're about to buy a product or
buying to uh an architecture what's that going to cost you what's your total cost of ownership
because if you're if what you're buying is already outdated uh then you're going to have some real
problems down the road and for not even a security issue this is a dollar and cents issue someone's
going to pay for it and who is going to end up pairing that cost yeah so this is what was springing
to mind as I was listening to this so as a
software developer myself and I think there was a recent tweet that we all saw about um this demand
that had come down to this open source library developer saying you know there's a serious
vulnerability in your in your library you need to fix it now within the next 48 hours
and this guy I think quite rightly pointed out he said like I recognize the severity of this issue
I'm not like saying that's that's not an issue he said but like I don't get paid for this
and you're like this big tech company and
this stuff for free and I think this has been a perennial problem for anyone involved in open
sources is basically these companies are essentially abusing open source half of
them are contributing anything back some of them aren't declaring they're using it
and they're you know it's the xkcd picture with Dave at the bottom right maintaining
this vitally critical library like you know what what do we do to compensate open source developers
or prevent big tech companies essentially creating their own Forks and maintaining and then sinking
it whenever they like how do we deal with that problem I think those are the points about
building things into the tools that make it easier for developers to you know incorporate
security from the beginning and also the liability structure I know that you know building out a
liability structure will be complex it will be tough and what we are trying to do is make sure
developers and companies to understand the implications of what we are trying to build
but if liability falls on organizations not on developers it can start to incentivize an
ecosystem where they're not abusing developers where developers are feeding into something that
doesn't disincentivize them from participating and from creating these things it is a feeding
ecosystem apparatus right this this should help with those market shifts I mean it won't be the
thing that drives that but I do think software liability will need to be a tool in our toolkit
if we are going to drive towards remediating that kind of abuse of developers and driving towards
the security outcomes that we want to see so on top of that actually I just want to add to this so
one of the other problems that we have with open source the sort of Paradox which is well open
source is available to everyone at peer review but as we all know the only
people who appear reviewing the security bits are usually the people who want to break it and
attack it um is there is there any way that we can can solve uh that issue in the future or is that
is that really part and parcel of of what you're putting forward in terms of shifting the market so
that the companies take responsibility for the open source they're using and essentially pay
these people is that right yeah I think so I mean I think what we need is a structure that makes it
clear who's accountable and then that will drive where we see that review happening right if it's
not the developers and it's the organization then they'll do the peer review to make sure that the
code is sound before they put it into their code base they will keep an eye on it they'll maintain
it they'll know what vulnerabilities they're introducing into their environment if we don't
then there's no incentive on either end to do anything about that and we continue to hope that
developers
will maintain their code that they created out of the goodness of their heart or to assume that
companies especially the smaller ones not necessarily the bigger ones they might have the
infrastructure and the staffing to be able to review code line by line but these smaller
organizations that are trusting that this thing that they grabbed or have no idea that some
developer that they hired to help them build out a thing um is using open source code they don't
have the infrastructure and the support to be able to do that so I think that's a really important
example to to do that peer review so how do we build out an environment that really helps you know
where the accountability lies and then you'll build in the infrastructure to be able to use that
so there are some built-in advantages to the ecosystem as well so there are a couple dozen
startups out there that just say oh well how are we going to test our tool and show that it scales
we will just run our tool against all the source on GitHub and identify and propose things and
measure them so that's
one piece where there are some structural advantages that we can start to do and there
are innovators that are starting to engage in this one of the challenges we're working on
collectively with this and the White House is you'd be surprised everyone thinks the government
has a lot of money and they're not wrong but it turns out it's surprisingly hard for us to spend
it in new ways and so that's some of the work we're doing uh so that's one piece two is figuring out
where to prioritize so there's a
great research by old friend of mine Frank Nagel up at Harvard Business uh that has sort of said
well what are the most used open source libraries uh but like a lot of research that data came from
the data that we had which was modern applications so we found out right hey this
is what's used in modern apps CISA cares about really fun web applications we do but
new priority is saving lives it's the fundamental risks that affect all of society and so one of our
projects that I'm really excited about that believe it or not CISA has an offer DHS is an
office of the chief economist so our economists are partnering with our vulnerability experts to
figure out uh what are the most important pieces of open source software for critical infrastructure
uh measured quite broadly and so that's going
to allow us to sort of say this is where we should be focusing I also want to flag one thing I feel
in security we don't often give ourselves a little pat on the back so I want to acknowledge something
that we've learned to do one of the first things I tackled when I joined government uh back in 2014
or something like that was look at vulnerability disclosure and those of you who've been DEF CON for
a while excuse me
those of you who've been coming from DEF CON for a while remember it was not that long ago when that
was a controversial topic that was fighting words right remember no free bugs um and this is now a
solved problem our friends in the UK have openly embraced it our friends in the Netherlands have
been way ahead of the United States on embracing the role of um governments from around the world
in different parts of the U.S government are all coming to DEF CON
why because we want to embrace the security research community so in the open sort that that
is sort of one of those fundamental pieces of resilience that I think we've got solved even
the most vicious corporate lawyers have at least been yelled at by their PR team say if
you sue this hacker it will go poorly for us even if we're right uh it will not go well for
us we'll lose in the court of public opinion and so that's one of those areas where we can sort of
build on that success and and I think we should acknowledge that that's progress that's been made
um yeah sorry I mean I'll try to add too much I mean I think we did look specifically at the
barriers of of uh uh open source uh the open source community to sort of high levels of
security as a part of our call for views and I think uh obviously there's sort of the first
thing that comes up when you speak to people about it is essentially funding right and we
need more funding and and I think actually uh you know one of the things we really wanted
to investigate was the government's uh as an actual player in the open source system right a
developer that uses uh open source code but also uh you know someone who buys code which is based
on open source components and I think that's definitely something that we're thinking about
moving moving forward right how do we lead by example as a responsible player ourselves in the
open source ecosystem and I think that's really important um I said the only thing I have I have
I think we have made loads of progress
on the back but I was actually quite surprised during our call for views how many people how
many security researchers we have still heard contacting companies with vulnerabilities and
being either ignored or threatened with legal action you know I mean I think I think we have
made loads of progress but one of the things from the UK perspective we're really keen on doing is
is understanding what really needs to be completely consistent practice here and I think vulnerability
disclosure is one of them and you know we're not at 100 yet I don't think we necessarily
will be but um uh it's definitely something that we're we want to continue raising the standard on
uh because you know security researchers play an absolutely essential role not only in in building
that evidence-based but also in actually holding these companies to account uh and I think that's
something that we really need to defend and and to respect I just want to double down on the point
about looking at governments and interrogating our use that is a big part of the work that we're
doing because it's really important for us as players in the space and as some of the largest users of
open source software and software in general to use our purchasing power to drive the market that
is one of those market tools that I was talking about and demanding of our supply chain that they
think about these issues is a really important first step towards shifting the market and towards
understanding the problem better I mean you'll see that in you know 14028 we talked about
