1
00:00:00,000 --> 00:00:05,900
As I said, we are recording this on the record, but some folks in the audience may not want to be internet famous, so keep that in mind.

2
00:00:06,560 --> 00:00:09,420
And with that, let's start with Harley for introduction.

3
00:00:11,300 --> 00:00:17,960
Hi, everybody. I am Harley Geiger, and I'm a cybersecurity attorney with the law firm Venable LLP.

4
00:00:18,060 --> 00:00:21,960
I've been working in cybersecurity law and policy for about 15 years.

5
00:00:22,620 --> 00:00:29,780
I've been a Hill staffer as well as an attorney at the Center for Democracy and Technology, as well as the cybersecurity firm Rapid7.

6
00:00:30,000 --> 00:00:31,020
Thank you all so much for being here.

7
00:00:34,320 --> 00:00:36,120
Hi, everyone. My name is Michaela Lee.

8
00:00:36,260 --> 00:00:41,600
I work at the White House at the Office of the National Cyber Director as a director on our strategy and research team

9
00:00:41,600 --> 00:00:47,300
and previously have worked at cybersecurity consulting firms, and my background is actually in human rights

10
00:00:47,300 --> 00:00:51,760
and looking at the human rights violations that can stem from the use of tech products and services.

11
00:00:53,820 --> 00:00:55,240
Hello. Good morning, everyone.

12
00:00:55,380 --> 00:00:59,980
My name is Suzanne Schwartz, and I am the director of the Office of Strategic Partnerships.

13
00:01:00,000 --> 00:01:05,500
and Technology Innovation at FDA's Center for Devices and Radiological Health.

14
00:01:05,740 --> 00:01:16,140
It is our center and our office that has spearheaded the efforts around regulating medical devices from a cybersecurity perspective.

15
00:01:16,340 --> 00:01:17,420
You'll hear more about that.

16
00:01:20,460 --> 00:01:22,540
Hello. My name is Lindsey Forsen.

17
00:01:22,620 --> 00:01:28,800
I am the deputy executive director of the National Association of Secretaries of State, or NASS.

18
00:01:29,120 --> 00:01:29,980
Hello. My name is Lindsay Forsen. I am the deputy executive director of the National Association of Secretaries of State, or NASS.

19
00:01:29,980 --> 00:01:34,320
aller cybersecurity and election security profile among other things at NASA.

20
00:01:34,680 --> 00:01:41,940
I came to NASA by way of academia where I looked at cybersecurity for local election offices

21
00:01:41,940 --> 00:01:45,640
from an administrative capacity standpoint at Auburn University.

22
00:01:45,960 --> 00:01:46,920
Happy to be here.

23
00:01:49,860 --> 00:01:52,140
Hi, everyone. My name is Lauren Zabic.

24
00:01:52,380 --> 00:01:59,720
I am a senior advisor at the Cybersecurity and Infrastructure Security Agency, or CISA, in the cybersecurity division.

25
00:01:59,980 --> 00:02:04,860
I came to this role from the Belfer Center at the Harvard Kennedy School

26
00:02:04,860 --> 00:02:09,780
where I ran the cyber project for a couple of years. Prior to that I was at

27
00:02:09,780 --> 00:02:15,100
Record Future. Prior to that I was an intelligence analyst in the government

28
00:02:15,100 --> 00:02:19,140
where I did counterterrorism work and then prior to that I was in the military.

29
00:02:19,580 --> 00:02:26,260
Thanks. All right so the way this is going to work I've been asked to give a

30
00:02:26,260 --> 00:02:32,600
15 minute or so overview just about a high level of US cyber policy and then

31
00:02:32,600 --> 00:02:36,500
I'll turn it over to these amazing colleagues here to talk about their work

32
00:02:36,500 --> 00:02:40,900
and in their agencies and how they fit into cyber policy and some of their

33
00:02:40,900 --> 00:02:49,060
priorities. So we'll get started. So a few years ago right and I think for people

34
00:02:49,060 --> 00:02:53,840
who have been paying attention to this space there we spent a lot of time as

35
00:02:53,840 --> 00:02:55,640
advocates trying to convince the

36
00:02:55,640 --> 00:03:00,320
government that cybersecurity was a problem and that we needed to do

37
00:03:00,320 --> 00:03:05,920
something about it. We are past that stage of advocacy. The federal

38
00:03:05,920 --> 00:03:10,760
governments and many of the states also are now aware of cybersecurity. It's

39
00:03:10,760 --> 00:03:14,380
frontline news every day and there is a lot of action that is happening in the

40
00:03:14,380 --> 00:03:19,100
space and so the question is more about you know like what do we do as opposed

41
00:03:19,100 --> 00:03:23,600
to should we do something. And so I'm gonna give you start out with sort of a

42
00:03:23,600 --> 00:03:25,500
high level like like just very

43
00:03:25,500 --> 00:03:25,620
right now. So I'm going to give you sort of a high level like like just very

44
00:03:25,640 --> 00:03:31,300
rough estimate of the numbers they show kind of like some of the the volume of

45
00:03:31,300 --> 00:03:35,820
action on this. So in the United States the legislative branch so this is the US

46
00:03:35,820 --> 00:03:41,320
House and the US Senate right now in the current Congress which is a two-year

47
00:03:41,320 --> 00:03:47,860
two-year Congress there are 195 bills with cybersecurity in it. This is again a

48
00:03:47,860 --> 00:03:52,460
very rough measure but it gives you a sense of it. 13 have already passed one

49
00:03:52,460 --> 00:03:55,620
chamber meaning that one has passed the House or one has passed the Senate and

50
00:03:55,620 --> 00:04:03,220
two have passed both chambers. In the executive branch you have 213 notices

51
00:04:03,220 --> 00:04:08,320
and proposed rules with cybersecurity in 2023. Here we're just looking at

52
00:04:08,320 --> 00:04:12,860
cybersecurity you know so it's cutting out a number of other regulations that

53
00:04:12,860 --> 00:04:17,640
are sort of adjacent or that matter the cybersecurity. 28 are proposed

54
00:04:17,640 --> 00:04:20,840
rules meaning these are regulations that the US government is considering

55
00:04:20,840 --> 00:04:25,560
and then 30 have become rules. Many that the reason the numbers are different

56
00:04:25,560 --> 00:04:31,440
is because some of those came from before 2023. And I don't have great

57
00:04:31,440 --> 00:04:39,620
numbers for the states credit to NCSL but in 2022 40 states considered about

58
00:04:39,620 --> 00:04:46,980
250 cybersecurity bills. 24 enacted some form of cybersecurity legislation and

59
00:04:46,980 --> 00:04:52,900
and many others are considering it presently. Just haven't don't have great

60
00:04:52,900 --> 00:04:55,400
full state coverage right now for 2020.

61
00:04:55,560 --> 00:05:01,140
23. So a fair amount of action right especially compared to say a decade ago when

62
00:05:01,140 --> 00:05:05,860
this was this was not on the radar of most politicians. So it is it is a high amount

63
00:05:05,860 --> 00:05:10,620
of volume. This doesn't even include things like guidance or non regulatory documents

64
00:05:10,620 --> 00:05:16,520
like like guidance best practices things like that standards. There's a high volume

65
00:05:16,520 --> 00:05:21,180
of those as well. So I'm going to talk a little bit now about some of the specific

66
00:05:21,180 --> 00:05:24,740
sectors that this is happening and starting with critical infrastructure.

67
00:05:25,560 --> 00:05:29,200
I think that critical infrastructure is a really important one particularly this year

68
00:05:29,580 --> 00:05:33,580
not only because it's critical infrastructure it's the stuff that we depend on for life

69
00:05:33,580 --> 00:05:39,920
and safety but because this is a year where this in the end of 2022 is a year where there's

70
00:05:39,920 --> 00:05:44,000
sort of a turning point in terms of the US government's approach to critical infrastructure

71
00:05:44,000 --> 00:05:49,520
cybersecurity. The previous model was sort of voluntary risk management. Right. So there

72
00:05:49,520 --> 00:05:55,280
are for many sectors with the exception maybe of electric or the financial sector many sectors

73
00:05:55,560 --> 00:06:01,080
did not really have a cyber security rule requiring them specifically to secure their

74
00:06:01,080 --> 00:06:07,200
their infrastructure. And so as a result the approach was we will work with the sector

75
00:06:07,200 --> 00:06:13,260
and we'll come up with a sector specific plan and the oversight has been criticized

76
00:06:13,260 --> 00:06:20,300
in the past as being very loose for those sectors. What is changing now and this was

77
00:06:20,300 --> 00:06:24,380
announced very clearly in the national cyber strategy that was released earlier this year

78
00:06:25,560 --> 00:06:30,900
the government no longer views this voluntary model as sufficient that we have sort of

79
00:06:30,900 --> 00:06:36,080
gone made progress but have gone about as far as we're going to go with entirely voluntary

80
00:06:36,370 --> 00:06:41,160
risk management. And so the emerging model for critical infrastructure cybersecurity

81
00:06:41,160 --> 00:06:47,340
regulation is for the government to use its existing authority in ways that are somewhat

82
00:06:47,340 --> 00:06:53,820
creative and ideally in ways that are straightforward and where there are gaps in cybersecurity

83
00:06:53,820 --> 00:06:55,340
regulation for the for the

84
00:06:55,340 --> 00:07:01,820
the sectors to then seek out new authorities from Congress to in order to have cyber security

85
00:07:02,540 --> 00:07:08,340
requirements explicit in regulation in the just the past year year and a half we've

86
00:07:08,340 --> 00:07:14,760
seen regulations for some sectors that include the water sector rail pipelines aviation financial.

87
00:07:14,960 --> 00:07:19,660
I think we are all broadly anticipating the chemical sector. There's a lot of talk about

88
00:07:19,660 --> 00:07:24,220
something coming in the health sector. You'll hear soon about medical devices.

89
00:07:24,220 --> 00:07:30,020
So there's been a lot happening on critical infrastructure. This is the top I believe

90
00:07:30,020 --> 00:07:35,740
is the first priority actually chronologically in the national cyber strategy. So this is

91
00:07:35,740 --> 00:07:39,820
a sector or this is an area of cyber policy that I think we can expect to roll on for

92
00:07:39,820 --> 00:07:48,820
the next few years. Another big one the I.O.T. security trust mark. They're calling it a trust

93
00:07:48,820 --> 00:07:53,080
mark because people just lose it when they hear the word label they think oh it's a sticker

94
00:07:53,080 --> 00:07:54,020
on a physical box.

95
00:07:54,220 --> 00:07:58,780
No it is not a sticker on a physical box. So we call it the trust mark so people don't

96
00:07:58,780 --> 00:08:05,040
get it confused. What we are talking about here is I.O.T. labeling the nutrition label.

97
00:08:05,240 --> 00:08:13,440
This is a mark on a connected devices. It can be on the physical packaging it could

98
00:08:13,440 --> 00:08:19,060
be on the the the online content around it around the device that shows that the device

99
00:08:19,060 --> 00:08:24,140
has some sort of baseline level of security. So it's been talked about for like for a long

100
00:08:24,140 --> 00:08:28,600
time. But what's changed now is that the White House has announced that it is going

101
00:08:28,600 --> 00:08:34,400
forward with this. It has White House backing the Federal Communications Commission recently

102
00:08:34,400 --> 00:08:40,460
issued a notice of proposed rulemaking to implement this concept. So it is it is going

103
00:08:40,460 --> 00:08:46,760
to march ahead. And again it is this is not just a static label like just a symbol by

104
00:08:46,760 --> 00:08:54,020
itself. The vision for it is that it will be layered and dynamic meaning that as a regular consumer you

105
00:08:54,140 --> 00:08:59,020
can see sort of top line very basic information. If you are a more sophisticated consumer like

106
00:08:59,020 --> 00:09:03,900
to find people in this room you can go into a deeper layer to get more technical information

107
00:09:04,380 --> 00:09:08,960
and then very very deep layers for things like machine readable information. There is

108
00:09:08,960 --> 00:09:14,140
talk of including a QR code on it which I think is going to be very interesting. And

109
00:09:14,140 --> 00:09:20,800
the security content that you have to attest to in order to apply and use the trust mark

110
00:09:20,800 --> 00:09:24,060
is going to be voluntary security standards.

111
00:09:24,060 --> 00:09:27,880
There are standards that are issued by NIST. NIST has issued a IOT security baseline and

112
00:09:27,880 --> 00:09:32,660
that's going to be we anticipate the criteria. So although you're not required to use the

113
00:09:32,660 --> 00:09:38,900
trust mark if you use it but you are falsifying your attestation you're saying we've met

114
00:09:38,900 --> 00:09:45,220
this baseline but you haven't then you could be liable for for false marketing false advertising

115
00:09:45,220 --> 00:09:51,420
under the FTC Act. And so in that way you there is an enforcement mechanism. I mentioned

116
00:09:51,420 --> 00:09:53,800
that the FCC has this notice of proposed rulemaking

117
00:09:53,800 --> 00:09:58,280
making out now. There is an opportunity for everyone to comment on that. They're soliciting

118
00:09:58,280 --> 00:10:04,720
public feedback if you want to get involved. It is widely viewed as a right now focused

119
00:10:04,720 --> 00:10:11,080
on consumer IOT but there is discussion about also applying this concept if not this exact

120
00:10:11,080 --> 00:10:14,980
label to routers and industrial IOT OT next.

121
00:10:18,680 --> 00:10:23,780
So vulnerability disclosure is a is a very important part of this. It's a very important

122
00:10:23,780 --> 00:10:29,600
is a topic that has been discussed a lot at DEF CON and we are seeing the good kind

123
00:10:29,600 --> 00:10:35,420
of vulnerability disclosure proliferate through regulations and policies in the United States

124
00:10:35,420 --> 00:10:40,060
and abroad. So when I say the good kind I mean we have a channel that is open and if

125
00:10:40,060 --> 00:10:44,960
you submit your vulnerabilities to us then we will triage them and do something about

126
00:10:44,960 --> 00:10:49,060
it and then you know communicate back out with you and you can you know tweet about

127
00:10:49,060 --> 00:10:53,600
it or something. What we're what is changing however we're seeing this as a

128
00:10:53,780 --> 00:11:00,000
regulatory trend is that there are a growing number of regulations that contemplate requiring

129
00:11:00,760 --> 00:11:06,840
disclosure of vulnerabilities to government agencies and on timelines that don't necessarily

130
00:11:06,840 --> 00:11:12,780
mean that that vulnerability is going to be patched. So a big one is the EU Cyber Resilience

131
00:11:12,780 --> 00:11:18,860
Act. If you have not heard of that law you will. It will have a GDPR like effect on security

132
00:11:18,860 --> 00:11:21,720
when it passes. I say when because it's it's going to pass.

133
00:11:23,780 --> 00:11:28,160
It is not law yet. They're discussing it sort of at the legislative level but it is

134
00:11:28,160 --> 00:11:34,620
at a very advanced stage. The EU Cyber Resilience Act includes provisions to require organizations

135
00:11:35,240 --> 00:11:42,080
if they have an actively exploited vulnerability to to notify. It's unclear which which government

136
00:11:42,080 --> 00:11:47,580
agency will be possibly a NISA possibly the scissors but notify them about that vulnerability

137
00:11:47,580 --> 00:11:53,620
within 24 hours. So within 24 hours of finding out that your vulnerability is exploited is

138
00:11:53,780 --> 00:11:58,820
not enough time most likely to patch that vulnerability. And this is for any software

139
00:11:59,200 --> 00:12:05,640
being sold in the EU. The effect of it will be a rolling list of software packages with

140
00:12:05,640 --> 00:12:11,260
vulnerabilities that were recently exploited and not likely patched being shared among

141
00:12:11,260 --> 00:12:19,720
you. You government agencies in France. There is a similar similar is now law. So it's a

142
00:12:19,720 --> 00:12:23,660
similar law. This was in their military programming legislation and it too.

143
00:12:23,780 --> 00:12:29,440
Required disclosure of vulnerabilities to the French government to honestly actually

144
00:12:29,440 --> 00:12:35,620
within a short period of time less than less than three days. And there it was not even

145
00:12:35,620 --> 00:12:41,340
a distinction I believe whether or not the vulnerability was exploited. At this time

146
00:12:41,340 --> 00:12:45,560
there's no distinction between whether the vulnerability is exploited by a criminal or

147
00:12:45,560 --> 00:12:49,260
by good faith security researchers. And there's no distinction as it as it relates to severity.

148
00:12:49,600 --> 00:12:53,600
If you're wondering how organizations are even going to comply with this you're not alone.