s-bombs and at asking of our suppliers to think about how they will leverage s-bombs and what we
in in helping us map out how we make sure that's a part of our procurement process right and thinking
about how we are leveraging our purchasing power to drive the market so I just really wanted to
underscore that that that federal piece is a big big piece and we should be leading by example and
that interrogation of our opportunities to advance this work are really important so not only our
purchasing power
but how can we spend grant money how can we wrap this as a requirement into grants that we are
already giving on relevant topics things like that are ways that we are also looking at shifting the
market okay and I mean I've also noticed as a developer you know where things are shifting
forward on parallel front so you um you know where you're putting stuff on GitHub you can
scan that code to see whether there's you've introduced a vulnerability um also Google for
example have done some good things with their ides to make sure that you know for example you don't
have an HTTP only connection that that's a dangerous function or you're not using SMS it
costs that's a dangerous function so it kind of steers developers on the onto the right track but
of course we you know Alan alluded to the fact that we have so much um Legacy out there an existing
technical and security debt um and so for all those factories that have got embedded systems and and
uh globally because you know we you know relatively we're British and American so we live in rich
countries but most of the world isn't rich and um you know for those we can't just rip and replace
all of that equipment it's going to be out there for a long time I was talking to somebody earlier
about 6G you know so when 6G deployed suddenly you know after 2035 we're suddenly on the Apocalypse
2038 there will be kit out there in 2038 that's going to be victim to that so what do we do about
the the
Legacy
so Camille of course has another strategy that she's going to talk about but um there are some
things that we can do at the technical level as well so one of the things that we're going to be
rolling out over the next year or so is uh I'll talk about two initiatives I'm really excited about
at CISA um one of them we're still trying to figure out the appropriate name for it I'm I'm
notoriously bad at naming things uh vex is my fault
um but tentatively called software observable Behavior Analytics which is I can't change the
software in a thing but what I can do is watch that software uh and it's weird just as for me
it's bananas that people sell software without knowing what's in their own software we also want
to extend that to what's it going to do on my network is this ever going to use UDP uh what's
the maximum size of a DNS lookup that it's going to make um what's the port serving and that will
allow us to take something that is currently a little expensive which is manually locked down
a network and enable better and more intelligent and easier to use software that I can just put on
my network and say deny everything that doesn't fit into this box and we should be asking the
question why would you sell me something if you can't tell me what it's going to do on my network
so that's one piece uh tentatively called soba because right now everyone names all their security
projects after food so why should it just be tech specs food um the second piece uh that that we're
sort of looking at gets a little bit to this which is and it still follows the model that transparency
is the first step that we can innovate on top of is there really isn't a good way of understanding
life or end of support and so uh the White House issued uh the National Cyber Strategy implementation
plan and one of the things they've asked sissa to do is to come up with a solution for helping
people who make software people buy software and people who operate software and that's I
think all of us uh to understand what is end of life what is in its court does it have the solution
to do now no but at least it helps us prioritize that and so that's something that we're starting
to roll out uh there's a great technical working group that will purchase video and my team member
Justin back there is going to be doing all the technical standards work uh for uh this as an
Oasis standard so there's lots of things that we can do without rip and replace to make some progress
um yeah I mean very quickly I think going back to open source right I mean one of the one of the
other useful things about open source is that it's largely free um and I think uh uh that's
something that we always want to support and uh and from a security standpoint should also make
sure that as much as possible we're making uh you know making solutions to some of these problems
available to everyone around the world you know I think obviously there's uh there are problems in
terms of global access to Tech that extend far past software you know I mean there are lots of
cars which are heavily polluting in countries
uh around the world which are not legally allowed to buy in the EU and so they get shipped elsewhere
I think there are obviously structural problems there right um and and some of that it needs to
be dealt with at the multilateral level um but obviously some of it can be helped with funding
but uh you know in terms of the global software community uh open source is obviously going to be
key to that as well so I'll just add that in partnership with State Department USAID and
recently Peace Corps we were really thinking about how we bring our partners on along for the
journey right there are a set of partners like the ones represented here who are working in lockstep
about advancing this forward and are really thinking proactively and have the resources as
you mentioned to invest in this problem space there are other partners who can benefit from
our lessons learned and the best practices that we have developed to implement things
like monitoring and other tools if they cannot invest in upgrading their
technology right now to help mitigate the risks that are in front of them and so we are doing a
lot of work to reach out to partners across a number of different regions for example we were talking
earlier about the workforce challenge and as part of releasing that strategy we recognize
that the implementation is very little bit federal government and a lot of it everybody
else to be Frank so how do we coalesce and convene everybody around that
and one of the ways that we have done that is that a lot of our partners have already stood up to
say like I'm ready to implement this work I see how important this is one such organization is
Cyber Safe Foundation based out of Nigeria but is working in seven plus countries across Africa
and they are going to translate the ecosystem model that we've articulated for the continent
of Africa so that that can be a tool to help developers to help cyber talent as they emerge
and as they continue to reskill and upskill be able to do exactly this be
able to address the threats as they manifest themselves in that ecosystem and relevant to
that ecosystem so it might not be that we can just upgrade all the technology but how else can they
leverage the resources at their disposal and the the skills at their disposal to mitigate the risks
in front of them okay um I feel like there's a number of directions we could take this conversation
and I was just about to ask some questions about post quantum but um if so but focusing on the
I mean obviously we there are strategies we can take that are not just about written replace we
can maybe contain things that we know are you know sketchy and maybe monitor them more closely or
validate the input more closely or whatever but just concentrate on the end of life question here
um so there's all this debate around right to repair and code escrow and we see you know my
special is really IOT and you see lots of these IOT companies that were around
2015 next big thing now going bust and people are going hang on I've got all this stuff in my house
but you know what do you mean I can't use it after 12 months so when that becomes a bit more critical
but some of that's critical right some of it's maybe life-affected what do we do in that space
around resilience is that is there a clear answer is there a strategy from from governments on that
or is it something that's in the
too hard box right now that we need to look at later?
I don't know that it's all the way in the too hard box,
but it's in the process.
I think there are a couple initiatives
that seek to address things like that.
The IoT Labeling Initiative,
which is an international initiative,
is seeking to make clearer to users
what security features their devices have,
what end of life looks like, that kind of thing.
I think that's more of an awareness tool
than it is going to be a solution to the problem,
quite frankly, right?
Because any logo on a box is going to be outdated
and the validity of that information changes rapidly,
but if we can train folks to actually go beyond the logo
and read the data embedded underneath, right,
that'll be included with that,
they'll learn a lot about the devices
that are in their homes.
They're probably gonna do that on the front end.
Will they continue to do that?
Maybe not.
So that can't be the only solution,
but it gets people starting to think about
the security of the devices in their home.
And as people start to realize and see in real time
how that can impact the safety for them and their families,
that'll be an important tool in our toolkit.
The other thing I talked about in the workforce strategy
is foundational cyber skills for everyone, right?
And if we posit that reading, writing, and arithmetic
are the traditional tools in everyone's toolkit
to be a functioning member of society,
to help you advance and thrive,
we say that foundational cyber skills need to be a part
of what you get to, that everyone should have them, right?
And that's not just digital literacy,
which is the ability to use the device, turn it off and on,
but that's computational literacy,
the ability to understand that when you turn on
and off a toggle, what does that mean
in terms of your security and privacy?
How does it change the usability?
What does that mean for your family?
And then digital resilience,
the ability to adapt to a changing technological environment
so that there's new features, new risks
that you are able to keep up.
Not make you a cybersecurity expert,
but just as you, um,
assess the risks of your physical security,
I want you to assess the risks
of your digital safety and security, right?
So you might, Charlie, you might walk down the alley
because you know karate and are willing to take that risk.
Come on, bring it on, right?
For me, I don't know karate.
I will not be walking down the alley.
I will be walking down the well road, right?
I've done, I've made a risk calculus of decision
based on who I am, what skills I have,
and what I know about the environment.
I want people to do that in their digital lives as well.
And so that's what those foundational cyber skills
will equip people to do.
So those are tool tools that we are using
to help with problems like that,
but those, they're not gonna be the end all, be all,
and they also aren't a solution that manifests
an outcome that we'd like to see today, right?
Yes, I completely agree.
I don't know karate.
But, and I definitely, yeah,
probably be running rather than anything else.
Yeah, so the UK is taking a very similar approach.
We have a cyber aware campaign.
But also we do sort of lots of training in schools
and partnership with private organizations
to try and generally make sure that,
particularly sort of through the educational process,
people are, cyber awareness and security
is now being taught in schools from a foundational level.
And I think that's great.
Regarding the sort of end of life question,
I think, so the UK earlier this year,
the Product Security and Telecommunications
Infrastructure Act, PSTI Act came,
well, it entered royal assent,
but we won't get back into the full question
of what that means in the British parliament.
No, no, let's reopen the constitution today.
If you guys do want to hear about that,
we talked about it at a reasonable length
at B-Sides a couple of days ago,
so I can send you the link.
We got through quite a few names of monarchs,
actually, didn't we?
Yeah, yeah, we did.
Anyway, so it received royal assent in April this year,
and it will be coming into force in April next year.
And one of the three core requirements
that that has for IoT, consumer IoT manufacturers,
is that they have to communicate
the lifespan of the product to consumers.
They have to give an indication
of how long it will receive updates for,
and when it will be sort of closed down,
which I think is a real success,
and something that we are interested in looking at
in other circumstances.
I don't think we're at the space
where we're considering legislative options yet,
but I don't see why that shouldn't also be a consideration
for software more widely, if it's something
that consumers or organizations are reliant on.
But I think that doesn't solve all the issues.
A company can tell you that they'll update the product
for 10 years, but if they then go bust the next year,
that doesn't necessarily help.
And I think that that is a real problem,
which we are, I think, still trying to grapple with.
So I'm sure that in the B2B case,
a lot of companies already require code escrow
because they're worried about partners going bust,
and stuff, but it's the B2C space that helps them.
It's that customer space where they're left high and dry.
David, I'll ask you a question on code escrow,
because I had a great conversation about this over lunch.
So code escrow, for those of you who don't know,
is before I sign a major contract,
I won't demand your source code,
because you're reluctant to do that,
but you need to put it in a vault,
so if you go bust, I can access it.
But here's my question, which is,
anyone who's ever looked at someone else's code,
just a couple of jokes,
is there a successful case study anywhere?
I don't know the answer,
but I think it's a great research question for anyone.
To find successful examples of code escrow
actually leading to sustained maintenance.
There is one, actually.
There was an IoT product that I think Sony took on,
but it was the original developer.
When Sony dumped the product,
it was the original developer who stepped back in.
So I think that's maybe a little biased issue there.
I thought you were going to ask me a different question.
I thought you were going to say,
cryptographic keys and certificates.
Oh, no, I'm not touching.
The tension between right to repair versus signed updates.
Yeah, but not even just signed updates.
I'm talking about, like,
the thing just won't compile and it won't run.
And the services aren't there
to be able to make this thing live again.
And nobody's looking at this problem.
At least, you know, as an IoT person.
And I'll be honest, in the code of practice,
the UK code of practice of IoT,
you know, we did put that in the too hard box
because there were fundamental issues,
like no default passwords.
But it's, I mean, does anyone in the audience
have a solution to this?
They suddenly all woke up.
I'm on my phone, I'm on Twitter.
So I want to sort of share two,
because, again, when a problem is too hard to solve
at one level, you sort of look around
for what are my other levers.
And to make this international,
I don't speak for our friends
at the Ministry of Information and Communication in Japan,
but I do want to highlight something that they did
and one of the surprising findings.
So four years ago,
and this is why I love,
and the importance of giving a global view, by the way,
is there are innovators everywhere on the planet.
And so that's where we should all be learning from each other.
That ministry obtained the ability
to scan the Japanese domestic IP space
for home e-drilling users.
And they were looking.
Their plan was we'll find all these vulnerability devices
and we'll have a way of notifying them through their ISP
so it won't be the government coming.
That's not what they say, but yeah, that's what we said.
It won't be the government coming
and, like, interfering with them.
But the surprising result,
which was obvious in retrospect,
is they found very, very few vulnerable devices.
Now, Japan's a pretty connected country.
Why was this?
And it's because we've accidentally built
a really powerful and almost flawless firewall
for every internet user in certain areas.
Anyone know what it is?
It's an app.
It's an app, yes.
It's a network address translation.
Like, we failed at the IPv6 translation.
We're still using IPv4.
So now everyone sits behind a data diode
for the safety-critical stuff,
for medical devices, for the world.
That's where we actually need to say,
once you're on the internet,
this is why Mirai affected security cameras,
is because those were connected directly to the internet.
And so one of the things we need to do
is look at our large-scale protection systems,
our, you know, the SASEs and the WAN firewalls
and things like that,
and say, how do we know that they're doing their job?
Because, hey, guess what?
Over the last couple of years,
there's been a lot of very high-profile vulnerabilities around that.
So let's look at the network level
and the appliance level
as an alternative model for this.
So, okay.
So then, resilience further up the supply chain,
and, I guess,
accountability is then the next question.
So, you know,
we don't have a global model for this,
and a lot of those suppliers of those products
are in, say, China, for example,
or other parts of the world
where we don't have any real jurisdiction.
We can deal with maybe the importation,
but how do we ensure accountability
in a...
to create resilience?
Does anybody have a view on that?
I can go first if you want.
Simple question.
I think there are lots of different
aspects of accountability,
and one of the things we've really been looking at
in the UK is
mechanisms for accountability
that are actually already there,
but just might not be being used enough.
So, actually, one of the key ways
in which suppliers of software
can be held to account
is by their customers,
through the contract.
But a key challenge there is that,
one, you have...
when we're looking at organisational resilience
in the United Kingdom,
the significant majority of organisations
are small and medium-sized businesses,
often who don't have
a dedicated security person at all,
let alone serious resource to actually
dedicate to really looking into this.