149
00:12:54,980 --> 00:13:01,440
China has a somewhat now famous vulnerability disclosure requirement. This was passed I

150
00:13:01,790 --> 00:13:07,700
believe last year it came in came into effect. And this too requires every organization to have a

151
00:13:07,700 --> 00:13:16,360
CBD vulnerability disclosure policy but to pass on disclosures to the Chinese government. If you

152
00:13:16,360 --> 00:13:22,540
are an independent researcher you have the great choice of disclosing your vulnerabilities that

153
00:13:22,540 --> 00:13:23,020
you've discovered.

154
00:13:23,780 --> 00:13:27,780
To the company that owns it which then must disclose it to the Chinese government or to the

155
00:13:27,780 --> 00:13:32,720
Chinese government. That's it. You don't get to talk about it publicly. So this is a trend that

156
00:13:32,720 --> 00:13:38,280
we're seeing worldwide. There is indeed in the United States now legislation to update FISMA.

157
00:13:38,400 --> 00:13:42,780
FISMA is the law that requires security for government agencies that looks at doing something

158
00:13:42,780 --> 00:13:46,360
somewhat similar. I'm not going to spend a lot of time on that because it's still new and I don't

159
00:13:46,360 --> 00:13:51,840
expect it to pass but it is out there. The reason why we think this is a problem quickly and

160
00:13:51,840 --> 00:13:53,580
probably many of you get this is that.

161
00:13:53,780 --> 00:13:58,640
If we're disclosing unmitigated vulnerabilities to a lot of government agencies there are risks.

162
00:13:58,940 --> 00:14:03,780
You're depending on the security of that government agency and the EU under the Cyber Resilience Act

163
00:14:03,780 --> 00:14:08,740
model if it goes to all the agencies they contemplate it's more than 50. 50 agencies. You're

164
00:14:08,740 --> 00:14:13,900
depending on the security of all of them not to alert adversaries. You are also depending on trust

165
00:14:13,900 --> 00:14:19,600
that they will not use these vulnerabilities for surveillance purposes. And independent research

166
00:14:19,600 --> 00:14:23,660
unless it's specifically carved out it's going to be kicking off this this process.

167
00:14:23,780 --> 00:14:28,260
Where I found a vulnerability in your software and now you have to tell the government. That's

168
00:14:28,260 --> 00:14:33,660
going to make it so that you are not as welcoming to my vulnerability disclosure. So keep an eye out

169
00:14:33,660 --> 00:14:40,240
for this. Incident reporting. So here we're talking about separately from vulnerability

170
00:14:40,240 --> 00:14:45,460
disclosure also separate from breach notification. So when we talked about breach notification in the

171
00:14:45,460 --> 00:14:52,220
past that was about loss of personal information. Here there is a at this point fairly well developed

172
00:14:53,780 --> 00:14:59,020
requirements to disclose cyber incidents that are independent of whether or not personal information

173
00:14:59,020 --> 00:15:04,600
is involved. Right. And so if you have been disrupted in some sort of way you now depending

174
00:15:04,600 --> 00:15:11,420
on what sector you sit in may have an obligation to notify regulators. So SIRCIA is a big one that's

175
00:15:11,420 --> 00:15:16,820
for critical infrastructure owners and operators. It flows down to their contractors as well. So if

176
00:15:16,820 --> 00:15:22,200
they experience a significant incident they will have to notify CISA. That is not yet in effect but

177
00:15:22,200 --> 00:15:23,640
it is it is law. But there is.

178
00:15:23,780 --> 00:15:28,920
At a regulatory stage where the final regulation is not out. Many of you have probably heard in recent days of the

179
00:15:28,920 --> 00:15:34,280
Securities and Exchange Commission requirements of the SEC. This is a very big one. This applies to every

180
00:15:34,280 --> 00:15:39,980
publicly traded company. And the requirement is such that if you are a publicly traded company and you

181
00:15:39,980 --> 00:15:47,300
experience a material cybersecurity incident you must disclose this effectively publicly within four days of

182
00:15:47,820 --> 00:15:53,220
determining that this is a material incident. So you disclose it through your 8K form which then goes on to the

183
00:15:53,220 --> 00:15:53,580
Edgar.

184
00:15:53,780 --> 00:16:02,020
Edgar system and that is public. So that is again four days not clear whether or not your incident is going to be contained or

185
00:16:02,020 --> 00:16:09,320
mitigated at that time. There's a bunch of others. So financial sector FCC. The point is for every sectoral regulator that's out

186
00:16:09,320 --> 00:16:15,560
there they want a piece of this action and they're all putting out incident reporting requirements. There's not a general one for

187
00:16:15,560 --> 00:16:21,300
the United States but the patchwork does spread pretty broad. And when I say patchwork we recognize that there's a patchwork.

188
00:16:21,380 --> 00:16:23,220
The U.S. government has talked openly about it.

189
00:16:23,220 --> 00:16:33,400
CIRCIA itself has a part of it in the law that requires CISA to have an incident reporting harmonization council. But harmonization is also just a fancy word.

190
00:16:33,520 --> 00:16:43,320
What do we really mean by that? What is the outcome going to be? And especially how will that process affect independent agencies like the SEC that don't

191
00:16:43,320 --> 00:16:52,640
necessarily have to listen? How will it affect things like the Cyber Resilience Act, non-U.S. organizations? And then lastly the talk about incident reporting is

192
00:16:53,580 --> 00:17:01,260
fine, transparency is good but we had transparency with data breach notification. It didn't fix privacy. Cyber incident reporting is not going to fix

193
00:17:01,260 --> 00:17:06,880
cyber security. It will be a big compliance burden and it will help transparency. It will help some things but it is not the same thing as

194
00:17:06,880 --> 00:17:18,340
resilience. So beyond just incident reporting there is this, right now there is a drive within the U.S. governments driven by the White House to

195
00:17:18,340 --> 00:17:22,620
harmonize cyber security regulations more broadly. Not just about cyber security in the United States. That is really important. In terms of that, we have a number of

196
00:17:22,640 --> 00:17:29,020
incidents is almost like cyber should have a policy and so the office of the

197
00:17:29,020 --> 00:17:35,240
national coordinator for for cyber has issued a regulatory harmonization

198
00:17:35,240 --> 00:17:39,820
initiative and is asked asking for public feedback right now that is a

199
00:17:39,820 --> 00:17:44,860
request for information that is present and anyone here can comment on it but

200
00:17:44,860 --> 00:17:49,660
the idea is to try to as much as possible get our cybersecurity or

201
00:17:49,660 --> 00:17:55,520
requirements to be more consistent and ideally to be based on a level of a

202
00:17:56,280 --> 00:18:01,320
baseline and that baseline right now looks like probably it will be the

203
00:18:02,460 --> 00:18:07,960
performance goals that the that CISA has has issued but it may differ by by

204
00:18:07,960 --> 00:18:12,700
sector streamlining regulations that are redundant so that you don't have to

205
00:18:12,700 --> 00:18:16,360
comply with the same thing twice and you know issue issue two incidents for

206
00:18:16,360 --> 00:18:19,540
example and ideally cutting across

207
00:18:19,540 --> 00:18:24,900
not just the federal sectors but also cut states as well here again however

208
00:18:24,900 --> 00:18:27,980
you have the same problem as harmonization with incident reporting

209
00:18:27,980 --> 00:18:32,560
how will affect independent agencies how will they work with states and many of

210
00:18:32,560 --> 00:18:36,340
the problems are outside of the United States as far as regulatory compliance

211
00:18:36,340 --> 00:18:40,620
so it's a significant challenge but this is one that is ongoing right now we're

212
00:18:40,620 --> 00:18:44,560
going to hear more about harmonization for the rest of the year and then

213
00:18:44,560 --> 00:18:49,380
artificial intelligence it's so hot right now but if it's already legal

214
00:18:49,540 --> 00:18:53,440
to hack does it need to be more illegal to hack with artificial intelligence

215
00:18:53,440 --> 00:18:57,420
that there's a lot that's happening and I want to kick it briefly to my killer

216
00:18:57,420 --> 00:19:01,340
colleague Heather West who follows this space very closely to talk about some

217
00:19:01,340 --> 00:19:04,920
of what's happening in artificial intelligence I love that I get to jump

218
00:19:04,920 --> 00:19:10,140
up here for just a hot second as Harley said you know artificial intelligence is

219
00:19:10,140 --> 00:19:14,600
all over the place is it new is it not who knows I mean we kind of know but

220
00:19:14,600 --> 00:19:18,560
it's it's worth walking through a little bit of what various governments are

221
00:19:18,560 --> 00:19:19,520
thinking about here because it's a lot of work and it's a lot of work and it's a lot of work and it's a lot of work and it's a lot of work

222
00:19:19,540 --> 00:19:22,100
because it could be really really impactful particularly at the

223
00:19:22,100 --> 00:19:25,460
intersection of these artificial intelligence systems and cybersecurity

224
00:19:25,460 --> 00:19:29,700
one of the things that that I think is a little bit underappreciated by some

225
00:19:29,700 --> 00:19:33,980
policymakers is how important artificial artificial intelligence is for

226
00:19:33,980 --> 00:19:37,820
cybersecurity it's kind of a bedrock to a lot of these technologies and yet

227
00:19:37,820 --> 00:19:43,800
there's a lot of hand-waving happening so you probably heard of a number of

228
00:19:43,800 --> 00:19:48,480
administration actions one of which is kind of being operationalized next door

229
00:19:48,480 --> 00:19:49,520
in the generative area of the world and it's a lot of work and it's a lot of

230
00:19:49,540 --> 00:19:49,780
research that's going on in it's a lot of research that's going on in there um especially

231
00:19:49,780 --> 00:19:53,640
a really amazing example that AI red teaming village or a village it's

232
00:19:53,640 --> 00:19:56,240
actually pretty cool I had a chance to poke around a little bit it's worth

233
00:19:56,240 --> 00:20:02,760
it's worth taking a look but there's they're letting at scale people go in and

234
00:20:02,760 --> 00:20:03,960
and try to break these systems.

235
00:20:04,080 --> 00:20:04,720
That's really cool.

236
00:20:05,600 --> 00:20:08,500
And these companies have committed to working together

237
00:20:08,500 --> 00:20:11,480
and working with the government to try to make sure

238
00:20:11,480 --> 00:20:13,140
that AI systems are secure

239
00:20:13,140 --> 00:20:16,100
and that we know how to use AI for security,

240
00:20:16,360 --> 00:20:17,240
which is pretty cool.

241
00:20:18,260 --> 00:20:21,620
Earlier this week, the DARPA AI challenge was announced

242
00:20:21,620 --> 00:20:24,860
of funding over the next few years to think about security.

243
00:20:25,220 --> 00:20:26,940
Like it's really apparent to me

244
00:20:27,720 --> 00:20:29,880
that the government has realized

245
00:20:29,880 --> 00:20:32,660
that focusing on security for AI

246
00:20:32,660 --> 00:20:34,520
is one of the places that we know

247
00:20:34,520 --> 00:20:36,340
how to jump into right now.

248
00:20:36,480 --> 00:20:38,660
There are a lot of other pieces of this puzzle

249
00:20:39,040 --> 00:20:40,480
and I have the sneaking suspicion

250
00:20:40,480 --> 00:20:42,620
that the other folks up here are gonna talk about this

251
00:20:42,620 --> 00:20:43,600
more than a little bit.

252
00:20:44,940 --> 00:20:46,680
So I won't go too far into it,

253
00:20:46,760 --> 00:20:49,520
but it's worth looking at and differentiating

254
00:20:49,520 --> 00:20:51,320
what's new and what's not.

255
00:20:52,000 --> 00:20:53,180
It's so hot right now,

256
00:20:53,260 --> 00:20:54,860
I think legislators have a rubber stamp

257
00:20:55,340 --> 00:20:56,860
that says now with AI.

258
00:20:58,360 --> 00:20:59,500
There are a ton of

259
00:20:59,500 --> 00:21:00,640
congressional and state proposals.

260
00:21:01,940 --> 00:21:03,680
They're all variously interesting.

261
00:21:03,940 --> 00:21:05,300
Some of them have to do with security.

262
00:21:05,540 --> 00:21:07,780
Some of them have to do with fairness and bias.

263
00:21:08,020 --> 00:21:10,540
And for example, there's a bunch of state proposals

264
00:21:10,540 --> 00:21:11,940
around hiring bias.

265
00:21:12,200 --> 00:21:13,220
That's incredibly important.

266
00:21:13,400 --> 00:21:14,160
It's really interesting.

267
00:21:15,680 --> 00:21:17,520
There's a lot of action internationally.

268
00:21:18,220 --> 00:21:22,400
The AI Act in the EU is in trial log right now.

269
00:21:22,680 --> 00:21:24,220
There are final negotiations.

270
00:21:24,980 --> 00:21:26,780
One of the most notable things there

271
00:21:26,780 --> 00:21:28,860
is how it interacts with the cyber,

272
00:21:28,900 --> 00:21:29,480
the cyber security.

273
00:21:29,500 --> 00:21:31,280
There's the resilience act that Harley mentioned,

274
00:21:31,520 --> 00:21:33,220
the product liability directive,

275
00:21:33,560 --> 00:21:35,020
the AI liability directive,

276
00:21:35,180 --> 00:21:37,480
thinking about what it means for an AI product

277
00:21:37,480 --> 00:21:40,960
to be defective and what the burden of proof is

278
00:21:40,960 --> 00:21:41,820
to think about that.

279
00:21:42,000 --> 00:21:43,240
And defective can mean security.

280
00:21:45,260 --> 00:21:48,140
There are over 50 national strategies out there

281
00:21:48,140 --> 00:21:49,900
from various countries thinking about

282
00:21:49,900 --> 00:21:51,020
how they're gonna approach AI

283
00:21:51,020 --> 00:21:53,300
and how they're gonna approach security for AI.

284
00:21:54,480 --> 00:21:57,500
And there's a ton of private sector initiatives.

285
00:21:57,860 --> 00:21:58,780
I personally,

286
00:21:58,780 --> 00:22:01,320
I'm spending a bunch of time with my colleagues at Venable

287
00:22:01,320 --> 00:22:04,020
thinking about what it means to be utilizing,

288
00:22:04,280 --> 00:22:07,780
developing AI well, responsibly, securely.

289
00:22:08,740 --> 00:22:11,020
So it is incredibly hot.

290
00:22:11,180 --> 00:22:12,940
I can't wait to hear what everybody else

291
00:22:12,940 --> 00:22:14,140
is thinking about on this front.

292
00:22:14,420 --> 00:22:15,080
Thanks, Harley.

293
00:22:18,540 --> 00:22:19,300
Thank you, Heather.

294
00:22:22,200 --> 00:22:23,780
So, because this is DEF CON,

295
00:22:26,160 --> 00:22:27,100
that was amazing.

296
00:22:30,220 --> 00:22:31,020
Not now.

297
00:22:31,460 --> 00:22:32,940
Okay, that was the right choice.

298
00:22:33,820 --> 00:22:35,000
So, because this is DEF CON,

299
00:22:35,140 --> 00:22:38,600
I also wanna talk about some of the hacker law priorities.

300
00:22:39,280 --> 00:22:42,040
And then we're rounding out the end of it

301
00:22:42,040 --> 00:22:42,780
before I turn it over.

302
00:22:44,240 --> 00:22:47,420
So, in the past, we've talked at DEF CON quite a lot

303
00:22:47,420 --> 00:22:49,960
about the Computer Fraud and Abuse Act.

304
00:22:50,900 --> 00:22:53,500
And I know I'm skipping out of order here seemingly,

305
00:22:53,840 --> 00:22:54,640
but hear me out.

306
00:22:54,800 --> 00:22:56,180
So, the Computer Fraud and Abuse Act

307
00:22:56,580 --> 00:22:58,760
has had a lot of changes over the past couple of years.

308
00:22:58,760 --> 00:23:02,840
Through the Supreme Court, the Van Buren case,

309
00:23:03,020 --> 00:23:06,580
as well as the Department of Justice charging policy on CFAA.

310
00:23:07,600 --> 00:23:12,060
Point is, the CFAA is now more narrow than it used to be.

311
00:23:12,300 --> 00:23:15,660
It has taken some of the heat off of some forms of research.

312
00:23:16,420 --> 00:23:18,560
That is not the same for the states.

313
00:23:19,000 --> 00:23:23,960
State laws were not touched by the Department of Justice's

314
00:23:23,960 --> 00:23:25,020
charging policy.

315
00:23:25,160 --> 00:23:27,440
It's not touched by Supreme Court, the Supreme Court,

316
00:23:27,440 --> 00:23:30,160
a ruling on CFAA, because the CFAA is a federal law.