Often the people who are actually
making these decisions and agreeing to contracts
are procurement professionals,
and for them,
cyber risk is one of a great number of risks
which they need to take into consideration.
So the question really is,
how do you empower those businesses
to actually hold these companies to account
in a way that is contractually viable,
as it were?
So one of the things that we've been looking at
is whether you can develop
actually sort of standardised clauses
which any company could essentially take
and put into their contract,
which would at least set a baseline standard
of security expectations in any relationship.
But I think that there are key challenges here
in terms of just the basic ability
of procurement professionals and small businesses
to interpret and understand the challenges.
Even small businesses are often using
more than 100 different kinds of software
a lot of the time,
and that is a real challenge.
So I think we do also need to think about
how we can upscale small businesses
as government,
whether through funding or programmes
or otherwise,
in a way that actually lets them hold
software vendors and software developers
to account through the contract.
But I do think that there is a sort of
another aspect here
which goes back to transparency, right?
So even if you have a company
which has the skills and has the resources
and has the expertise
to ask the right questions
of their software vendors,
quite a lot of the time
they're just meeting a brick wall.
You know?
They're not being given the information they need.
And we have heard that,
you know, particularly with the larger vendors,
things have been getting better
in the last few years
and they've been a bit more open
about their security practices
and how they securely develop their software.
But I think there is clearly a long way to go,
particularly with sort of smaller
and medium-sized software vendors.
So I think there's a big question
about how you empower people
to hold companies accountable,
but the transparency question is also key.
And I think you do need
both the accountability and the transparency
if we're really going to raise the standards
of software security across the board.
I think where you leave off
is where the government needs to pick up.
And one of the things that,
you know, I mentioned
about the national cybersecurity strategy
is we're trying to shift the burden
from the small players to the big players.
It should be that our cloud service providers,
it should be that our large software vendors
are held to account
to make sure that code is secure,
to make sure technology and hardware is secure.
And they should be thinking about
how all of those things come together.
And so a lot of the work that we're doing
is kind of picking up where that leaves off
and driving towards
how do we hold those big players accountable?
Some of that is by starting with our own infrastructure
and the things that we procure,
but also that's where those liability frameworks
and some of those other things come into play
is holding them to account
and engaging them in this process.
That ongoing conversation has been a big part
of shifting some of these bigger players
to act in the manner that we have wanted them to act
and wanted them to.
So we engaged very directly with a number of companies
on the open source software question,
particularly around memory unsafe languages.
And recently you probably saw that Microsoft announced
that over the next 10 years or so
they'll be migrating their code base
from C and C++, memory unsafe languages,
to Rust.
That's a huge win.
And that started just from engagement.
We didn't even have to get to the point
where we were building out liability frameworks
and that kind of thing.
So the shift that we've got
of engaging ecosystem partners
to be a part of the ideation and solutioning,
having these conversations,
especially with these bigger players,
is starting to drive and catalyze
the kind of action that we want to see.
The other venue I just want to highlight
is international standards bodies.
We really need to engage more
in international standards bodies
because that's where a lot of the frameworks
that folks are using start.
And that is where a lot
of our engineers and developers
are getting some measure of training, right?
Talking to their peers in these forums.
And organizations, small, medium, and large,
should be encouraging their security teams,
their technical teams,
to participate in standards bodies
to both share and to learn
as those standards evolve.
And so that's another opportunity
for us to evolve that.
Hi.
A question about international standards bodies.
Standards bodies like the W3C
have IPR policies where you have to covenant
not to invoke your IP
against people who implement standards.
What about comparable covenants
to say that if you are given a right
through standardization
such as an anti-circumvention right
or tortious interference right
that would allow you to silence a security researcher
who comes forward with a bona fide claim
of an effect on a product
covered under the standard?
That as a condition of membership,
the SDO can force vendors to covenant
non-aggression against security researchers
who make those disclosures.
I wonder if that's going to happen.
I was actually just thinking about W3C just then
because I was involved with W3C for a long time.
And I remember Thomas Rosler
who's there encouraging somebody
to come and help out
because this guy who worked
for a big security software company
highlighted all these issues of HTML5
and said, come and join us, come and help us
because we really need more security people.
And he went, I don't do standards.
So, you know, but on that bit about
the pulling those kind of rules in,
I think that would be really, really helpful.
And actually we're just trying to get to the point
where we're getting CVD for
specifically for standards.
So, for example, for 3GPP and NC,
they have CVD schemes in place now,
which is great.
And the one thing I'll say is
I like that idea.
We had a fun discussion about, you know,
hey, CVD is now a very common practice,
not universal skills and edge cases,
but we've made a lot of progress on it.
The one challenge for things like
widely implemented standards,
especially if it's a flaw in the standard itself,
is that multi-party CVD
is an increasingly common use case in CVD.
There's a very good guide
that came out of the Software Engineering Institute
and first.org
that we're working on,
but that's something where we want to help promote
the muscle memory of that.
And it's sometimes contentious.
So, for example, there was a couple of years ago,
we phrased this as neutrally as possible,
a couple of years ago,
there was a ship-based vulnerability
and the folks that found it
and the primary vendors
had to figure out who to have
inside the trust circle.
And they made some decisions
about some of their downstream customers
who were the ones shipping it,
but not certain governments.
And there was a lot of kerfuffle.
And I don't know if that's an area
where there is a single right answer or wrong answer,
but as we think about this,
and this goes to the bigger picture of resiliency,
the easy ones have been solved.
And so now we're dealing with these more complex issues
where we may have to make
situational-based judgments.
So, I think if I can zoom out a little bit from that
and talk about government's involvement
in international standards generally,
I do think...
Charlie, let's just finish up.
Okay, fine.
I do want to elaborate much more on standards,
but I think there's a really important point here,
isn't there,
about basically treating security research with respect
and fundamental issues of software resiliency
when it comes to the standards themselves.
So, there are lots of gaps.
Like, we probably both know
where a lot of bodies are buried in IETF and W3C,
not just in the building.
But, so, for example,
so you talk about multi-party disclosure.
So, we, in the mobile industry,
we wrote an industry-wide CVD scheme,
and I think it's the only industry that has one like that.
So, security researchers,
instead of having to go to each company individually,
they can come to the GSMA
where it's seen as an industry-wide issue.
And so what we've seen is that a lot of those
are actually standards-based vulnerabilities.
But what we've also done there is facilitated
because those...
vendors and the companies
often didn't have a clue
how to deal with security researchers.
So, half the time,
it was about creating that relationship
and saying, look, don't hammer this guy.
You know, this person's coming to you in good faith.
And I'll also say
that's where governments can play a role.
My wonderful colleague, Elizabeth Cardona,
went off to say something much more interesting than us,
but CISA has a team
as helping with coordinator as last resort
with a particular focus on safety-critical.
We run the IC...
It used to be called ICS, sir.
And we work very hard to focus on
how do we get things fixed as quickly as possible.
And I love David's...
which is like, say,
respecting the researcher
but also taking the view of
how are we actually protecting the humans?
Wait.
We can trail a CVD panel.