317
00:23:30,540 --> 00:23:34,220
The things that people, that this community

318
00:23:34,220 --> 00:23:36,800
has historically feared and complained about

319
00:23:36,800 --> 00:23:39,200
as it relates to the overbreadth of the CFAA,

320
00:23:39,420 --> 00:23:41,160
it's actually more present in the states.

321
00:23:41,520 --> 00:23:44,520
So, anyone here from wherever state you are from,

322
00:23:44,620 --> 00:23:46,540
if you look up your state and then computer crime law,

323
00:23:46,640 --> 00:23:47,680
you'll be able to read it for yourself.

324
00:23:48,400 --> 00:23:49,520
But they have not evolved.

325
00:23:49,860 --> 00:23:54,240
And so, I just wanna emphasize that as a hacker law priority

326
00:23:54,240 --> 00:23:56,260
that I think this is where the action ought to be

327
00:23:56,260 --> 00:23:57,420
for this community that has, you know,

328
00:23:57,440 --> 00:24:00,820
historically done so well at speaking up for itself.

329
00:24:01,760 --> 00:24:03,240
DMCA section 1201.

330
00:24:03,660 --> 00:24:07,180
This is arguably the second most important hacking law

331
00:24:07,180 --> 00:24:08,920
at the federal level.

332
00:24:10,220 --> 00:24:13,000
That law requires you to get the authorization

333
00:24:13,000 --> 00:24:16,940
of the software copyright owner before circumventing

334
00:24:16,940 --> 00:24:19,060
a technological protection measure to software.

335
00:24:19,280 --> 00:24:21,360
Even if you own the copy of the software,

336
00:24:21,560 --> 00:24:22,920
because it is a copyright law.

337
00:24:24,180 --> 00:24:26,220
That too has gotten a lot better.

338
00:24:26,220 --> 00:24:29,760
So, there are now exceptions for security researchers there.

339
00:24:29,900 --> 00:24:31,620
Where there is not an exception though,

340
00:24:31,780 --> 00:24:33,460
is in what they call trafficking.

341
00:24:33,700 --> 00:24:35,980
So, this is making your tools available

342
00:24:36,800 --> 00:24:38,300
to the public in some form.

343
00:24:38,400 --> 00:24:39,900
Whether you're doing it for pay

344
00:24:39,900 --> 00:24:41,780
or just making it available for free.

345
00:24:42,020 --> 00:24:44,500
Section 1201 forbids this and there is no exception.

346
00:24:45,260 --> 00:24:46,900
Every security company is just sort of

347
00:24:46,900 --> 00:24:48,500
whistling past this regulation.

348
00:24:48,800 --> 00:24:51,100
It's not often enforced, but it has been enforced.

349
00:24:51,320 --> 00:24:53,380
It is not just a criminal law.

350
00:24:53,480 --> 00:24:56,200
It is also a private law, meaning that it's subject to, you know,

351
00:24:56,220 --> 00:25:00,000
to private lawsuits and we have seen a private lawsuit

352
00:25:00,500 --> 00:25:02,320
based on this in the past.

353
00:25:03,880 --> 00:25:06,480
CFAA, I mentioned some of the evolution of it.

354
00:25:06,640 --> 00:25:09,060
The DOJ's charging policy was very significant

355
00:25:10,040 --> 00:25:11,880
insofar as the Department of Justice says,

356
00:25:12,080 --> 00:25:13,700
if you are doing good face security research,

357
00:25:13,940 --> 00:25:17,480
we will, by default, sort of decline to prosecute you

358
00:25:17,480 --> 00:25:19,560
as long as you're not doing something worse.

359
00:25:19,940 --> 00:25:20,820
That's prosecution.

360
00:25:21,180 --> 00:25:24,400
The CFAA, like the DMCA, is not just a criminal statute.

361
00:25:24,540 --> 00:25:25,600
It's also a private,

362
00:25:26,220 --> 00:25:28,020
criminal statute, meaning that you can be sued privately

363
00:25:28,020 --> 00:25:28,860
under the CFAA.

364
00:25:29,080 --> 00:25:30,200
That has not changed.

365
00:25:31,120 --> 00:25:33,500
We're seeing a lot of bright spots in CBD

366
00:25:34,120 --> 00:25:36,560
and vulnerability disclosure policies, but like I said,

367
00:25:36,620 --> 00:25:39,060
I think we're getting further left of boom to the point

368
00:25:39,060 --> 00:25:41,480
where we are now being required to, in some circumstances,

369
00:25:41,800 --> 00:25:45,200
disclose our vulnerabilities in a mandatory way

370
00:25:45,200 --> 00:25:46,140
to government agencies.

371
00:25:47,020 --> 00:25:50,240
And that is our chief concern as it relates to the way

372
00:25:50,240 --> 00:25:51,580
that this is evolving globally.

373
00:25:55,340 --> 00:25:56,200
This is my last question.

374
00:25:56,200 --> 00:25:58,120
Last slide, and then I'll turn it over.

375
00:25:58,340 --> 00:26:01,000
And that is, if you want to advocate on these things,

376
00:26:01,220 --> 00:26:04,340
right, so this is part of what we hope you'll come away with.

377
00:26:04,640 --> 00:26:07,800
If you want to advocate on this, it is easy

378
00:26:07,800 --> 00:26:10,920
to just appreciate the problem, right, to say, well,

379
00:26:11,360 --> 00:26:13,720
CFAA is too broad, or states, you know, haven't evolved.

380
00:26:14,180 --> 00:26:17,200
What is harder is finding the right officials

381
00:26:17,200 --> 00:26:18,660
to describe your problem to.

382
00:26:18,780 --> 00:26:19,800
Some of them are up here.

383
00:26:19,920 --> 00:26:20,940
Some of them are at DEFCON.

384
00:26:21,080 --> 00:26:22,740
But finding the right official to describe

385
00:26:22,740 --> 00:26:24,260
that problem is really the next step.

386
00:26:24,460 --> 00:26:26,060
And then, even more difficult,

387
00:26:26,060 --> 00:26:28,020
substantially more difficult, is actually coming up

388
00:26:28,020 --> 00:26:30,300
with a solution to the problem that you have identified.

389
00:26:30,540 --> 00:26:32,920
And that is what we ask our government officials to do.

390
00:26:33,040 --> 00:26:34,960
That is what makes their job pretty hard.

391
00:26:35,740 --> 00:26:39,080
And coming up with a solution that actually works

392
00:26:39,080 --> 00:26:40,980
for the world is even more difficult,

393
00:26:41,100 --> 00:26:42,620
because it's not just a world that cares

394
00:26:42,620 --> 00:26:43,600
about security out there.

395
00:26:43,740 --> 00:26:46,680
We have other things, like business, or public safety,

396
00:26:46,840 --> 00:26:48,980
and other things like that, that all must be balanced,

397
00:26:49,180 --> 00:26:50,460
not just about hacker rights.

398
00:26:51,060 --> 00:26:54,180
And then, finally, making actual tangible progress

399
00:26:54,180 --> 00:26:54,860
on your solution.

400
00:26:54,860 --> 00:26:56,200
That's where it really begins.

401
00:26:56,940 --> 00:26:58,340
Thank you so much.

402
00:26:58,420 --> 00:26:59,860
I hope you appreciated that overview.

403
00:27:00,080 --> 00:27:02,220
And now I want to turn it over to my colleagues

404
00:27:02,220 --> 00:27:04,840
at the White House here to talk about what they do.

405
00:27:06,040 --> 00:27:06,920
And that's it.

406
00:27:07,000 --> 00:27:07,380
Thank you.

407
00:27:14,580 --> 00:27:15,740
Thanks so much, Harley.

408
00:27:15,880 --> 00:27:20,800
That was an incredibly useful background for, I think,

409
00:27:20,820 --> 00:27:22,720
what the rest of us on the panel are going to talk about,

410
00:27:22,840 --> 00:27:24,500
which is what do each

411
00:27:24,500 --> 00:27:28,480
of our organizations do within this context, and how do we do it.

412
00:27:28,680 --> 00:27:30,700
The hope is that through this session,

413
00:27:30,880 --> 00:27:33,220
you'll have a better understanding of what each

414
00:27:33,220 --> 00:27:36,960
of our offices or organizations do as it relates to cyber policy,

415
00:27:37,240 --> 00:27:40,200
the kinds of levers and tools that we have in our toolbox,

416
00:27:40,520 --> 00:27:43,320
and hopefully, as well, the kinds of levers and tools

417
00:27:43,320 --> 00:27:46,940
that you have in your toolbox to engage in this policy process.

418
00:27:47,980 --> 00:27:50,820
The one thing that I want to say up front is that the challenge

419
00:27:50,820 --> 00:27:54,220
with doing a Cyber Policy 101 session is that sometimes,

420
00:27:54,220 --> 00:27:56,980
there are very, very different understandings

421
00:27:56,980 --> 00:27:58,660
of what the word cyber means.

422
00:27:59,180 --> 00:28:02,620
And that is, I think, understandable.

423
00:28:02,960 --> 00:28:06,580
There are people who think of the word cyber and take that

424
00:28:06,580 --> 00:28:10,740
to mean offensive tools and approaches to attack adversaries.

425
00:28:11,080 --> 00:28:15,140
They might think that it means enterprise IT networks

426
00:28:15,140 --> 00:28:18,080
and securing those, or the defense of critical infrastructure.

427
00:28:18,420 --> 00:28:22,220
To some people, cyber means a job classification

428
00:28:22,480 --> 00:28:23,820
that helps the federal government

429
00:28:23,820 --> 00:28:26,180
identify the types of technical skills

430
00:28:26,180 --> 00:28:28,400
that we need within our departments and agencies.

431
00:28:28,740 --> 00:28:31,060
And there's a really wide range of topics here.

432
00:28:31,120 --> 00:28:32,620
I think, over the course of the rest of the session,

433
00:28:32,780 --> 00:28:35,080
we might use the same terms to mean different things,

434
00:28:35,280 --> 00:28:39,280
but hopefully, we can help parse the differences

435
00:28:39,280 --> 00:28:43,440
and the nuances within the way that we think about cyber policy.

436
00:28:44,280 --> 00:28:46,380
So that's just a little bit of framing up front.

437
00:28:47,700 --> 00:28:49,420
For those of you who came in a little bit late,

438
00:28:49,500 --> 00:28:51,160
I work at the Office of the National Cyber Director

439
00:28:51,160 --> 00:28:53,800
at the White House, and we are an incredible,

440
00:28:53,800 --> 00:28:56,500
incredibly new office, a new component

441
00:28:56,500 --> 00:28:58,160
in the Executive Office of the President,

442
00:28:58,400 --> 00:29:00,240
established only a few years ago,

443
00:29:00,420 --> 00:29:02,780
but it was established through the recognition,

444
00:29:03,060 --> 00:29:04,660
because the recognition that historically,

445
00:29:04,880 --> 00:29:06,960
it's been very difficult to understand

446
00:29:07,340 --> 00:29:09,860
how to establish some level of cohesion

447
00:29:09,860 --> 00:29:10,940
across the federal government

448
00:29:11,380 --> 00:29:13,420
to address cybersecurity issues.

449
00:29:15,560 --> 00:29:18,200
ONCD sits at the intersection of all those

450
00:29:18,200 --> 00:29:20,060
kind of different definitions of cyber

451
00:29:20,060 --> 00:29:21,820
that I mentioned up top.

452
00:29:24,140 --> 00:29:28,240
It's incredibly useful to bring some of those elements

453
00:29:28,240 --> 00:29:30,660
together, but also challenging, because that world

454
00:29:30,660 --> 00:29:31,400
is very complex.

455
00:29:31,700 --> 00:29:34,580
And so one of the ways that we, one of the things

456
00:29:34,580 --> 00:29:36,660
that we hope to do is to engage deeply

457
00:29:36,660 --> 00:29:38,880
with the private sector, with civil society,

458
00:29:38,960 --> 00:29:40,720
to better understand that complexity

459
00:29:40,720 --> 00:29:43,260
and apply that to the way that we think about policymaking.

460
00:29:44,880 --> 00:29:48,640
So ONCD was established in 2021 by Congress.

461
00:29:49,640 --> 00:29:51,900
It took us a little while to get off the ground,

462
00:29:52,000 --> 00:29:53,780
because we didn't have money at that point.

463
00:29:53,780 --> 00:29:56,040
And so appropriation only came a little bit later.

464
00:29:56,680 --> 00:29:59,360
But we're now about 80 people strong,

465
00:29:59,620 --> 00:30:03,420
and have been working on a number of different issues

466
00:30:03,420 --> 00:30:05,760
that I'll kind of lay out for you all today.

467
00:30:06,160 --> 00:30:07,400
I'll talk a little bit about

468
00:30:07,400 --> 00:30:08,580
the National Cybersecurity Strategy,

469
00:30:08,800 --> 00:30:11,180
which was released in March, that Harley mentioned,

470
00:30:11,400 --> 00:30:13,960
and then all of the work that we've done since then

471
00:30:13,960 --> 00:30:15,940
to implement that strategy.

472
00:30:16,440 --> 00:30:19,000
I think one of the, sometimes the challenge

473
00:30:19,000 --> 00:30:21,140
of a strategy or a strategy document

474
00:30:21,140 --> 00:30:23,640
is that it's words on a page that could turn

475
00:30:23,640 --> 00:30:26,740
into words on a shelf unless there is sufficient buy-in

476
00:30:26,740 --> 00:30:29,060
within the right communities, both within the interagency,

477
00:30:29,280 --> 00:30:31,500
other departments and agencies across the federal government,

478
00:30:31,760 --> 00:30:34,180
or buy-in from other stakeholders

479
00:30:34,180 --> 00:30:36,740
in the private sector or in civil society.

480
00:30:37,400 --> 00:30:41,680
And our hope is to make sure that this is not a strategy

481
00:30:41,680 --> 00:30:43,460
that sits on the shelf, but that it is implemented

482
00:30:43,960 --> 00:30:48,160
and that it is funded, that we're able to align our budget

483
00:30:48,160 --> 00:30:50,800
to our aspirations over the course of this implementation.

484
00:30:51,840 --> 00:30:53,540
So the National Cybersecurity Strategy

485
00:30:53,640 --> 00:30:56,500
that was signed by the president and released

486
00:30:56,500 --> 00:31:01,080
in March of this year laid out two fundamental shifts.

487
00:31:01,460 --> 00:31:03,920
And if you're familiar with this already, that's great.

488
00:31:04,140 --> 00:31:06,920
For those of you who haven't had a chance to take a look at it,

489
00:31:06,940 --> 00:31:08,620
I definitely encourage you to read it

490
00:31:09,180 --> 00:31:12,020
because these two fundamental shifts are important

491
00:31:12,020 --> 00:31:15,920
to the way that we're thinking about the vision

492
00:31:15,920 --> 00:31:17,940
for cyberspace in this decisive decade,

493
00:31:18,260 --> 00:31:21,500
the things that we hope to accomplish in the next decade

494
00:31:21,500 --> 00:31:23,000
and in years to come as well.

495
00:31:23,640 --> 00:31:25,360
Harley talked a little bit about regulation.

496
00:31:25,700 --> 00:31:28,800
That's part of the first shift that we established

497
00:31:28,800 --> 00:31:30,320
in the National Cybersecurity Strategy.

498
00:31:30,660 --> 00:31:33,340
And that shift is about shifting the burden,

499
00:31:34,040 --> 00:31:36,420
understanding that there needs to be a shift

500
00:31:36,420 --> 00:31:38,660
in terms of who is responsible

501
00:31:38,660 --> 00:31:40,440
for managing cybersecurity risk.

502
00:31:40,620 --> 00:31:43,260
And we want to move that away from the end user,

503
00:31:43,400 --> 00:31:46,200
the consumer, and move that up towards those

504
00:31:46,200 --> 00:31:49,560
who are the most capable, who are the biggest

505
00:31:49,560 --> 00:31:51,940
and potentially most responsible entities

506
00:31:52,700 --> 00:31:53,620
for cyber security.

507
00:31:53,640 --> 00:31:54,720
And we want to work that cybersecurity risk.

508
00:31:55,400 --> 00:31:58,560
Now, that involves things like regulation

509
00:31:58,560 --> 00:31:59,980
and regulatory harmonization.

510
00:32:00,440 --> 00:32:02,820
It also, we also talk in the strategy

511
00:32:02,820 --> 00:32:05,520
about software liability model as well.

512
00:32:05,780 --> 00:32:08,300
But this is something that we want to change

513
00:32:08,300 --> 00:32:12,780
because, as it stands now, we're asking elementary schools

514
00:32:13,050 --> 00:32:15,120
and rural hospitals to go toe-to-toe

515
00:32:15,120 --> 00:32:16,520
with transnational criminal organizations.

516
00:32:17,020 --> 00:32:20,620
And not only is that not fair, it's also not effective.

517
00:32:20,980 --> 00:32:22,820
We want to change that model

518
00:32:22,820 --> 00:32:25,220
so that we can address some of these problems

519
00:32:25,580 --> 00:32:27,360
at the part of the chain

520
00:32:27,360 --> 00:32:29,480
where they are most able to be addressed.

521
00:32:30,160 --> 00:32:31,300
So that's the first big shift.

522
00:32:32,000 --> 00:32:33,880
The other big shift is thinking about

523
00:32:33,880 --> 00:32:36,980
how we incentivize long-term investments in cybersecurity.

524
00:32:37,460 --> 00:32:39,360
What we want is a world in which,

525
00:32:40,160 --> 00:32:42,860
when private sector entities or public sector entities

526
00:32:43,420 --> 00:32:45,620
are fighting with trade-offs,

527
00:32:45,640 --> 00:32:46,680
the trade-offs that they have to make

528
00:32:46,680 --> 00:32:50,260
between the perhaps easy but temporary fix

529
00:32:50,740 --> 00:32:52,480
versus the more difficult,

530
00:32:52,820 --> 00:32:53,600
but enduring fix,

531
00:32:53,880 --> 00:32:55,520
that the enduring solution

532
00:32:55,520 --> 00:32:57,860
is the one that should be the right choice.

533
00:32:58,060 --> 00:33:00,320
We want to make that an easier choice.

534
00:33:00,380 --> 00:33:01,520
We want to help shape market forces

535
00:33:01,520 --> 00:33:03,500
so that that choice is the one

536
00:33:03,500 --> 00:33:05,200
that people automatically go to.

537
00:33:05,440 --> 00:33:07,080
And sometimes that's difficult.

538
00:33:07,760 --> 00:33:09,880
I think one example that I'll raise

539
00:33:09,880 --> 00:33:12,960
is the kinds of infrastructure investments

540
00:33:12,960 --> 00:33:14,380
that we're making right now.

541
00:33:14,560 --> 00:33:18,520
The Biden-Harris administration has signed legislation

542
00:33:18,520 --> 00:33:22,380
to pour millions and millions of dollars into infrastructure.

543
00:33:23,120 --> 00:33:26,300
Into clean energy infrastructure as well.

544
00:33:26,460 --> 00:33:28,960
And one of the potential risks is that

545
00:33:29,360 --> 00:33:30,480
that money rolls out,

546
00:33:30,560 --> 00:33:31,880
that infrastructure is built

547
00:33:31,880 --> 00:33:33,340
without sufficient understanding

548
00:33:33,860 --> 00:33:36,280
of the potential cybersecurity risks,

549
00:33:36,340 --> 00:33:39,540
but building some of those cybersecurity mitigations in

550
00:33:39,540 --> 00:33:40,120
at the beginning.

551
00:33:40,420 --> 00:33:44,300
And if we look five years, 10 years, 20 years down the line,

552
00:33:44,420 --> 00:33:47,060
are we going to run the risk of vulnerabilities

553
00:33:47,360 --> 00:33:48,060
in that infrastructure?

554
00:33:48,380 --> 00:33:49,580
Are we going to have to rip and replace,

555
00:33:49,820 --> 00:33:52,280
which may cost exorbitantly more?

556
00:33:52,820 --> 00:33:54,880
How do we make sure that we are doing things

557
00:33:54,880 --> 00:33:57,280
in a way that is secure at the beginning?

558
00:33:57,500 --> 00:33:59,580
And we're thinking about that kind of secure

559
00:33:59,580 --> 00:34:01,160
by design mentality early on.

560
00:34:01,640 --> 00:34:04,240
So incentivizing those long-term investments

561
00:34:04,240 --> 00:34:05,960
in cybersecurity is the other big shift

562
00:34:05,960 --> 00:34:08,000
that we talk about in the National Cybersecurity Strategy.

563
00:34:09,600 --> 00:34:12,060
The implementation of that strategy is something

564
00:34:12,060 --> 00:34:14,340
that we've been focused on for the last couple of months.

565
00:34:14,460 --> 00:34:15,880
And in fact, a month ago,

566
00:34:16,000 --> 00:34:18,600
the implementation plan was released publicly.

567
00:34:19,240 --> 00:34:21,360
This doesn't happen all that often,

568
00:34:21,460 --> 00:34:22,120
but this is something

569
00:34:22,120 --> 00:34:23,720
that we wanted to make sure happened,

570
00:34:23,840 --> 00:34:25,060
both for transparency's sake,

571
00:34:25,160 --> 00:34:27,060
as well as for accountability's sake.

572
00:34:27,260 --> 00:34:31,040
We think it's important to put the implementation plan

573
00:34:31,040 --> 00:34:34,240
out there, not only for us to hold ourselves accountable,

574
00:34:34,420 --> 00:34:37,160
but for you all to hold us accountable as well.

575
00:34:38,060 --> 00:34:39,920
You can find that implementation plan,

576
00:34:40,540 --> 00:34:42,800
pull it apart, ask questions about it.

577
00:34:42,920 --> 00:34:44,860
There are things that are already underway

578
00:34:44,860 --> 00:34:47,180
and are already being implemented.

579
00:34:47,560 --> 00:34:49,460
One of the pieces that Harley mentioned

580
00:34:49,460 --> 00:34:50,720
is the request for information

581
00:34:50,720 --> 00:34:51,980
on regulatory harmonization.

582
00:34:51,980 --> 00:34:54,200
We know that regulatory harmonization

583
00:34:54,200 --> 00:34:58,500
is a big, thorny topic that is going to take years

584
00:34:58,840 --> 00:35:00,480
to unpack and understand.

585
00:35:00,860 --> 00:35:03,860
And we know as well that engagement

586
00:35:03,860 --> 00:35:05,520
with the private sector is necessary.

587
00:35:06,280 --> 00:35:08,980
It is necessary for us to be able to do that effectively.

588
00:35:09,600 --> 00:35:11,020
So that's out and live now.

589
00:35:11,460 --> 00:35:13,960
There's also one that was just released yesterday

590
00:35:13,960 --> 00:35:15,780
on open source software.

591
00:35:16,340 --> 00:35:18,380
And there's a request for information

592
00:35:18,380 --> 00:35:21,280
that we would love to hear from you all in this room,

593
00:35:21,280 --> 00:35:23,820
as well as many other people who are here at DEF CON

594
00:35:23,820 --> 00:35:27,800
about the ways in which we can think about security

595
00:35:27,800 --> 00:35:30,080
of open source software and memory safe languages.

596
00:35:30,740 --> 00:35:32,300
So those are some of the things

597
00:35:32,300 --> 00:35:33,240
that we've been doing recently.

598
00:35:34,200 --> 00:35:36,400
I'll hit on two more and then pass it off

599
00:35:36,400 --> 00:35:38,280
to the other panelists here.

600
00:35:39,020 --> 00:35:41,880
One thing that we released last week

601
00:35:41,880 --> 00:35:45,020
is the National Cyber Workforce and Education Strategy.

602
00:35:45,700 --> 00:35:47,940
And I think that this is incredibly important

603
00:35:47,940 --> 00:35:51,200
because it illustrates the kind of missing pieces

604
00:35:51,280 --> 00:35:54,840
of the puzzle that's often underemphasized or overlooked.

605
00:35:55,100 --> 00:35:58,180
And that is the people, the talent, the expertise that

606
00:35:58,180 --> 00:36:01,460
is needed to do all of the things that we hope to do,

607
00:36:01,500 --> 00:36:04,620
to meet our aspirations for cyberspace.

608
00:36:04,880 --> 00:36:07,480
And that people part is incredibly important.

609
00:36:07,760 --> 00:36:10,000
Finding, training, getting people

610
00:36:10,000 --> 00:36:11,780
into jobs where they can help defend

611
00:36:11,780 --> 00:36:14,220
critical infrastructure, where they can think about the issues

612
00:36:14,220 --> 00:36:16,400
that arise with ITOT conversions,

613
00:36:16,820 --> 00:36:21,100
where they can be in positions to help make decisions on how,

614
00:36:21,100 --> 00:36:24,940
how we think about securing our nation's digital ecosystem.

615
00:36:25,380 --> 00:36:28,120
That, those are things that require talented people.

616
00:36:28,380 --> 00:36:31,420
And the National Cyber and Workforce Education Strategy

617
00:36:32,310 --> 00:36:36,040
is the, is the US government's plan

618
00:36:36,040 --> 00:36:38,880
to address those, those shortfalls

619
00:36:38,880 --> 00:36:41,000
and how to train up the next generation

620
00:36:41,410 --> 00:36:44,000
of digital workforce, our digital workforce.

621
00:36:45,110 --> 00:36:46,960
And then finally, the last thing that I'll mention

622
00:36:46,960 --> 00:36:49,380
is the kind of values alignment piece.

623
00:36:49,620 --> 00:36:50,320
So the,

624
00:36:51,100 --> 00:36:51,800
the National Cyber Security Strategy

625
00:36:51,800 --> 00:36:54,880
talks about defensibility, it talks about resilience,

626
00:36:55,260 --> 00:36:57,020
but it also talks about values alignment.

627
00:36:57,380 --> 00:37:00,940
And that's something that is often difficult to define

628
00:37:01,460 --> 00:37:02,600
and, and, and shape.

629
00:37:03,120 --> 00:37:05,160
One of the things that we did around the Summit

630
00:37:05,160 --> 00:37:08,340
for Democracy back in March is work with the State Department

631
00:37:08,340 --> 00:37:13,020
to put out a call to action on the development

632
00:37:13,020 --> 00:37:16,580
and implementation of censorship circumvention tools.

633
00:37:16,820 --> 00:37:19,520
So thinking about the ways in which technologies

634
00:37:19,520 --> 00:37:20,400
can be helpful

635
00:37:21,100 --> 00:37:23,800
in circumventing the authoritarian censorship

636
00:37:23,800 --> 00:37:25,180
that happens in other countries

637
00:37:25,180 --> 00:37:28,180
in order to make it more,

638
00:37:28,320 --> 00:37:29,700
make the internet more accessible,

639
00:37:30,540 --> 00:37:32,660
more open and more resilient.

640
00:37:33,840 --> 00:37:36,260
Those are the types of things that we've been working on

641
00:37:36,260 --> 00:37:37,820
in the last couple of months.

642
00:37:38,560 --> 00:37:41,160
My, some of my colleagues that are here at DEF CON

643
00:37:41,160 --> 00:37:42,480
have sessions on those topics,

644
00:37:42,660 --> 00:37:45,560
including on Secure by Design and open source software

645
00:37:45,960 --> 00:37:48,340
and anti-censorship and definitely encourage you

646
00:37:48,340 --> 00:37:49,620
to find any one of us.

647
00:37:49,720 --> 00:37:50,500
We tend to be wearing

648
00:37:50,500 --> 00:37:53,660
these China badges and ask us questions.

649
00:37:54,320 --> 00:37:55,220
Give us feedback.

650
00:37:55,500 --> 00:37:57,900
We definitely want to hear from you all in this room.

651
00:37:58,520 --> 00:37:59,340
I'll pass it over.

652
00:38:02,720 --> 00:38:04,020
All right, thank you.

653
00:38:04,240 --> 00:38:07,600
And I want to start off by saying,

654
00:38:07,680 --> 00:38:08,820
Harley, a lot of, you know,

655
00:38:08,840 --> 00:38:14,420
your overview provided a lot of touch points for us at FDA,

656
00:38:14,540 --> 00:38:16,460
reflective of the journey that we've had

657
00:38:16,460 --> 00:38:19,600
over the past decade and a little bit longer.

658
00:38:21,580 --> 00:38:25,220
And let me first also mention that I'm going to have to leave

659
00:38:25,220 --> 00:38:26,660
a little bit early with my team.

660
00:38:26,720 --> 00:38:29,240
My team members are actually here in the audience as well,

661
00:38:29,300 --> 00:38:31,440
but we're going to have to hop over to Biohacking Village

662
00:38:31,440 --> 00:38:33,760
for some activities over there.

663
00:38:35,060 --> 00:38:38,260
I think the best place for me to start,

664
00:38:38,440 --> 00:38:41,140
especially since we're here at DEF CON right now,

665
00:38:41,620 --> 00:38:45,260
is in reflecting back to what some of you

666
00:38:45,260 --> 00:38:47,300
who are in the audience here in the room

667
00:38:47,300 --> 00:38:50,480
and possibly those of you who are, you know, listening, you know,

668
00:38:50,480 --> 00:38:55,000
listening, recall with respect to demos

669
00:38:55,000 --> 00:38:57,980
that have taken place over the years

670
00:38:57,980 --> 00:39:00,840
on the stage at Black Hat and DEF CON,

671
00:39:01,960 --> 00:39:05,240
showing the potential for exploiting vulnerabilities

672
00:39:05,620 --> 00:39:09,320
in medical devices that can result in significant,

673
00:39:09,540 --> 00:39:12,680
I would say, sometimes catastrophic patient harm.

674
00:39:13,660 --> 00:39:17,000
And those types of demonstrations that have been done

675
00:39:17,420 --> 00:39:19,500
by White Hat hackers, by security,

676
00:39:20,480 --> 00:39:26,420
by security researchers, were very much a call to action,

677
00:39:26,580 --> 00:39:28,480
I would say, for the agency.

678
00:39:29,760 --> 00:39:32,660
If we go back, we dial back all those years,

679
00:39:32,840 --> 00:39:36,240
10 years plus, when those demos occurred,

680
00:39:36,760 --> 00:39:40,500
the state of our community, the healthcare ecosystem,

681
00:39:41,040 --> 00:39:47,120
was such that manufacturers were issuing cease and desist letters

682
00:39:47,120 --> 00:39:49,020
to those security researchers.

683
00:39:49,440 --> 00:39:50,460
And, you know, I think, you know, I think, you know, I think, you know,

684
00:39:50,460 --> 00:39:52,680
we're obviously coming to the FDA as well,

685
00:39:52,820 --> 00:39:55,800
complaining that researchers shouldn't be doing

686
00:39:55,800 --> 00:39:57,200
any of those activities.

687
00:39:57,520 --> 00:40:00,600
They're putting patients in harm's way.

688
00:40:00,900 --> 00:40:05,580
We're creating a crisis of confidence in the public

689
00:40:05,580 --> 00:40:10,300
with respect to the use of these devices.

690
00:40:11,330 --> 00:40:16,480
And if you consider that's where we were

691
00:40:17,130 --> 00:40:19,480
10 plus years ago,

692
00:40:19,480 --> 00:40:23,840
and what we at the agency needed to do

693
00:40:23,840 --> 00:40:26,020
to bring us to the present,

694
00:40:26,280 --> 00:40:31,440
this is a very, very hard hill or mountain to climb,

695
00:40:31,660 --> 00:40:32,120
I would say.

696
00:40:32,220 --> 00:40:33,800
And certainly we did not do that alone.

697
00:40:33,980 --> 00:40:36,500
Certainly we did that with many partners,

698
00:40:36,580 --> 00:40:39,020
many collaborators across the entirety

699
00:40:39,020 --> 00:40:41,420
of the medical device ecosystem.

700
00:40:41,840 --> 00:40:44,980
And one of the places where we started

701
00:40:45,400 --> 00:40:48,920
was with this community, with the hacker community,

702
00:40:48,920 --> 00:40:50,860
with security researchers,

703
00:40:51,100 --> 00:40:54,340
with really trying to get a better understanding

704
00:40:54,340 --> 00:41:00,860
of what was happening with respect to vulnerabilities

705
00:41:01,120 --> 00:41:02,560
as they were identified,

706
00:41:02,880 --> 00:41:08,260
and what type of potential risks they expose

707
00:41:08,260 --> 00:41:12,860
or they bring up towards the use of these devices.

708
00:41:14,100 --> 00:41:17,640
I want to, you know, say very clearly our stance at FDA

709
00:41:17,640 --> 00:41:22,580
is that you cannot have,

710
00:41:22,680 --> 00:41:25,300
we cannot have a safe device

711
00:41:26,200 --> 00:41:29,040
unless that device is cyber secure.

712
00:41:30,020 --> 00:41:31,000
I'll say that again.