Okay.
CVD panel.
Look it up on the channel.
Okay.
So let's go back out.
Are we continuing on CVD
or are we going straight to science?
I was just going to make two quick comments.
One was in an effort to advance that as well,
NIST is doing a lot of work
to make sure that security researchers
are respected in international bodies.
But also, we kind of wanted to elevate
the collaboration and the visibility
on the importance of security researchers.
So we hosted our version of Hackers on the Hill,
Hackers at the White House,
and had a bunch of security researchers
come in, learn more about what we're doing,
so we can learn more about the challenges
that they're facing
in these international standards bodies
and others otherwise,
so we can start to ideate on how we solution that
and how we can advance rules
that will help support them in that environment.
Cool.
Okay.
So, Charlie, I cut you off,
but I cut you off for good reasons.
So, because standards is a favorite topic at the moment, right?
Everyone wants to be in standards.
Five years ago, no one would want to be involved in standards.
But, so, we have all of these standards bodies
around the world.
Charlie, what's the answer?
It's simple.
I mean, I think, you know,
the UK perspective is, unsurprisingly,
that these are global issues
and they need global solutions,
and I think standards bodies
play an absolutely essential role in that.
During our call for views,
one of the things we did consult on
was whether the UK should support
the development of new standards
around software development.
And I think, generally, the view we heard
was that the standards are largely out there.
The problem is that people aren't actually using them.
And there's that classic SKCD comic, again,
second time, there's a reference,
there's always a reference,
about there being 14 international standards
and someone says,
we need to create a new standard
that brings together all these standards.
And then the result is that there are 15 international standards.
And that's definitely something we want to avoid.
So, I mean, I think one of the real values of standards
is in encouraging that sort of consistent approach
that's sort of interoperable between different countries.
And any of the solutions
which we're potentially looking at from the UK perspective,
we would want to align, wherever possible,
with the appropriate international standards.
You know, which standards body you use
is another question, and it's a hard one.
But I think we're really keen to work with other governments,
with the US,
we've been working with the Singaporean government,
on this, and a few others.
But really, to identify which of those standards are key
for getting the fundamentals right in software development, right?
And secure development is the most important thing
that we need to get right.
And getting that international alignment
is going to be essential.
And I think standards are the main way of delivering that.
I'll just say that that work should be complemented
with the bilateral, multilateral engagement
that Charlie just highlighted, right?
Because there are so many standards bodies,
it can get confusing,
and you don't know where your partners are aligned
if you're not engaging with them directly
on their direction and the things that they have prioritised.
And so that's just been a really important complement
to that standards organisation.
And I think, sorry,
I guess the thing I did want to add to that
is that the role of governments, right,
is to add extra authority to those standards
by telling people, you need to look at this.
You know?
And that's really where that symbiotic relationship
properly comes into its own.
And so to tie things back to SBOM,
one of the things,
and again this is in the National Strategy Implementation Plan,
is to explicitly partner with our peer governments
around the world
to make sure that we're all on the same page.
Because the last thing that people want
is to say, alright,
here's the American solution
and here's the Japanese solution
and here's the European solution.
Yeah.
And then, but I also,
we have a national standard strategy
which embraces industry-led,
oh gosh, consensus-based,
there are a bunch of buzzwords in it.
But I do want to put a flag in there
which is, especially for the evolving security space,
we need to be careful of premature standardisation.
And even in the IETF,
which embraces rough consensus and running code,
guess what,
it's like two vendors that are driving it.
And not even two vendors,
it's like two very excited people
who are in a tiny corner of a vendor.
And so this is where we want to say,
let's show that it works,
show that it can scale,
and then make sure that everyone can weigh in
as we fine-tune it.
And so that's one of those areas that,
you know, nothing in security is ever easy.
Okay.
We're going to continue on standards in a minute.
I think we're going to have...
This question leads right into that a little bit.
Well, I was going to call it something that we can't call it.
But anyway, think of the standards of what you most hate
and then we can come back to that.
So, gentlemen,
I was going to say, gentlemen in the grey shirt.
Sure, sure.
So speaking of international standards,
you know, we have the RED coming,
we have EU harmonisation, right,
which also encompasses
the EU Cyber Security Act.
These dates are, like, imminent, right?
They're, like, within months for some of them.
I was wondering how you were following those policies
and how they should be adjusted.
Was this the Cyber Resilience Act, sorry?
Well, it's the EU Cyber Security Act.
Yes.
And then that feeds into the Harmonisation Act.
Of course.
And then also we have the RED out there,
which is even more...
So basically, we've got a ton of policies
that have come through from governments
in this overwhelming industry.
Correct.
And individuals who are having to deal with this,
and answer vendor questionnaires
and all sorts of stuff from Europe,
from America, wherever.
And what was the question?
How are digital organisations...
I do realise...
Well, so, from a UK perspective,
in terms of the burden,
so we, in 2021,
published a higher-level strategy
called the Plan for Digital Regulation,
and that set out
our overall plan
to make sure that,
while there are lots of new regulations
in cyber competition,
in online safety,
we need to be looking at the picture as a whole,
and we also need to make sure that,
especially because a lot of these regulations
are affecting the same companies,
that we're not creating unnecessary duplication,
that we're not making it overly burdensome.
And the international aspect of that
is absolutely key.
So in all of the policies we're looking at
in the UK,
that question of international alignment
or at least international operability
is absolutely at the centre of our thinking.
I think we don't want to create unnecessary red tape
despite the reputation that most bureaucrats have.
And at its core,
I think we share the same objectives
with a lot of the outcomes
that the EU is trying to get,
a lot of the outcomes
that people in the US are developing.
We are going to have to have
a lot of different ways that we get there,
but I think particularly from the UK perspective,
one of the things we really want to prioritise
is sort of outcomes-focused regulatory questions
and outcomes-focused processes
which allow vendors
and any other organisations involved
to take their own approach
to delivering these solutions.
And I think as much as possible,
that's what we're trying to do.
So international alignment, I think,
is a key part of that.
Yeah, as we develop
a lot of these standards
and our path forward, quite frankly,
we have made sure to not only include
our private sector,
but include our international partners
and to share the lessons learned
and best practices
in hopes of all of us
striving towards similar solutions and outcomes.
So, for example,
we just had the one-year anniversary
of the CHIPS Act.
You're seeing CHIPS Acts
pop up all around the world.
We have been in direct engagement
to share what we are learning
about the semiconductor space
with our partners.
That said,
I think the point that Charlie just made
is a really important one,
that we will have different pathways
for getting there.
We will choose different models
in hopes of reaching
the same or similar outcomes.
I'm not exactly sure
that any one person or government
can solve for that,
but that continued bilateral
and multilateral engagement
and our engagement in these broader bodies
has been the best path for us
to kind of share those best practices
and lessons learned
and our path forward.
But what tends to happen is
one government's going to move out on one thing
while we're focused on another thing,
and then someone gets ahead of someone else.
And I don't think we'll ever get past that.
But what we have been doing
and are very aware of
and talking to our partners about
how we then mitigate the pain
on the industry.
And so I think you've seen more
bodies designed to bring industry
into it so that they can,
even if it's throw out there like,
hey, I have this new obligation over here.
How do we marry these things up?
That's getting into the process.
And so I'm hoping the pain is reduced,
but I just want to be frank
that it will take time
because we will inevitably
in certain areas have different plans
for how to achieve the same outcome.
If I could just very quickly add,
I think this isn't just to be supportive of industry.
I mean, that is,
it's a strategically desirable outcome.
And I think that's the outcome for us as well.
You know, the more inconsistency
or duplication there is
in the regulatory environment,
whether domestically or internationally,
the more that companies can sort of,
to some extent,
just pick and choose which ones they want, right?
And regulatory arbitrage
is something we want to minimize.
That benefits us as well as you guys.
Yeah, really quick, I'll just say
we have a regulatory harmonization RFI out right now.
Please respond to it.
These are our opportunities
to advance a better understanding,
yes, for industry,
but more so for the entire ecosystem.
The one other point I'd make
in terms of progress that I've seen
inside my short tenure in the U.S. government
is we have chunks of governments
that their job is to work with other countries.
And for a while, they were pretty stoked.
Like, they were diplomats
and they were only at a very high level.
And increasingly,
they're now bringing in the technical experts
along with them.
So when we meet with our counterparts,
we actually have engineers in the room
or security experts in the room
who can say,
okay, that's great,
but here's a specific issue
that you're glossing over.
So that's where we're trying to make progress
in the process side.
And just to brag a little bit
about the U.K.'s IOT work,
and together with the U.S. as well,
I think the country
that worked together
to basically create defragmentation
of what good looks like in IOT standards,
I think does set a really good model
for how we can work in the future
because it is really the opposite
of that XKCD comic that you mentioned.
We actually did manage to achieve
a lot of harmonization.
But, sorry,
you've been waiting very patiently there
for a question.
No, it's perfectly fine.
But it's a question
in a completely different direction.
I hope it's okay.
Yeah, no, no, no.
We're happy to go in another direction.
Yeah.
NFT, is it?
No, no.
No NFTs.
No NFTs and no AI.
We're talking about resilience, right?
As I was talking about resilience
and covering from ICS
all the way down to SMB, right?
Now, the harsh reality
for most organizations
is that they are not going to,
they are being hit by open RDP.
They are being hit
by poor adoption of MSA.
They are being hit
by difficulties patching existing code.
I would love to hear your perspectives
on what can we do
to help these organizations.
This is not about
asking them to meet another standard.
This is not about
pointing them to,
as much as I love them,
memory-safe languages, right?
How are we helping
the proverbial dentist
that needs to fix RDP?
This is practical on the ground
stuff they can do.
Actually,
at B-Sides,
we talked about agritech
and I actually looked at
some British stuff
from the National Farmers Union,
which the NCSC had written.
And it was basically
generic advice about MFA
and stuff that's too technical,
I think, for any farmer that I know
that's a mate of mine.
And then I don't think it would achieve
the desired objective.
So I'm kind of interested as well
to see, you know,
what practical stuff can we do
to protect retailers
and small businesses now?
Yeah.
It's a really tough question.
I think part of it needs to be
industry-led solutions.
You know, I think we as government
need to be really encouraging
the industry to be creating new ways
to reduce the complexity
and to make it easier for organizations
to secure themselves.
You know, we,
as a part of our call for views,
consulted on whether the government
should even be looking into
trying to fund these industry tools
to create the market for ourselves.
Now that is,
I think we had mixed reviews on that
and I think we'll see where it goes.
But the point is that
technology can often really be
a helpful solution.
And, you know,
guidance is useful,
but people need to actually read it
and people need to use it.
And obviously,
as we talked about before,
these are often small businesses
operating on an absolute shoestring
and none of whom are cybersecurity experts.
I think part of this does go back
to what Camille was talking about before
and about the shifting of responsibility
to companies who can actually
have that resource
but also have the more centralized control.
You know, I think in the UK,
we really agree with the point made
in the US cyber strategy
that we need to be giving responsibility
to the people who are best placed
in the whole ecosystem
to actually deal with the problems.
You know, immediate solutions are hard
and I don't think we're going to solve them overnight.
But I do think if we,
you know, the more we can move control
over that in terms of maintenance and use
to the companies who actually,
you know, develop and maintain the software,
the better it'll be.
But, you know,
obviously there are cyber challenges
which are even outside of that, right?
You can have the most secure software ecosystem
in the world,
but still in the UK,
the majority of cyber attacks are,
you know,
phishing and simple things.
You can't solve all of that,
but I think a big part of it is training
and a big part of it needs to be
empowering organizations
to actually know what they need to do
and to take those basic steps.
So what does CISA have in common
with 90s metal fans in the lockpick village?
We love tools.
And, right,
so we can,
we have some lessons.
We can look at the past
where things that used to be very advanced
and had to be described
in sort of very fluffy,
not actual guidance,
threat intelligence,
static analysis.
And you remember what static analysis
used to be like 10 years ago?
Here's a giant list of things
that are completely irrelevant to your product.
And now we've had the tools
and the entire marketplace
has now shifted to
we will help you parse,
which ones are important.
So this isn't a perfect approach,
but we do have to acknowledge
that things start rarefied
and being used by very resourced organizations.
And then everyone looks to say,
well, yeah, I can make money selling to a bank,
but you know what would be even better?
Is selling to 10,000 medium-sized enterprises.
And so that's, you know,
understanding what's the policy part
and where's the engagement part
to actually help,
we'll use the term trickle down,
but actually helping these things
scale and integrate
and be part of what companies
are already spending money on.
Yeah, so to echo that,
that shifting of burden,
education and training,
all of those are some of the longer term solutions.
But more tactically,
one of the things that I found most frustrating
when I used to work at the
Department of Homeland Security
was how few people,
how few organizations
understood the resources
out of what was then MPPD
is now CISA
to support small and medium businesses,
and businesses of any size really,
but small and medium businesses.
There are educational materials there,
but also you could get actual support
to harden your networks,
to remediate a attack.
And that's something that we have been working
really hard to make sure
that organizations across the ecosystem
and the landscape know about.
And there are similar resources
in other countries
that really are there
to support the small and medium businesses
and all businesses.
But really the small and medium businesses
that don't have the infrastructure themselves
to be able to address
the attacks that they're seeing.
More tactically also,
I mean we have a small business
cybersecurity summit in October
through SBA.
They're doing a lot of work
to educate small businesses.
We are quite literally as a government
on a road show
to make sure that small and medium businesses
feel seen
and are just kind of tracking this issue in general
and know where their resources are.
We've been engaging philanthropy
in building out tools
that can be more widely available.
And so we're getting more creative
about how we engage
all the members of the ecosystem, right?
So we're convening philanthropy,
we're convening the nonprofit sector
who often provides a number of tools
for small organizations.