713
00:41:31,260 --> 00:41:35,680
You know, our position is that for a device

714
00:41:35,680 --> 00:41:37,820
to be safe for patient use,

715
00:41:37,960 --> 00:41:41,640
a device obviously that has capabilities of connection

716
00:41:41,640 --> 00:41:43,580
or has software within it,

717
00:41:44,260 --> 00:41:46,840
that device has to have

718
00:41:47,640 --> 00:41:51,700
basic security by design and capabilities

719
00:41:51,700 --> 00:41:55,060
of being able to be protected from a security perspective.

720
00:41:56,050 --> 00:42:03,940
And moving the ecosystem from a culture of,

721
00:42:04,360 --> 00:42:05,840
this can never happen,

722
00:42:05,960 --> 00:42:07,920
these vulnerabilities are kind of hypothetical,

723
00:42:08,400 --> 00:42:10,100
they're theoretical,

724
00:42:10,770 --> 00:42:12,700
just because they're being shown on this stage

725
00:42:12,700 --> 00:42:15,320
doesn't mean that in reality, you know,

726
00:42:15,320 --> 00:42:17,620
in a real use environment, anything, you know,

727
00:42:17,620 --> 00:42:18,900
anything bad could ever happen.

728
00:42:19,340 --> 00:42:22,500
Moving people away from that mindset,

729
00:42:22,680 --> 00:42:26,760
from that culture has been a really substantial journey

730
00:42:26,760 --> 00:42:28,620
over the past bunch of years,

731
00:42:28,760 --> 00:42:30,200
over the past decade, essentially.

732
00:42:31,320 --> 00:42:34,900
But we've gotten there through a lot of the work

733
00:42:34,900 --> 00:42:39,060
that we have done, again, with groups such as

734
00:42:39,060 --> 00:42:44,560
I am the Cavalry and others who have been huge proponents.

735
00:42:45,220 --> 00:42:46,860
And as Harley talked about,

736
00:42:46,860 --> 00:42:52,280
in his slides, the advocacy aspect of what an audience,

737
00:42:52,440 --> 00:42:56,500
what a coalition can bring to a particular policy area

738
00:42:56,980 --> 00:42:59,060
where change is very much needed.

739
00:42:59,440 --> 00:43:01,480
So that's, you know, just for openers,

740
00:43:01,500 --> 00:43:02,960
I want you to make that very clear.

741
00:43:03,580 --> 00:43:05,840
So FDA, we're, you know, what is our mission?

742
00:43:06,080 --> 00:43:10,320
Again, we are there to protect and promote the public health

743
00:43:10,320 --> 00:43:13,640
and we do that through regulatory activities,

744
00:43:13,900 --> 00:43:16,560
including oversight of medical products,

745
00:43:16,860 --> 00:43:19,460
in, you know, in total.

746
00:43:20,200 --> 00:43:22,620
Our office, the office that I represent

747
00:43:23,040 --> 00:43:25,740
within the Center for Devices and Radiological Health

748
00:43:25,740 --> 00:43:28,820
has responsibility for medical devices.

749
00:43:30,840 --> 00:43:34,640
And if you were to go back and look at

750
00:43:34,640 --> 00:43:39,060
the statutory language for which we abide by,

751
00:43:39,100 --> 00:43:40,460
which we operate under,

752
00:43:40,600 --> 00:43:42,700
it has always been reasonable assurance

753
00:43:42,700 --> 00:43:44,180
of safety and effectiveness.

754
00:43:45,260 --> 00:43:46,840
We've never had, you know, we've never had, you know,

755
00:43:46,840 --> 00:43:49,120
up until recent, so I'll get to the really great news,

756
00:43:49,300 --> 00:43:51,940
but we never had had explicit authorities

757
00:43:53,120 --> 00:43:54,160
around cybersecurity.

758
00:43:54,280 --> 00:43:55,900
If you were to just kind of go through

759
00:43:55,900 --> 00:43:59,420
all of our regulations, all of the food and drug law,

760
00:43:59,880 --> 00:44:02,720
the word cybersecurity up until very recently

761
00:44:02,720 --> 00:44:04,000
has never appeared.

762
00:44:05,180 --> 00:44:10,140
So you might say it was sort of a conundrum back in 2013

763
00:44:10,580 --> 00:44:12,920
when we really started to deal with these vulnerabilities

764
00:44:12,920 --> 00:44:16,180
being brought forward to us by security researchers.

765
00:44:16,840 --> 00:44:20,380
As to how are we going to be able to

766
00:44:21,160 --> 00:44:22,980
appropriately deal with this

767
00:44:22,980 --> 00:44:27,180
within our regulatory schema, our framework.

768
00:44:27,800 --> 00:44:30,400
And we did have to be pretty creative about that.

769
00:44:30,520 --> 00:44:33,240
Harley talked also about if you don't have existing

770
00:44:33,240 --> 00:44:35,700
or explicit, you know, explicit authorities,

771
00:44:35,960 --> 00:44:38,620
how might one use existing authorities

772
00:44:39,460 --> 00:44:42,660
in order to be able to issue policy

773
00:44:43,320 --> 00:44:46,820
and again, move or drive towards advancing, you know,

774
00:44:46,840 --> 00:44:48,120
enhancing or strengthening cybersecurity.

775
00:44:48,740 --> 00:44:54,140
Which is what we did through a lot of our initial policy

776
00:44:56,030 --> 00:45:01,160
documents that start from the pre-market side.

777
00:45:01,400 --> 00:45:05,100
And what we mean by pre-market is manufacturers

778
00:45:05,100 --> 00:45:07,840
within the medical device industry need to come

779
00:45:07,840 --> 00:45:11,020
to the agency with a submission,

780
00:45:11,240 --> 00:45:16,620
with a package of material in which they are provided

781
00:45:16,840 --> 00:45:19,800
with data or evidence that supports

782
00:45:20,370 --> 00:45:22,820
that reasonable assurance of safety and effectiveness.

783
00:45:24,960 --> 00:45:29,100
And in order for that device to be allowed

784
00:45:29,100 --> 00:45:32,020
or what we call authorized to go onto the market,

785
00:45:32,080 --> 00:45:34,540
to be used, to be sold, to be, you know,

786
00:45:36,040 --> 00:45:39,480
enabled by clinicians and by patients,

787
00:45:39,660 --> 00:45:42,380
it has to go through that FDA process.

788
00:45:42,880 --> 00:45:46,580
So back in 2013 and 14, we issued at that,

789
00:45:46,580 --> 00:45:49,080
that very first pre-market guidance,

790
00:45:50,360 --> 00:45:55,380
laying out basic tenants of what we expect manufacturers

791
00:45:55,380 --> 00:45:58,880
to do with respect to security by design.

792
00:46:00,040 --> 00:46:02,280
Again, we don't have the explicit authority.

793
00:46:02,540 --> 00:46:06,140
So what we used were other existing regulations,

794
00:46:06,340 --> 00:46:08,400
the quality system regulation for one,

795
00:46:09,000 --> 00:46:14,200
as a hook, if you will, in terms of manufacturers,

796
00:46:16,580 --> 00:46:19,580
meaning to abide by that existing regulation

797
00:46:19,580 --> 00:46:23,600
in order to meet design controls and other aspects

798
00:46:23,600 --> 00:46:28,580
of security and software that would allow

799
00:46:28,580 --> 00:46:30,600
for those devices to go on the market.

800
00:46:32,030 --> 00:46:34,780
We continued, you know, along in this journey,

801
00:46:34,900 --> 00:46:37,400
a lot of it through, again, meeting with,

802
00:46:37,460 --> 00:46:39,140
engaging with the ecosystem.

803
00:46:39,260 --> 00:46:41,120
A lot of what we've done has been

804
00:46:41,120 --> 00:46:43,880
multi-stakeholder engagement with patients,

805
00:46:44,100 --> 00:46:46,180
with healthcare delivery organizations,

806
00:46:46,180 --> 00:46:48,680
and clinicians, with the independent security

807
00:46:48,680 --> 00:46:51,600
researcher community, and obviously with industry,

808
00:46:51,840 --> 00:46:53,920
medical device manufacturers themselves,

809
00:46:54,140 --> 00:46:58,080
as well as now we have an entire stakeholder group

810
00:46:58,080 --> 00:47:01,200
of third-party security vendors as well.

811
00:47:02,040 --> 00:47:06,180
And in this period of time of really trying

812
00:47:06,180 --> 00:47:10,120
to change the culture within the healthcare sector,

813
00:47:10,280 --> 00:47:14,420
in terms of recognizing that these are emerging threats,

814
00:47:14,840 --> 00:47:16,160
that the healthcare sector,

815
00:47:16,160 --> 00:47:20,400
has a very significant exposed attack surface

816
00:47:20,400 --> 00:47:22,400
that is not being addressed.

817
00:47:22,920 --> 00:47:26,200
And certainly from where we sit in our role

818
00:47:26,200 --> 00:47:27,400
on the medical device side,

819
00:47:27,640 --> 00:47:31,360
this is an area where we need to be having manufacturers

820
00:47:31,790 --> 00:47:35,740
step up to the plate and deal with their, with devices.

821
00:47:37,060 --> 00:47:41,300
So much of what we learned over this period of time,

822
00:47:41,420 --> 00:47:42,880
as we did this engagement,

823
00:47:42,960 --> 00:47:44,580
as we developed these collaborations,

824
00:47:44,580 --> 00:47:48,800
included interactions with other government agencies,

825
00:47:49,260 --> 00:47:52,580
included a lot of, yes, what were voluntary efforts

826
00:47:52,580 --> 00:47:56,020
through prior executive orders and prior administrations,

827
00:47:56,080 --> 00:47:58,960
but these were important in terms of really starting

828
00:47:58,960 --> 00:48:03,520
to again move the needle towards what our expectations were.

829
00:48:04,030 --> 00:48:08,040
In 2016, we released a post-market guidance,

830
00:48:08,220 --> 00:48:14,560
which meant that, yes, while devices as they go on,

831
00:48:14,580 --> 00:48:18,480
onto the market, need to have security built into them,

832
00:48:18,600 --> 00:48:21,260
we know that vulnerabilities are going to emerge

833
00:48:21,260 --> 00:48:23,060
over the life cycle of that device.

834
00:48:23,200 --> 00:48:24,160
They're gonna be identified.

835
00:48:24,680 --> 00:48:27,800
And it's not a one and done once the device

836
00:48:27,800 --> 00:48:28,600
goes on the market,

837
00:48:28,740 --> 00:48:30,940
but what is the manufacturer's responsibility

838
00:48:32,620 --> 00:48:36,000
in keeping that device and maintaining that device

839
00:48:36,000 --> 00:48:38,520
from a risk management, from a cybersecurity perspective,

840
00:48:38,640 --> 00:48:39,960
throughout that life cycle?

841
00:48:41,180 --> 00:48:44,440
Because of a lot of the work that we did with the,

842
00:48:44,580 --> 00:48:48,060
the community, you had things included within our guidance,

843
00:48:48,140 --> 00:48:51,480
such as coordinated vulnerability disclosures,

844
00:48:51,500 --> 00:48:54,480
that we had an expectation that manufacturers

845
00:48:55,000 --> 00:48:56,760
would need to have, first of all,

846
00:48:57,300 --> 00:48:59,540
processes and policy in place

847
00:48:59,540 --> 00:49:04,380
for ingesting vulnerability information that came to them,

848
00:49:04,500 --> 00:49:07,620
regardless of who provided that information,

849
00:49:07,980 --> 00:49:10,480
that they needed to do the necessary assessment

850
00:49:10,480 --> 00:49:13,220
and analysis of that vulnerability to determine

851
00:49:13,220 --> 00:49:16,080
what type of risk was involved.

852
00:49:16,440 --> 00:49:21,740
And if that risk certainly was of a critical nature,

853
00:49:22,020 --> 00:49:23,760
what we called uncontrolled vulnerabilities,

854
00:49:24,200 --> 00:49:28,620
that the manufacturers absolutely need to take action

855
00:49:28,780 --> 00:49:33,980
to reduce that risk through various efforts of remediation.

856
00:49:35,880 --> 00:49:40,140
And to disclose that to the public in a coordinated manner

857
00:49:40,140 --> 00:49:41,460
with FDIC.

858
00:49:43,220 --> 00:49:43,520
So that's what we're trying to do.

859
00:49:43,520 --> 00:49:46,120
And we're working with the FDA with what's now CISA as well,

860
00:49:46,300 --> 00:49:51,260
so that there was really a very aligned effort

861
00:49:51,260 --> 00:49:55,140
towards providing information and reducing the potential

862
00:49:55,140 --> 00:49:59,360
for a crisis of confidence among patients, family members,

863
00:49:59,460 --> 00:50:02,400
who rely on these devices, be it pacemakers,

864
00:50:03,600 --> 00:50:06,940
implantable devices, insulin, infusion pumps,

865
00:50:07,140 --> 00:50:08,620
all of those types of devices,

866
00:50:08,800 --> 00:50:11,860
for which we've also issued over the years, a lot of safety,

867
00:50:11,860 --> 00:50:14,980
communications as well as part of this disclosure process.

868
00:50:17,180 --> 00:50:19,260
So you had the pre-market guidance,

869
00:50:19,380 --> 00:50:20,980
we've had the post-market guidance,

870
00:50:21,180 --> 00:50:26,100
we've also promised all along that this is an evolution

871
00:50:26,100 --> 00:50:27,540
within the healthcare space.

872
00:50:27,840 --> 00:50:29,360
We're going to need to iterate.

873
00:50:29,760 --> 00:50:35,540
What we put out in 2014 or 2016 is not going to be

874
00:50:36,120 --> 00:50:39,080
sufficient to meet the mark of the future,

875
00:50:39,220 --> 00:50:40,580
of the present and the future,

876
00:50:40,640 --> 00:50:41,660
and that we would,

877
00:50:41,860 --> 00:50:45,340
we continue to address where there's a need to really,

878
00:50:45,440 --> 00:50:47,840
again, raise the bar based upon what we were learning.

879
00:50:48,280 --> 00:50:49,500
And so in 2018,

880
00:50:50,040 --> 00:50:53,360
we issued an updated pre-market guidance at the time.

881
00:50:53,520 --> 00:50:57,360
And that, you know, in comparison to the pre-market in 2014,

882
00:50:57,580 --> 00:51:01,360
which was just merely nine pages, just basic foundations,

883
00:51:01,860 --> 00:51:06,120
the 2018 one was somewhere as close to 20 pages.

884
00:51:06,200 --> 00:51:07,800
This is already a lot more meat,

885
00:51:07,860 --> 00:51:11,840
a lot more substance within that, within that guidance.

886
00:51:13,120 --> 00:51:14,680
Here's the thing, you know,

887
00:51:14,700 --> 00:51:18,780
by 2018 from all we were learning and what we were seeing,

888
00:51:19,140 --> 00:51:22,260
it became very clear to us as well that yes,

889
00:51:22,360 --> 00:51:23,240
there are certain,

890
00:51:23,420 --> 00:51:27,140
there's a lot that we can do through guidance.

891
00:51:27,520 --> 00:51:30,920
However, there are certain areas where to really

892
00:51:31,680 --> 00:51:34,520
advance cybersecurity in medical devices,

893
00:51:34,840 --> 00:51:37,440
we were going to need additional authorities,

894
00:51:37,780 --> 00:51:41,360
very specific cybersecurity authorities that we

895
00:51:41,360 --> 00:51:42,780
really did not have.

896
00:51:43,060 --> 00:51:45,440
And we put out what was called

897
00:51:45,440 --> 00:51:47,280
a medical device safety action plan.

898
00:51:47,520 --> 00:51:50,280
And one of those sections in there was focused

899
00:51:50,280 --> 00:51:54,040
on cybersecurity, where we already signaled to the public

900
00:51:54,420 --> 00:51:57,240
that we were considering seeking additional authorities

901
00:51:57,640 --> 00:52:00,360
for medical device cybersecurity.

902
00:52:00,880 --> 00:52:04,520
Included within that was requiring or mandating

903
00:52:04,520 --> 00:52:06,440
coordinated vulnerability disclosure,

904
00:52:06,880 --> 00:52:11,300
mandating a software bill of materials, mandating,

905
00:52:11,300 --> 00:52:11,340
mandating a software bill of materials,

906
00:52:11,360 --> 00:52:14,300
mandating that as part of the pre-market submission

907
00:52:14,800 --> 00:52:17,400
that manufacturers need to submit to the agency,

908
00:52:17,780 --> 00:52:20,540
they need to provide the appropriate evidence

909
00:52:20,540 --> 00:52:24,120
that patching or updating a device that's out there

910
00:52:24,520 --> 00:52:27,060
is going to be safe and not going to affect

911
00:52:27,060 --> 00:52:29,800
the performance of that device.