How do we make sure
that they're getting the support they need
from the large organizations
or have the tools that they need
to be able to make sound purchasing
and secure and defensible purchasing decisions
so that when they then build this other tool
that supports all of these small and medium organizations,
particularly in the nonprofit sector,
that they are buying something
that has already contemplated these issues.
You'll see in the National Cyber Workforce Strategy,
we talk about fractional hiring.
How do we share talent and resources
such that an organization
that cannot afford to have a cybersecurity resource
on staff all of the time
can have one fourth of their time
while this other organization
has one fourth or one eighth of their time
and making sure that somebody has access
to the information, to the skill sets
that they need to harden their systems?
And I'll just highlight those things,
but we're trying to get creative
with how we reach out.
There are so many small businesses
and this is not their type of priority, right?
If you are the mom and pop shop
who is just trying to service your neighborhood,
you're not thinking about this,
but there are a lot of great programs
coming out of academic institutions
where one of the ways they're training students
is to go to those stores
and help them implement multifactor authentication,
help them make sure they have
all the security settings turned on
in the programs that they've deployed
in their stores.
Those are great opportunities
for not only training and skill development
for the students and for the people
who will soon be in our workforce,
but it also supports small businesses.
So some of that ecosystem model
that we're building out
through the National Cyber Workforce
and Education Strategy
are designed to create an ecosystem
that feeds itself
and supports organizations like that,
small and medium businesses,
community organizations, etc.
So I guess, I mean,
on the practical stuff as well,
I have noticed,
you call it trickle-down,
I think maybe of a different term,
but I don't think it's trickle-down
because it's kind of like top-down direction
on secure by design
and product security measures being put in,
all products that are sold into enterprises
and that end up,
so I guess that's the trickle-down bit,
that end up in those small businesses.
But maybe there's this gap in time
when they can't afford to replace it
and that's obviously the money issue,
it's the who pays issue,
it's always the issue,
the same with rip and replace
in mobile networks, you know?
There's a lot of burden on industry
to create resilience
and a lot of burden on small businesses
and consumers.
that's going to be stretched
at the moment as well.
Gentleman here, please share.
Great, thank you.
And this may be outside the scope,
but if so, just feel free
to just gloss over it.
But since we're talking about resilience,
if we could,
I'd like to back up
like to the real 3,000-foot view.
Is anybody looking at,
we're technologists,
we like to have technological solutions,
we like to make our technology better,
we argue about different ways
we could do that.
But when it does fail,
is anybody looking at
or trying to recommend to companies
that they have backup plans
for when these things fail?
For resilience,
like literally,
like is there an analog solution
to this digital problem
that we used to have
and we used to know how to use?
Like did that report
where the billing system went down
or the employee records went down
and they didn't know
how to do paper records anymore.
They couldn't do that.
So is there any kind of non-technical,
do we actually suggest
non-technical resilience solutions?
So some companies have had that happen,
haven't they?
Where they had to go back to paper
and then realize that maybe
they should have done that exercise.
Yeah, absolutely.
I mean,
if you look at the national cybersecurity strategy,
it focuses on defensibility and resilience, right?
The inability to bounce back.
And you'll probably see this a lot
in the election space
where the guidance that's going out,
especially best practices,
are really focused on like,
should you focus on paper ballots?
Should there be a backup
where folks can vote through the machine
but there also is a printout
that they can verify their votes, right?
So yes,
there are definitely efforts
to focus on that resilience piece
because inevitably,
even systems that have been designed
with security in mind from the very beginning
and privacy in mind from the very beginning
will see an attack,
will be compromised, right?
And so when your defenses are down,
how do you get them back up?
But some of that is an analog solution.
So how do we think about all of those things?
And how do you have a plan for your organization
that includes the entire C-suite
that everyone is engaged and involved?
Those are the parts of the conversation that we're having
not only with the small and medium businesses,
but of course with the larger ones as well.
So I don't think I have a,
I'm not sure about specific rules
around having an analog solution,
but in the UK,
we have the network and information services regulations.
I think that's what they're called,
the NIS regulations they're normally known as.
And what that really is are rules
which focus on critical national infrastructure
and organizations which are foundational
to the operation of the UK.
And those regulations do have,
you know, a more strict set of rules
around how organizations,
which so includes all the major sort of CNI sectors,
but also digital service providers,
things like cloud computing,
we're looking to bring into scope very soon.
So that they have plans in place
in case of everything from small outages
to pretty catastrophic risks.
So I think broadly our approach
is to prioritize the areas
that are most critical in that space.
But I think it is a really interesting question
about how organizations
which aren't thinking about that
in the way they have to in CNI,
you know, how they deal with that.
I think it's a real challenge.
There's two other data points
of how this is happening today
and how we need to expand it.
One, five years ago,
the post Mirai botnet,
the Department of Commerce published
what's referred to as the botnet report,
but basically,
it was saying,
how do we think about resiliency
against massive scale automated malware?
And one of the things it recommended is,
hey, if your network is hit,
either directly or indirectly,
binders, right?
You gotta have the phone numbers,
you gotta have the,
these are the IPs,
this is, you know, again,
if you have a secure facility,
how are you going to reboot things?
What are some of the less used details
that you need to have at your fingertips?
Second piece that we've seen
as more and more organizations
tabletop against ransomware is,
again, having that explicit behavior
where the executives become aware
through engaging against this.
And I love there's now movement
to bring in influence from role-playing games,
which I think a lot of us enjoy,
to make tabletops more interesting,
more engaging, and more real.
Right, you know,
nothing like a couple of D10s
to sort of help you figure out,
will your decisions actually have an effect?
So, and that also gets to people
sort of thinking through,
what happens if I lose
this organizational capacity?
How will I stay afloat?
How do I prioritize?
And that speaks directly
to the concept of resilience,
which is bend but not break.
I look forward to the invite
to your organizational resilience,
organizational resilience one shot.
We have that almost in the door.
Yeah, yeah.
So, yeah, actually,
that goes back to our previous discussion
about IoT and the sort of death
of those IoT companies.
And, you know, what do people,
you know, again, back to consumers as well,
you know, so they're the victim
of a lack of software resiliency
in the end of life
or that company going bust or whatever.
I mean, do we need to be preparing users
for, you know,
that, you know,
imagine the large cloud service provider
goes bust type situation or,
you know, when we wrote that IoT stuff,
for example, I couldn't believe
that we had to write in there that,
you know, a door lock should still operate.
You know?
Because some of these companies
are just doing this stuff on the bench
and assuming,
I call it the Silicon Valley problem,
which is that, oh,
we've always got internet, right?
And actually, for a lot of people,
they do have power outages repeatedly.
Especially if you live in Wales.
So, but I think this speaks directly
to sort of this vision we have
of secure by design, secure by default.
There are some things we should keep from the 90s.
The kids need to know about ska.
But consumer empowerment
as a primary technical policy philosophy
didn't work.
We have successfully taught
a decent chunk of consumers
to do one thing for security,
which is look for the little lock
in your browser.
And five years ago,
that stopped being relevant
with Let's Encrypt.
It's not that Let's Encrypt is bad,
but now that means something
that conveys no semantics.