912
00:52:30,200 --> 00:52:32,840
And while we signaled that in 2018,

913
00:52:33,280 --> 00:52:37,100
we also provided proposals, legislative proposals,

914
00:52:37,260 --> 00:52:40,220
what we call A19s is the common lingo for that,

915
00:52:40,220 --> 00:52:44,280
where we made that case and justification for why,

916
00:52:44,480 --> 00:52:46,620
you know, we've got to close that gap.

917
00:52:46,920 --> 00:52:50,220
It wasn't about taking a regulatory hammer and bluntly,

918
00:52:50,220 --> 00:52:52,820
you know, putting down a request for regulations.

919
00:52:53,060 --> 00:52:56,060
It's really more like carving out with a scalpel,

920
00:52:56,140 --> 00:52:59,020
those specific areas where we're, you know,

921
00:52:59,020 --> 00:53:00,700
we're going to need to drive further

922
00:53:00,700 --> 00:53:04,300
and we need more very specific regulatory authority.

923
00:53:05,380 --> 00:53:09,880
And over the, you know, over the past several years,

924
00:53:10,220 --> 00:53:12,280
we've been pushing and been persistent

925
00:53:12,280 --> 00:53:14,260
in terms of pushing this particular area,

926
00:53:14,400 --> 00:53:18,460
working with many partners on the healthcare provider side

927
00:53:19,140 --> 00:53:21,020
with the security researcher community,

928
00:53:21,240 --> 00:53:25,320
with patients, with others, in order to make that case.

929
00:53:25,820 --> 00:53:27,640
I'm going to, you know, kind of speed up

930
00:53:27,640 --> 00:53:28,880
to where we are at present,

931
00:53:28,940 --> 00:53:33,380
where finally we have received in 2022,

932
00:53:33,740 --> 00:53:38,060
in December, December 29th of 2022, to be specific,

933
00:53:38,320 --> 00:53:39,660
the omnibus.

934
00:53:40,220 --> 00:53:43,820
Which passed and included within it was the patch act,

935
00:53:44,580 --> 00:53:51,180
which provides a multiple provisions requiring manufacturers

936
00:53:51,920 --> 00:53:57,480
in order to abide by a certain key elements

937
00:53:57,480 --> 00:54:04,600
in submitting their pre-market applications to the agency,

938
00:54:04,900 --> 00:54:08,680
as well as the expectation for what they're going to need

939
00:54:08,680 --> 00:54:09,740
to do for the lifetime.

940
00:54:10,220 --> 00:54:10,940
Of that device.

941
00:54:11,800 --> 00:54:14,280
Including coordinated vulnerability disclosure,

942
00:54:15,520 --> 00:54:18,680
policies and processes with a time frame expected

943
00:54:18,860 --> 00:54:21,140
for not merely disclosing,

944
00:54:21,160 --> 00:54:23,720
but patching that vulnerability,

945
00:54:24,800 --> 00:54:26,760
depending upon its criticality.

946
00:54:27,040 --> 00:54:30,120
In addition to that, mandating SBOM,

947
00:54:30,260 --> 00:54:32,580
that manufacturers need to submit the software bill

948
00:54:32,580 --> 00:54:33,840
of materials to the agency.

949
00:54:35,660 --> 00:54:36,420
That,

950
00:54:38,260 --> 00:54:39,780
that statute,

951
00:54:40,220 --> 00:54:46,660
has gone into implementation 90 days later,

952
00:54:46,800 --> 00:54:49,260
which was March 29th of this year.

953
00:54:50,020 --> 00:54:54,740
And at present, so I would say to you that we also issued

954
00:54:54,740 --> 00:54:57,420
what's called a refuse to accept policy guidance

955
00:54:57,420 --> 00:55:01,940
on March 29th, which essentially states that as of October 1st

956
00:55:01,940 --> 00:55:06,400
of this year, we have something called refuse to accept,

957
00:55:06,500 --> 00:55:09,840
which means that if a submission comes in,

958
00:55:09,840 --> 00:55:14,920
to the agency, that does not have the necessary elements

959
00:55:16,840 --> 00:55:20,480
for cyber security required for pre-market review,

960
00:55:20,840 --> 00:55:24,160
then that submission would get immediately rejected

961
00:55:24,320 --> 00:55:27,380
from going into, again, the process of review.

962
00:55:27,740 --> 00:55:31,660
And it returns back to the sponsor, the manufacturer.

963
00:55:34,620 --> 00:55:36,760
It returns back to the manufacturer,

964
00:55:36,900 --> 00:55:39,320
and the manufacturer is going to lose time as a result,

965
00:55:39,840 --> 00:55:42,480
and being able to get that product to the market

966
00:55:42,480 --> 00:55:45,520
until they provide the information for which

967
00:55:45,520 --> 00:55:47,900
that submission is accepted.

968
00:55:49,200 --> 00:55:52,360
We've been working very much interactively

969
00:55:52,800 --> 00:55:56,120
with manufacturers over the years,

970
00:55:56,320 --> 00:55:59,140
and even over this period of time since the statute

971
00:55:59,140 --> 00:56:03,260
has gone into effect, so that they can understand better

972
00:56:03,260 --> 00:56:06,880
what it is that they need to provide to the agency.

973
00:56:07,420 --> 00:56:09,780
But this is a real inflection point for us.

974
00:56:09,840 --> 00:56:15,240
And we're really excited to be at this stage right now.

975
00:56:15,440 --> 00:56:18,360
It doesn't solve all of the problems

976
00:56:18,360 --> 00:56:19,760
with regard to medical devices.

977
00:56:20,120 --> 00:56:23,220
It doesn't directly address legacy,

978
00:56:23,400 --> 00:56:25,140
and we could have a whole separate discussion

979
00:56:25,140 --> 00:56:28,200
around those devices out there that are legacy equipment

980
00:56:28,700 --> 00:56:31,860
for which that's really more of a whole of community

981
00:56:31,860 --> 00:56:33,960
type of an approach towards dealing with,

982
00:56:34,040 --> 00:56:35,060
in addition to FDA.

983
00:56:35,740 --> 00:56:38,620
But certainly with respect to new medical devices

984
00:56:38,620 --> 00:56:44,940
that are going to be going on the market this is a game changer and you know

985
00:56:44,940 --> 00:56:52,680
we're we're very much leaning into this in terms of really making sure that we

986
00:56:52,680 --> 00:56:57,800
capitalize in full upon these new provisions these new authorities that we

987
00:56:57,800 --> 00:57:08,600
were given I'm gonna stop right there and turn it off to you great thank you I

988
00:57:09,400 --> 00:57:12,800
know we've had a lot of new folks come in the room so just reintroducing myself

989
00:57:12,800 --> 00:57:16,920
my name is Lindsay Forson I'm with the National Association of Secretaries of

990
00:57:16,920 --> 00:57:23,120
State I know this is a lot of policy talk for a Friday morning in Vegas and I

991
00:57:23,120 --> 00:57:27,020
know the secretaries have a very specific role and we're in a cyber 101

992
00:57:27,020 --> 00:57:27,780
section and we're in a very specific role in a cyber 101 section and we're in a

993
00:57:27,780 --> 00:57:31,540
cyber policy 101 session so I'm not gonna get too far into the weeds but I

994
00:57:31,540 --> 00:57:36,640
do want to touch on you know who is NASS who are our members what do we do how

995
00:57:36,640 --> 00:57:43,800
they fit kind of within the broader state cyber policy environment and just

996
00:57:43,800 --> 00:57:48,320
you know some priorities of secretaries and what they've been working on in the

997
00:57:48,320 --> 00:57:53,540
cyberspace but I'll get through those things relatively quickly so NASS is a

998
00:57:53,540 --> 00:57:57,660
membership association we we represent the secretaries of state across the

999
00:57:57,660 --> 00:58:02,500
country their profile has increased in recent years as you might know we've

1000
00:58:02,500 --> 00:58:07,580
gone from you know when I tell people what I do they think I work for the US

1001
00:58:07,580 --> 00:58:12,280
State Department to when I tell people what they what I do they want to talk

1002
00:58:12,280 --> 00:58:18,800
election security and so that's been a bit of a transition so secretaries of

1003
00:58:18,800 --> 00:58:23,240
state they're in almost every state in the states where they aren't the other

1004
00:58:23,240 --> 00:58:27,400
position that's closest lieutenant governor may be our member of NASS and

1005
00:58:27,400 --> 00:58:33,560
and often they are they do a lot more than just elections actually as you may

1006
00:58:33,560 --> 00:58:38,040
or may not know every single secretary of state role is a little bit different

1007
00:58:38,040 --> 00:58:42,700
from the other states forty of them serve as their state chief election

1008
00:58:42,700 --> 00:58:48,340
official almost all of them run business what we call business services at NASS

1009
00:58:48,340 --> 00:58:53,100
for their states registering renewing businesses providing resources to small

1010
00:58:53,100 --> 00:58:57,160
businesses those sorts of things a lot of them are

1011
00:58:57,400 --> 00:59:02,060
main record keeper and the archivist is within the secretary's office a lot of

1012
00:59:02,060 --> 00:59:05,800
them do international relations that's our one tie to the US State Department

1013
00:59:05,800 --> 00:59:12,500
but but you know their their roles and responsibilities vary drastically NASS

1014
00:59:12,500 --> 00:59:17,500
our role in the cyberspace and in all the space is to be a liaison between the

1015
00:59:17,500 --> 00:59:22,800
states and and in the federal government or other partners we work very closely

1016
00:59:22,800 --> 00:59:27,160
with CISO we work with them almost every day on you know whatever cyber

1017
00:59:27,400 --> 00:59:32,980
security issues the members are facing or are looking for support from the

1018
00:59:32,980 --> 00:59:36,980
federal government or looking for less support from the federal government we

1019
00:59:37,400 --> 00:59:41,780
also work with FBI cyber and the intelligence community the Election

1020
00:59:41,780 --> 00:59:45,920
Assistance Commission and are kind of that conduit of information sharing

1021
00:59:45,920 --> 00:59:51,100
back and forth we also our main role in what we are the most proud of our work

1022
00:59:51,100 --> 00:59:55,240
is sharing the best ideas and the most

1023
00:59:57,400 --> 01:00:01,280
serious lessons learned across the states with each other and and I think

1024
01:00:01,280 --> 01:00:04,500
that that information sharing role has really increased the collective

1025
01:00:04,500 --> 01:00:10,900
resilience of Secretary of State offices and the election the security of our

1026
01:00:10,900 --> 01:00:14,480
elections in this country just the sharing from Secretary of State office

1027
01:00:14,480 --> 01:00:18,820
to Secretary of State office the building of relationships across their CIOs and

1028
01:00:18,820 --> 01:00:23,700
CISOs and that's really you know the role that is most important to us at NASS

1029
01:00:23,700 --> 01:00:26,820
um so secretaries in most states

1030
01:00:27,400 --> 01:00:31,760
I'm moving on to point number two kind of how they fit in that state cyber

1031
01:00:31,760 --> 01:00:36,880
policy environment first and most importantly probably to this discussion

1032
01:00:36,880 --> 01:00:42,400
they are primarily administrators more so than they are policy makers right

1033
01:00:42,400 --> 01:00:48,460
they work with the state legislature and they sometimes advocate for policy positions

1034
01:00:48,460 --> 01:00:57,020
but ultimately their their role is administering the law and um so so that's an important point

1035
01:00:57,400 --> 01:01:04,180
but in most states the Secretary of State is an independently elected constitutional officer which

1036
01:01:04,180 --> 01:01:09,880
means they don't fall under the governor they are a separate statewide elected official what

1037
01:01:09,880 --> 01:01:16,060
that means is that they have to do a lot of coordination in the state with those who do

1038
01:01:16,060 --> 01:01:20,880
work under the governor right the Homeland Security advisor the office of the state

1039
01:01:20,880 --> 01:01:27,000
chief information officer the emergency management department whatever it may be called in the state

1040
01:01:27,400 --> 01:01:31,920
the National Guard the governor's office uh the state legislature right so there's a lot of

1041
01:01:31,920 --> 01:01:38,020
interest state coordination that secretaries of state do and that role has for them has increased

1042
01:01:38,020 --> 01:01:44,000
dramatically since the 2016 election and uh um designation of elections as critical

1043
01:01:44,000 --> 01:01:52,500
infrastructure in 2017 um and and so I'll just make that point and can address any questions on

1044
01:01:52,500 --> 01:01:57,380
that one later and I'll move on to the third point which is kind of in the cyberspace what have you

1045
01:01:57,400 --> 01:02:05,500
been like major trends for my members and and major priorities um so as you may know election

1046
01:02:05,500 --> 01:02:11,980
administration gets much more complicated than the 50 states run their own elections in that most of

1047
01:02:11,980 --> 01:02:16,740
the administration happens at the local government level so we're talking eight to ten thousand local

1048
01:02:16,740 --> 01:02:23,720
government election jurisdictions and so in the cyber arena a big part of the role of the Secretary

1049
01:02:23,720 --> 01:02:26,520
of State is providing support to those local government

1050
01:02:27,400 --> 01:02:33,160
leaders so in some places municipalities and townships in most places it's counties and so a

1051
01:02:33,810 --> 01:02:38,660
massive push among Secretary of State offices has been establishing what most of them call

1052
01:02:38,660 --> 01:02:44,960
cyber navigator programs where they have they're employing folks at the state level to go out and be

1053
01:02:44,960 --> 01:02:48,980
boots on the grounds in the counties and the municipalities to work with folks to raise their

1054
01:02:48,980 --> 01:02:55,840
um you know their resilience and and part of that effort has been maturing the risk assessment model

1055
01:02:55,840 --> 01:02:57,000
for states

1056
01:02:57,400 --> 01:03:03,740
um you know using actual frameworks that are out there to assess and prioritize risk management for

1057
01:03:03,740 --> 01:03:10,000
the local governments um again usually that just like our relationship with the federal government

1058
01:03:10,000 --> 01:03:18,100
is still largely voluntary on the that's a voluntary information and um support structure with

1059
01:03:18,100 --> 01:03:23,800
states to locals it's generally the same right secretaries of state do not have most of them do not

1060
01:03:23,800 --> 01:03:27,380
have much authority over their local election officials or their local government and so that's a

1061
01:03:27,400 --> 01:03:27,540
very complex environment in which they work but they have you know there are some secretaries who can

1062
01:03:27,540 --> 01:03:30,900
supporting the federal government with their local government and through the cyber navigator

1063
01:03:30,900 --> 01:03:36,080
programs they've really learned that most local election offices get that i.t. and cyber security

1064
01:03:36,080 --> 01:03:41,240
support from somewhere else in the county or municipal government or even from a managed service

1065
01:03:41,240 --> 01:03:48,640
provider and so it's a very complex environment in which they work but they have you know there are

1066
01:03:57,400 --> 01:04:03,420
big move in recent years is to you know type specific requirements very basic

1067
01:04:03,420 --> 01:04:07,540
foundational cyber requirements to federal grant funds for election

1068
01:04:07,540 --> 01:04:12,740
security as they pass them down to local governments besides working with their

1069
01:04:12,740 --> 01:04:19,860
locals other major areas have been cyber incident reporting for for elections

1070
01:04:19,860 --> 01:04:26,300
specifically but a lot of times within broader state laws from you know from

1071
01:04:26,300 --> 01:04:30,780
locals to the state requiring some cyber incident reporting and or from vendors

1072
01:04:31,620 --> 01:04:35,540
imposing or working with their either imposing requirements on their vendors

1073
01:04:35,540 --> 01:04:40,200
through contracts or working with their vendors to come to agreements on things

1074
01:04:40,200 --> 01:04:44,180
like vendors sharing vulnerability assessments vendors establishing

1075
01:04:44,180 --> 01:04:50,660
coordinated vulnerability disclosure policies and things like that and then

1076
01:04:50,660 --> 01:04:56,120
you know the other point that I would say has been a major priority

1077
01:04:56,120 --> 01:04:59,960
and I could go on but I'll stick with this one is kind of maturing the

1078
01:04:59,960 --> 01:05:04,960
cybersecurity teams in the Secretary of State offices and so you know realizing

1079
01:05:04,960 --> 01:05:10,200
that that IT director handling cybersecurity is not working anymore

1080
01:05:10,200 --> 01:05:15,440
it's it's the role is bigger and so you know a lot of a lot of Secretary of

1081
01:05:15,440 --> 01:05:20,060
State offices are hiring CISOs having them be a part of the senior leadership

1082
01:05:20,060 --> 01:05:25,940
team and really building the team under that and I said that was the last one