So, if our strategy depends
on teaching consumers things,
we're not going to succeed.
And that's why, again,
as Camille's been saying,
and Sissa has,
we've got a lot of workshops
coming up this weekend.
There's Bob Lord,
who's pioneering this effort,
to say, how can we make it
so that people don't have
to make those decisions?
I do also think, I mean,
I think we do actually need
to be careful in part as well.
I mean, so the UK has sort of
various parts of the UK government
which looks at civil contingencies
and catastrophic events.
But I also think, you know,
you don't necessarily want
to start going out with campaigns
telling everyone,
you need to be prepared
for what happens when the internet
goes down across the country
because, you know, ultimately,
that's the job of governments.
That's the job of the companies
who run them.
And I think, you know,
while it is important
people remain aware,
and I'm sure many people
in this room do think a lot
about those kind of things,
you know, you also don't want to be
scaring people unnecessarily.
And I think, fundamentally,
the responsibility is of government
and the organisations involved
in that critical national infrastructure.
But, you know, I think
consumer empowerment,
where it works
and where we can,
is great.
But as you say,
it's not the solution
which we can rely on.
So this is merely
a thought experiment
just leading on from your question.
So, you know,
what do we think will happen
if, say, a large cloud provider
suddenly went bust overnight?
Do we think it would be like
the banks where they go,
you know, you have to bail them out
for the greater good of the users
and the disruption that would ensue?
And I know that's
a controversial statement in itself
because that's a point of view.
But have any of you guys thought about this
just personally or, you know?
Yeah, I don't think I can commit
the British government
to bailing out cloud manufacturers
if they go bust.
Yeah, just Google.
Can you bail out Google?
Yeah.
I mean, you know,
at the risk of repeating myself,
I think part of that is why
we are currently looking to update
the network and information systems regulations
to include more digital service providers
and digital infrastructure providers
because, you know,
people are reliant on cloud services now
in a way that they were not 10 years ago.
And we need to make sure that the...
And I believe,
I would need to double check,
but I think that sort of
question of solvency is a part of that.
You know, it's not just about
having secure data centers
and having everything in place.
I think it's about the sustainability
and I think from both
the government perspective
and from a company perspective,
making sure that the availability
of those services are there
in those kind of circumstances.
But yeah, I mean,
I think it's an interesting question.
I don't imagine most cloud companies
are looking at going bust.
It looks like they're probably
going the other way and growing bigger.
But, you know, you never know.
Yeah, that's what I was going to say.
I mean, in terms of prioritization
of the list of problems
that we have discussed today,
yeah, I mean,
I don't know how that would happen
if the major cloud providers,
I mean, everybody stops using them
and then the money runs out.
I mean, I think we can...
contingency plan for outages.
But them going bust is not a thing
that I think most of us
have put at the top of the list
of challenges to triage,
nor do I think it's a realistic possibility
any time soon.
So I think we're okay.
I'm looking forward to that clip
next week.
I know, right?
Okay.
So you heard it here first.
So we've only got a few more minutes left.
So has anybody got a burning question?
Any question they would like
to ask any of the panelists?
Or just views,
they want to share as well.
Yeah.
I was going to say,
you can give the closing remarks.
Yeah.
So we heard,
we've kind of gone across
a lot of the landscape
and I didn't get to
what I wanted to talk about
with standards,
but like,
has anybody got any ideas
about software resiliency
in terms of what you would like to see?
It's too late in the afternoon.
You need some coffee, don't you?
So, okay.
So what do you think,
what keeps you awake at night, Alan?
So, I mean,
for me,
the question that I sort of worry about
is why haven't we seen
the catastrophic attack?
And I,
that's not really something that keeps me awake,
but the fact that we spend a lot of time in security
and, you know,
I use the analogy of the Drake equation a lot,
which is you've got so many humans,
30,000 people come to the desert every year
and learn how to pop shell.
Many of them really are a little crazy
and many of those people have very strong opinions
about very important institutions.
And so I don't have a good answer for it
and that makes me sort of worry that
it's just sheer luck that we haven't seen
sort of the very large event.
And so that's sort of the high level policy question.
That is way above my pay grade,
but I like to raise it for people like Camille.
I think that the real challenge for us,
which we've sort of covered here,
is really a kind of a core problem of government,
which is that you have a limited number of resources
and an essentially infinite number of challenges.
That's true in cyber as much as it is everywhere else.
And that prioritization is hard
and there are always people who might lose out on that.
I think one of the things that we're really hoping to do
in the UK is listen to as many people as possible
to make sure that we are making the right decisions
and that there are the right people who are being protected.
But there are always things which don't get done
and we are really keen to make sure that we are at least,
if we make that wrong decision,
we've been as informed as possible.
So actually it would be remiss of me not to note
that our call for views,
we are probably publishing our sort of response to it
in the next few months.
So anyone who's interested in learning more
about what our next steps are in the UK
and also sort of actually sharing your views on it,
keep an eye out for that,
but also obviously happily sort of have a chat afterwards as well.
Hashtag advert.
The ability to mitigate risk across a number of different issues
all at the same time at scale,
at the pace that we need them to be mitigated.
That's what keeps me up at night, all night.
But I do think,
I do take heart in the progress that we have made
and the evolution of the role of government
and private sector collaboration.
We've moved from that public-private partnership
when really it was just like throwing threat indicators
across the fence to true collaboration.
I mean, I think you've heard in everyone's points
how they've worked with a private sector organization
of one kind or another,
an international organization
of one kind or another
to try to advance and end
and better understand the implications
of the things that we are trying to do.
That's an important evolution.
It will take time,
so it doesn't really help my speed and scale piece,
but I take heart in the fact that now,
as one of the people who moves back and forth
between government and the private sector
and has seen how much harm on both sides can be done
when they're not talking to each other,
that institutionalization of the collaboration model
and a true understanding of the challenges we seek to solve,
I think is really important.
Thank you.
We're going to have to shut this down
because I want to ask the audience one thing.
So, based on when you stepped into the room,
and I know some people have joined us on the way,
like Peter who's just walked one minute before the end.
You enjoyed our panel.
So, based on when you walked in the room,
do you feel now more confident or less confident
about government's approach to software resiliency?
So, if you feel more confident, raise your hands now.
That's all the government people, isn't it?
Okay, and who is less confident?
Who's in the kind of don't know category?
Middle class?
I don't know.
I haven't changed.
If you haven't changed, it has to be a monologue.
Okay.
Yeah?
Hasn't changed.
Hasn't changed.
Hasn't changed.
Your view hasn't changed?
No.
That sounds pessimistic.
No, it's not.
Maybe we've been doing a great job.
Maybe we've done it all.
Well, let's take another couple hours.
We shouldn't interrogate you.
Yeah, yeah, yeah.
You've got so many.
So, all that remains for me to say is thank you, the audience.
Thank you to Camille.
Thank you to Charlie.
And thank you to Alan.
Thank you very much.
Thank you very much.
And thank you very much to David for his excellent sharing as well here today.
Yes, thank you.