1083
01:05:26,120 --> 01:05:30,920
but one more and a plug for our later session is just establishing vulnerability

1084
01:05:30,920 --> 01:05:35,340
disclosure policies and working with the hacker community we've come a long way

1085
01:05:35,340 --> 01:05:42,140
we're not quite 10 years into the relationship like on the medical side elections isn't but

1086
01:05:42,140 --> 01:05:49,580
a lot of secretaries have established vulnerability disclosure policies in the last few years not just

1087
01:05:49,580 --> 01:05:53,840
for their election systems but for internet connected systems that are under the control

1088
01:05:53,840 --> 01:05:55,240
of the Secretary of State office

1089
01:05:56,120 --> 01:06:01,100
um and there's a lot there's more definitely thinking about it and working with some people

1090
01:06:01,100 --> 01:06:07,960
in this room and a lot of people in this building to to get to that point um so we've done a lot of

1091
01:06:07,960 --> 01:06:13,980
work at NASS through through our members in in cyber leadership positions to really work to

1092
01:06:13,980 --> 01:06:19,600
build bridges with the hacker community and improve the relationship and I really think

1093
01:06:19,600 --> 01:06:24,400
that my members in many many states are kind of leading the way in state government in terms of

1094
01:06:24,400 --> 01:06:25,260
establishing

1095
01:06:26,120 --> 01:06:33,320
policies and even encouraging the CIO to do the same to follow suit um or you know just just

1096
01:06:33,320 --> 01:06:38,460
working with with building those relationships with the security research community and we're

1097
01:06:38,460 --> 01:06:41,900
going to be talking a little bit more about that this afternoon at five thank you

1098
01:06:44,640 --> 01:06:51,420
all right I'm the last one all right first I'm just going to ask you three questions okay how

1099
01:06:51,420 --> 01:06:53,960
many of you are familiar with CISA

1100
01:06:56,120 --> 01:07:01,940
awesome how many are you familiar with our director Jen easterly and her Rubik's Cube skills

1101
01:07:04,000 --> 01:07:09,580
okay how many of you think you can do a Rubik's Cube and like I don't know in just a couple minutes

1102
01:07:11,020 --> 01:07:16,020
yeah me either I can't I can't do one to save my life so I always when I watch her do it I'm just

1103
01:07:16,020 --> 01:07:21,740
I'm amazed so um and I also want to just acknowledge everyone here on the panel

1104
01:07:21,740 --> 01:07:25,900
um it's it's been really fascinating to hear you and I just I love this idea

1105
01:07:26,120 --> 01:07:32,860
um you know being in government because you see these issues right and you want to try to fix them

1106
01:07:32,860 --> 01:07:38,240
right and and not necessarily in government but other aspects of law and policy and so I just want

1107
01:07:38,240 --> 01:07:43,120
to you know give my appreciation my admiration for you all and especially here in the community

1108
01:07:43,120 --> 01:07:49,100
too for your interests and and you know I just want to thank you so I met CISA I've been there

1109
01:07:49,100 --> 01:07:54,560
for about six or seven months. It's awesome. So if you're ever thinking about joining government,

1110
01:07:54,780 --> 01:08:02,440
please do. We are always hiring. So and if you are interested, I can talk to you after about some

1111
01:08:03,240 --> 01:08:12,100
open positions. So what do we do? We work with our partners to drive down systemic risk too and

1112
01:08:12,100 --> 01:08:17,720
to defend our critical infrastructure. All right. So let's unpack that. There are kind of three main

1113
01:08:17,720 --> 01:08:26,340
things in there. What are the who? The who mostly are our federal civilian branches, right? So we're

1114
01:08:26,340 --> 01:08:33,560
the primary people responsible for protecting that. We work with our state and local tribal

1115
01:08:33,560 --> 01:08:39,600
territorial partners, the private sector as well, and of course, you know, with the general public,

1116
01:08:39,660 --> 01:08:46,200
with you all. How do we do it? Well, there's a number of ways that we organize how we're doing

1117
01:08:46,200 --> 01:08:47,700
it, right? Where we kind of

1118
01:08:47,720 --> 01:08:54,800
get our strategy and authorities and I'll go over that in a second. But right now, our cyber

1119
01:08:54,800 --> 01:09:01,060
strategic plan really is focused on three main things, okay? That's addressing the immediate

1120
01:09:01,060 --> 01:09:07,260
threats, right? So it's kind of like that blocking and tackling and making sure that the

1121
01:09:07,260 --> 01:09:13,280
most immediate threats are stopped, mitigated, prevented, et cetera. Hardening the terrain,

1122
01:09:13,580 --> 01:09:17,700
right? So making it so that, you know, we can't

1123
01:09:17,720 --> 01:09:23,380
get those or attackers really can't get, you know, our critical infrastructure and things like

1124
01:09:23,380 --> 01:09:29,160
that. And finally, driving security at scale. So to Harley's point earlier, remember reporting

1125
01:09:29,160 --> 01:09:34,800
doesn't equal resilience. And we know that. And so as part of the national cyber security

1126
01:09:34,800 --> 01:09:40,540
strategy and that shift and then, you know, the resulting strategies, that's something that we're

1127
01:09:40,540 --> 01:09:46,880
really invested in is making sure that our products, our software, our hardware are secure

1128
01:09:47,720 --> 01:09:52,900
because that is what's really going to drive resilience and security. Things like reporting

1129
01:09:52,900 --> 01:10:00,000
and all the other things are important, they're great, but ultimately it is the security of our

1130
01:10:00,000 --> 01:10:05,340
products that will help us. As well as, I'll put a plug in on the state side, too, especially

1131
01:10:05,340 --> 01:10:11,220
that our emergency management, right? And I'll just give a plug to my former colleague at the

1132
01:10:11,220 --> 01:10:17,240
Belfer Center, Juliette Kayyem, who really talks a lot about resilience and sort of right of

1133
01:10:17,720 --> 01:10:22,680
boom, right? I think the left of boom and the right of boom are so critically important and I

1134
01:10:22,680 --> 01:10:27,640
don't think that we address it enough. I think we're kind of like in the boom, right, a lot.

1135
01:10:27,840 --> 01:10:34,140
We need to go left and we need to go very right, okay? All right. So how do we work with our

1136
01:10:34,140 --> 01:10:41,740
interagency partners? How do we fit in? So think of us as the doers and the advisors. So we get our

1137
01:10:41,740 --> 01:10:47,240
authorities, we get our money from Congress, but then we get our strategic direction from the Office

1138
01:10:47,240 --> 01:10:55,940
of the National Cyber Director, from, you know, we look to the National Security Council, we look

1139
01:10:55,940 --> 01:11:02,960
to, of course, you know, big system for our big strategy, and then, of course, within our division,

1140
01:11:03,100 --> 01:11:09,180
we have our cyber strat plan. We work hand in hand together with the other federal cyber

1141
01:11:09,180 --> 01:11:15,900
executive branch, so we're actually responsible for protecting them. We work together with state

1142
01:11:15,900 --> 01:11:17,180
and local, especially through our

1143
01:11:17,240 --> 01:11:23,760
cyber state advisors. So if you know that CISA actually has 10 regional offices, which is

1144
01:11:23,760 --> 01:11:31,360
awesome, then you may know the cyber security advisors there, the state advisors in each of

1145
01:11:31,360 --> 01:11:36,100
the different states. I believe we're in region nine right now, so I don't know if we have any of

1146
01:11:36,100 --> 01:11:42,660
our region nine colleagues from this area. And then we do a lot of collaboration with

1147
01:11:42,660 --> 01:11:46,860
the interagency, so the State Department, FBI, NSA,

1148
01:11:47,240 --> 01:11:53,480
the intelligence community, Department of Defense to help defend and, of course, collaborate.

1149
01:11:56,760 --> 01:12:03,080
So what are we working on in the next year, right? So I mentioned these three

1150
01:12:03,600 --> 01:12:07,280
major things that we're doing. This is really from our cyber security strategic plan,

1151
01:12:07,500 --> 01:12:13,560
which, of course, flows from the National Cyber Security Plan, as well as CISA's strategic plan,

1152
01:12:13,600 --> 01:12:17,100
as well. But let's talk about what addressing those immediate

1153
01:12:17,240 --> 01:12:22,520
threats are. We want to increase our visibility, and we want to increase our ability to mitigate

1154
01:12:22,520 --> 01:12:29,640
the threats through data collaboration and cyber response and recovery fund.

1155
01:12:31,860 --> 01:12:35,520
I apologize. I'm getting over a cold, so I don't know if I can continue.

1156
01:12:37,720 --> 01:12:43,340
But I will just say hardening the terrain, understanding how the attacks occur,

1157
01:12:44,760 --> 01:12:47,200
and then driving security at scale. The

1158
01:12:47,240 --> 01:12:48,600
last thing I want to talk about is security by design. This is a really important one for me.

1159
01:12:48,720 --> 01:12:54,240
I'm working on secure by design. So Mikayla mentioned this a lot, as well as the open

1160
01:12:54,240 --> 01:13:02,620
source security or software security ecosystem. We are giving a talk tomorrow on secure by design.

1161
01:13:03,160 --> 01:13:08,380
Please come. Please come look at our draft and mark it up. We brought CISA branded red pens

1162
01:13:08,380 --> 01:13:12,340
for you to do so. So we're really excited for you to come and take a look at it.

1163
01:13:23,640 --> 01:13:28,140
Thank you so much. Can we get a round of applause for our panel?

1164
01:13:35,160 --> 01:13:40,340
And we still have a bit of time, I believe, Maryse, right? So if you have any questions,

1165
01:13:40,440 --> 01:13:45,600
we covered a lot of grounds on U.S. policy, and that was the point, right, is U.S. policy 101.

1166
01:13:45,940 --> 01:13:47,220
And so you got to see some of the things that we talked about. So thank you, Maryse,

1167
01:13:47,220 --> 01:13:54,080
for the broad range of things. What do you think? What is left out? What do you want to know more

1168
01:13:54,080 --> 01:14:01,620
about? Please, now is a good time for your questions. And as a reminder, go ahead and

1169
01:14:01,620 --> 01:14:15,260
step up to the mic so that everyone can hear the question. So my question. Oh, no. Oh, no.

1170
01:14:15,980 --> 01:14:17,100
Do I just need to talk?

1171
01:14:17,220 --> 01:14:17,620
Really loud?

1172
01:14:17,700 --> 01:14:19,660
Does that one work? Check, check, check.

1173
01:14:19,900 --> 01:14:24,460
Check, check, check. Anything? I can go over there.

1174
01:14:24,680 --> 01:14:30,580
Okay. Let's start. Go ahead while we're waiting. Oh, well.

1175
01:14:31,280 --> 01:14:36,740
All right. So my question on harmonizing some of the regulations and things like that.

1176
01:14:36,980 --> 01:14:42,800
In higher education specifically, there's a, I would call it a disconnect between

1177
01:14:42,800 --> 01:14:45,980
the research side of things and the education side of things. And

1178
01:14:45,980 --> 01:14:52,920
in the research side of things, we functionally work as a federal contractor for the purposes of

1179
01:14:52,920 --> 01:14:58,780
DOD grants and things like that. And the side of it that deals with educational data and student

1180
01:14:58,780 --> 01:15:04,360
data and things like that is entirely separate. And I know there are talks of changes in

1181
01:15:04,360 --> 01:15:08,620
regulation in that area. I was wondering if you guys could talk a little bit about

1182
01:15:09,340 --> 01:15:15,220
those two areas and the possibility of bringing them together a little more and sort of allowing us

1183
01:15:15,220 --> 01:15:20,440
utilize our efforts in both areas rather than having the research security people

1184
01:15:20,440 --> 01:15:24,940
and the other security people and we like wave at each other across the way.

1185
01:15:26,540 --> 01:15:31,320
Great I can jump in and then if anyone else wants to chime in as well feel free

1186
01:15:31,320 --> 01:15:35,900
to. Really appreciate your question I think it illustrates why regulatory

1187
01:15:35,900 --> 01:15:41,500
harmonization is so challenging because it is sector specific in many cases and

1188
01:15:41,500 --> 01:15:45,480
so academia may be very different than the types of regulatory harmonization

1189
01:15:45,480 --> 01:15:50,500
that's needed in the water sector or utilities. One of the things that we are

1190
01:15:50,500 --> 01:15:54,620
hoping to do with the request for information the RFI is to pull out some

1191
01:15:54,620 --> 01:15:59,240
of those sector specific nuances so that we can say all right we can engage with

1192
01:15:59,240 --> 01:16:05,280
both independent regulators as well as engage on with the sector with private

1193
01:16:05,280 --> 01:16:10,460
sector entities or universities on those particular questions of how do we

1194
01:16:10,460 --> 01:16:11,260
ensure that

1195
01:16:11,260 --> 01:16:17,140
regulation is not conflicting with each other or overlapping or hopefully not

1196
01:16:17,140 --> 01:16:21,620
discordant at all and where the gaps are so I think you mentioned that as well

1197
01:16:21,620 --> 01:16:28,540
sometimes there are gaps and that causes some of the problems I think it's

1198
01:16:28,540 --> 01:16:32,120
very much a part of what we're hoping to do and in the next couple of months

1199
01:16:32,120 --> 01:16:38,820
in the next couple of months the goal is to solicit information from the general

1200
01:16:38,820 --> 01:16:41,100
public solicit information from the Department

1201
01:16:41,100 --> 01:16:48,220
and agencies that we work with and come up with plans to harmonize regulation in

1202
01:16:48,220 --> 01:16:51,700
each of those sectors so happy to talk with you more afterwards as well but

1203
01:16:51,700 --> 01:16:56,400
definitely encourage you to contribute to that process of informing sector

1204
01:16:56,400 --> 01:17:02,900
specific regulatory harmonization. I thought that was a great a great point

1205
01:17:02,900 --> 01:17:05,920
that you raised I had not actually heard about that particular particular

1206
01:17:05,920 --> 01:17:11,080
regulatory quirk but I think it makes absolute sense to one of the things that I think is really important is that we have a lot of

1207
01:17:11,080 --> 01:17:14,960
things that I think we're we're seeing as more organizations are taking on

1208
01:17:14,960 --> 01:17:20,680
cyber security departments like in governments and nonprofits and companies you know we are we want

1209
01:17:20,680 --> 01:17:25,640
to avoid having those cyber security departments siloed I mean really it should be a horizontal

1210
01:17:25,640 --> 01:17:30,480
you know across the organization sort of function and it sounds like what you're describing is the

1211
01:17:30,480 --> 01:17:36,600
separation between that function and the folks that are working with student data which should

1212
01:17:36,600 --> 01:17:40,340
not is not really sustainable right the student data is some of the most valuable assets that our

1213
01:17:41,080 --> 01:17:45,720
students have and so so yes I think I think that's a that's an excellent point to Michaela's

1214
01:17:45,720 --> 01:17:52,280
Michaela's point I would encourage you to to talk with folks about submitting comments on that very

1215
01:17:52,280 --> 01:17:59,920
that very issue to ONCD like that I think we take for granted a lot of times the willingness the

1216
01:17:59,920 --> 01:18:06,960
openness of U.S government agencies to to feedback from from the the population but

1217
01:18:06,960 --> 01:18:10,860
there are formal processes where you can submit comments and and make a difference

1218
01:18:11,080 --> 01:18:16,620
you know and and I I do believe that ONCD will uh will read it and we'll do what they can

1219
01:18:17,500 --> 01:18:23,260
um thank you did you have a follow-up or is it um no I mean that was it that was uh you know we're

1220
01:18:23,260 --> 01:18:29,800
doing CMMC you know for our research things but we're not necessarily doing that for our student

1221
01:18:29,800 --> 01:18:35,940
data at the moment so yeah that was permission thank you it was very thank you all right and

1222
01:18:35,940 --> 01:18:40,580
we had a at least one other question yeah yeah I'll try to give you a brief uh

1223
01:18:41,080 --> 01:18:47,680
I kind of want to do a concern then a question then a compliment if you don't mind so uh coming

1224
01:18:47,680 --> 01:18:54,040
from a technical IR leadership role I feel like my job is going to be increasingly about how I can

1225
01:18:54,040 --> 01:19:00,540
align facts to avoid a material incident so I'd like to ask if you what your honest definition

1226
01:19:00,540 --> 01:19:07,360
would be of a material impact in a generic Enterprise and uh also just a appreciation

1227
01:19:07,700 --> 01:19:09,400
for kind of a thankless job that I think

1228
01:19:11,080 --> 01:19:19,100
we do because it's it's not easy so yeah um I'll start if you don't mind just so the because your

1229
01:19:19,100 --> 01:19:23,020
initial question it sounded like you know you wanted to for those of you that didn't hear it

1230
01:19:23,020 --> 01:19:30,760
sounded like you said part of your job will be to align facts with a foiable uh record of the

1231
01:19:30,760 --> 01:19:37,140
incident right and so is it did I get that right I guess yeah if I could that's your fear street

1232
01:19:37,140 --> 01:19:40,680
terms I guess I mean um I feel like executives

1233
01:19:41,080 --> 01:19:47,140
are going to want us as incident responders to find anything we can to avoid calling something a

1234
01:19:47,140 --> 01:19:51,180
material incident because the SEC says you got four days now as soon as an incident pops off

1235
01:19:51,180 --> 01:19:59,540
you got four days before you got to report it so there's a the law so the the SEC's law or

1236
01:19:59,540 --> 01:20:07,220
regulation is is unique insofar as it will go public um so to be clear the other incident

1237
01:20:07,220 --> 01:20:10,740
reporting regulations that are out there almost all of them are confidential

1238
01:20:11,080 --> 01:20:15,680
um and so for cercia which is a major one for critical infrastructure owners and operators

1239
01:20:15,680 --> 01:20:18,400
and we say critical infrastructure it's a big big chunk to the economy

1240
01:20:18,400 --> 01:20:25,260
um the those are actually are exempt from FOIA and there's a fair amount of anonymization that

1241
01:20:25,260 --> 01:20:29,960
is supposed to take place when you submit an incident to cercia the sec's rule is completely

1242
01:20:29,960 --> 01:20:34,500
different as you know um and and it's public and this is something that the security community

1243
01:20:34,500 --> 01:20:39,120
raised repeatedly with the sec is being potentially problematic but they went ahead with it anyway

1244
01:20:39,120 --> 01:20:40,820
because their mandate is actually

1245
01:20:41,080 --> 01:20:47,620
not to not to enhance security it is to provide information to investors like that is what it is

1246
01:20:47,620 --> 01:20:53,740
um and I think that you have a you raise a good point it is not actually even just about incidents

1247
01:20:53,740 --> 01:20:57,440
it's about your entire security program your entire security posture because those are things

1248
01:20:57,440 --> 01:21:02,920
that have to be disclosed under that same regulation and I think that uh where it will move

1249
01:21:02,920 --> 01:21:08,560
is not to deny facts um you know I think that you you know there's you're going to be releasing it

1250
01:21:08,560 --> 01:21:10,380
publicly there will maybe pressure to

1251
01:21:11,080 --> 01:21:16,760
uh to dress up the the facts in a way that is uh better for public consumption yeah that's it right

1252
01:21:16,760 --> 01:21:21,300
but that doesn't mean that but that doesn't mean being false about it either I think what it means

1253
01:21:21,300 --> 01:21:26,380
is looping in your legal team and your corporate communications team earlier on in the process that

1254
01:21:26,380 --> 01:21:31,220
when you do make that disclosure you're accurate but you also you're clearing you know the the

1255
01:21:31,220 --> 01:21:34,600
message that you want to get out there to the public because now you're playing to a different

1256
01:21:34,600 --> 01:21:40,340
audience than if you were just submitting it to say sisa under cercia okay so I don't I don't think

1257
01:21:41,080 --> 01:21:44,020
that's the right way to do it I think it will be about more cross collaboration with other arms of

1258
01:21:44,020 --> 01:21:48,600
the business yeah okay yeah and if I could just jump in on that I don't know if you guys can hear

1259
01:21:48,600 --> 01:21:55,520
me this idea of secure by design is super important right you can advocate for that

1260
01:21:56,660 --> 01:22:01,960
because if you're the ones who are kind of getting you know not in trouble but you're

1261
01:22:01,960 --> 01:22:08,540
concerned about that again let's shift that burden way way left right to the manufacturers of that

1262
01:22:08,540 --> 01:22:10,900
software that can ensure or

1263
01:22:11,080 --> 01:22:17,000
at least work to you know make these products secure so that you know the the the there's less

1264
01:22:17,000 --> 01:22:23,160
attacks right it makes your job easier so you know let's let's generate that demand as well from

1265
01:22:23,160 --> 01:22:31,780
our vendors if we have time let's do one more question and then end it we have like three people

1266
01:22:31,780 --> 01:22:38,420
that want to talk we can take more questions let's do oh my gosh we have a whole bunch we're gonna

1267
01:22:38,420 --> 01:22:40,060
do this forever go for it

1268
01:22:41,080 --> 01:22:45,960
you know different device types network devices medical devices election devices

1269
01:22:46,580 --> 01:22:55,400
IOT devices have a lot of similar challenges in securing it's wonderful to see the progress

1270
01:22:55,400 --> 01:23:01,060
that's been made in the medical device field over the last ten years how our agency is working

1271
01:23:01,060 --> 01:23:08,680
together to learn from you know overcoming some challenges there what should we expect in the next

1272
01:23:08,680 --> 01:23:11,060
two three years as far as collaboration goes?

1273
01:23:11,080 --> 01:23:19,620
on medical devices specifically? across all device families really we see medical device and election

1274
01:23:19,620 --> 01:23:26,780
device for instance the risks are high in both obviously how are your teams collaborating?

1275
01:23:28,400 --> 01:23:40,780
yeah I think that similarly between the two communities you know when security research starts when the attention shifts to

1276
01:23:40,780 --> 01:23:48,900
your industry it's you know everybody gets a little scared right like nobody knows what it is before before the

1277
01:23:48,900 --> 01:23:55,220
collaboration starts between the security research community and and the manufacturers and the policy folks and the

1278
01:23:55,220 --> 01:24:03,960
implementers and so we've come a long way in terms of that education and building those bridges what I will say is we we do

1279
01:24:03,960 --> 01:24:10,680
want to learn from what works so we engage NASA immediately engaged or not

1280
01:24:10,780 --> 01:24:15,920
immediately but very quickly when when I started at NASA and that was their

1281
01:24:15,920 --> 01:24:21,280
first time bringing on someone with a cyber focus I engaged with I am the

1282
01:24:21,280 --> 01:24:25,560
Calvary because I knew that they had you know we knew their history with the

1283
01:24:25,560 --> 01:24:31,500
medical community and we we Bill Woods is a good friend of mine and we work

1284
01:24:31,500 --> 01:24:35,700
very closely with them we've brought them in to talk you know about success

1285
01:24:35,700 --> 01:24:40,440
stories and we have some NASA folks here whose first stop was the Mount

1286
01:24:40,780 --> 01:24:45,080
Biomedical Hacking village to learn how it looks pretty different from the

1287
01:24:45,080 --> 01:24:49,380
voting village so alright and so there's still ways to go and obviously the

1288
01:24:49,380 --> 01:24:53,500
manufacturers play a big role here and I don't speak on behalf of the

1289
01:24:53,500 --> 01:24:59,300
manufacturers but there is a lot of work being done with them too and so I

1290
01:24:59,300 --> 01:25:04,440
think that we are we've come a long way and we but we recognize that there's

1291
01:25:04,440 --> 01:25:09,100
still a long way to go but to your point we absolutely want to look at those

1292
01:25:09,100 --> 01:25:10,760
success models like like the building models we have because there's a lot of ongoing work that we have to do and also we know there's a lot of like a lot of we don't feel it. So I just wanted to say thank you guys for giving us a chance to like you to be here. I hope that was very, very helpful. So if you have any questions as well, we can actually get to a meeting tomorrow. That's a good way to go but we could have a Q and A. Thank you, bye bye.

1293
01:25:10,780 --> 01:25:18,200
the medical success model and learn from it and try to implement what what is similar right because

1294
01:25:18,200 --> 01:25:23,520
there are some similarities and there are also some key differences i think an important difference

1295
01:25:23,520 --> 01:25:27,820
with medical devices and you heard suzanne schwartz talking about this earlier is that they

1296
01:25:27,820 --> 01:25:34,260
have a specific regulatory authority on cyber security and a lot of we don't have that really

1297
01:25:34,260 --> 01:25:40,260
for just general iot devices in the united states that is changing overseas and we talked a bit

1298
01:25:40,260 --> 01:25:45,500
about the cyber resilience acts there are a few other things that are happening in in europe that

1299
01:25:45,500 --> 01:25:51,720
will i think require secure by design as well as post-market cyber security actions which i think

1300
01:25:51,720 --> 01:25:58,360
will potentially lift all boats you know outside of europe but that is uh that is one key difference

1301
01:25:58,860 --> 01:26:03,480
um the the other i think another thing to point out is the the trust mark that we talked about

1302
01:26:03,480 --> 01:26:07,740
earlier the iot trust mark um i and there was movement in and out of the room so i'm not sure

1303
01:26:07,740 --> 01:26:10,200
if you were here but there is okay so so these this is

1304
01:26:10,260 --> 01:26:14,480
this is one way that i think the the us government is laudably trying to

1305
01:26:15,300 --> 01:26:21,980
extend its coverage to to other iot devices outside of just medical devices to have at least you know

1306
01:26:21,980 --> 01:26:25,820
demonstrate a baseline of security and then to some extent it is going to be up to consumers

1307
01:26:25,820 --> 01:26:30,440
it'll be up to consumers to vote with their wallets and you know show that security matters

1308
01:26:30,440 --> 01:26:38,080
to them and buy the device that has the trust mark yeah and just to jump on that too um we know

1309
01:26:40,480 --> 01:26:46,380
challenges especially in say ot and like those devices right as far as backwards compatibility

1310
01:26:46,680 --> 01:26:54,360
and of course the massive um investment rate that has to last several years so but we know that

1311
01:26:54,360 --> 01:27:00,380
through a lot of engagement with that community and so as part of our secure by design work we are

1312
01:27:00,380 --> 01:27:05,240
engaging with a lot of different manufacturers both on the software and hardware side

1313
01:27:05,960 --> 01:27:10,080
because we want to understand that and of course we also want to understand the consumer side of the

1314
01:27:10,260 --> 01:27:16,020
too right understand those investments and those needs so it's it's you know

1315
01:27:16,020 --> 01:27:18,960
sort of a long journey for this understanding but that's something that

1316
01:27:18,960 --> 01:27:25,420
we are prioritizing we had a couple of other folks that wanted to ask questions

1317
01:27:26,320 --> 01:27:31,180
let's go ahead and get two more questions hey there um thank you guys

1318
01:27:31,180 --> 01:27:36,080
for for holding this panel and I came a little bit late so I apologize that this

1319
01:27:36,080 --> 01:27:41,620
was already covered but I have a question the medical devices and also

1320
01:27:41,620 --> 01:27:46,720
the MSPs that you mentioned for election security are there plans or current

1321
01:27:46,720 --> 01:27:53,680
measures in place to kind of like if you have an MSP who uses a subcontractor or

1322
01:27:53,680 --> 01:27:57,360
another vendor or you have a vendor who uses a vendor who uses a vendor what

1323
01:27:57,360 --> 01:28:04,000
kind of measures are in place to kind of you know make sure that the vendor

1324
01:28:04,000 --> 01:28:05,980
inside the vendor inside the vendor is compliant

1325
01:28:06,080 --> 01:28:10,820
or you know upholding these regulations because what I would be particularly

1326
01:28:10,820 --> 01:28:15,080
concerned about is like kind of a game of telephone where the vendor says yes

1327
01:28:15,080 --> 01:28:18,580
we're compliant the manufacturer just hits that at face value and there's not

1328
01:28:18,580 --> 01:28:20,940
really investigation so can you guys speak to that

1329
01:28:26,680 --> 01:28:31,200
yeah so I think one of the things that we're thinking about on the software

1330
01:28:31,200 --> 01:28:35,160
side is a software liability model that can help address some of those

1331
01:28:35,160 --> 01:28:36,060
challenges that we're facing and I think that's something that we're really

1332
01:28:36,060 --> 01:28:39,180
interested in is the kind of kick the kick the ball kick the can whichever the

1333
01:28:39,180 --> 01:28:46,180
analogy is that we know is a very challenging topic to address both from a

1334
01:28:46,180 --> 01:28:49,760
practical standpoint as well as from a legal standpoint and so that's one of

1335
01:28:49,760 --> 01:28:52,740
the things that's in the national cybersecurity strategy and that we

1336
01:28:52,740 --> 01:28:56,640
anticipate working on for multiple years that's not something that's going to be

1337
01:28:56,640 --> 01:29:01,660
able to be addressed within the next year or so but the intermediary steps

1338
01:29:01,660 --> 01:29:06,040
that we're taking to determine what that model should look like and

1339
01:29:06,060 --> 01:29:11,160
include a lot of engagement with folks who are in this room and in other spaces

1340
01:29:11,160 --> 01:29:17,120
as well to understand what are some of the potential downstream effects if we

1341
01:29:17,120 --> 01:29:18,600
make certain liability shifts

1342
01:29:18,600 --> 01:29:29,400
so just very quickly on that on the MSP side for state and local government so

1343
01:29:29,400 --> 01:29:34,840
there are a lot of state efforts that are happening related to you know what

1344
01:29:34,840 --> 01:29:36,040
requirements should be you know what requirements should be you know what

1345
01:29:36,060 --> 01:29:40,240
for MSPs who work with state or local government I'm not an expert on those by

1346
01:29:40,240 --> 01:29:45,960
any means the one thing I'll say is the Louisiana Secretary of State's Office was

1347
01:29:45,960 --> 01:29:51,400
very involved in that legislative process and now in the implementation

1348
01:29:51,400 --> 01:29:57,920
process for what they did post 2019 ransomware incidents in the state of

1349
01:29:57,920 --> 01:30:02,620
Louisiana that the CIO for Secretary of State of State's office will be on the

1350
01:30:02,620 --> 01:30:05,560
panel later today at five and he's going to talk a little bit about that

1351
01:30:06,060 --> 01:30:29,300
So in most states, the Secretary of State's office wouldn't necessarily be leading the way on that, but what I will add on the local government side, I mentioned a lot of local townships, municipalities, counties work with an MSP, and it's incredibly complex.

1352
01:30:29,300 --> 01:30:45,720
But one thing on the election side that is being done is lowering the risk that you're, you know, what is that MSP doing, right, and what actual risk does that have to the elections, right?

1353
01:30:46,160 --> 01:30:57,700
Often you're coming down to just like IT operations for the county clerk's office or whatever it may be, and certainly there's some risk there, but maybe it's, you know, it's to public-facing websites and things like that.

1354
01:30:57,760 --> 01:30:58,680
It's not to the...

1355
01:30:59,300 --> 01:31:07,080
They're putting things in place to isolate the IT systems on which the election really relies, right?

1356
01:31:07,940 --> 01:31:20,400
Absolutely the actual voting systems, the vote-casting and tabulation systems, but additionally the voter registration systems and those other IT systems that really are integral to the process.

1357
01:31:21,300 --> 01:31:22,120
Thank you all.

1358
01:31:22,200 --> 01:31:22,740
Thank you.

1359
01:31:23,020 --> 01:31:25,040
And I think we have time for one more question.

1360
01:31:25,240 --> 01:31:28,020
Ma'am, in the back, I know you've been coming up to the mic.

1361
01:31:28,260 --> 01:31:29,220
Do you want to do it?

1362
01:31:30,340 --> 01:31:31,220
Yeah, look.

1363
01:31:32,800 --> 01:31:33,320
Okay.

1364
01:31:33,380 --> 01:31:34,160
All righty.

1365
01:31:34,160 --> 01:31:34,560
Thank you.

1366
01:31:35,180 --> 01:31:44,780
So as more regulation gets added, usually the cost of implementation goes up, and a lot of companies either can't afford it, so it pushes a lot of players out of the market.

1367
01:31:45,040 --> 01:31:52,980
So, and it stagnates the velocity which products can get released to the market.

1368
01:31:53,220 --> 01:31:59,280
So I was wondering, and that causes a lot of repetitive work to be done among companies.

1369
01:31:59,300 --> 01:32:02,860
Where everybody needs to have a SOC team, a security team.

1370
01:32:03,040 --> 01:32:18,480
So I was wondering if there's any initiative for a security framework that would allow companies to specialize in each one of those aspects, and standardize security controls in a way that it lowers the barrier to entry for companies.

1371
01:32:20,260 --> 01:32:29,280
I'll take that just to say this idea of baking security in right from the start.

1372
01:32:29,280 --> 01:32:30,000
Then, I can go back to what I said earlier, which is, if you're very familiar with security, you'll see that we've been on the subject of security by design and technology, which is a big part of the design phase.

1373
01:32:30,900 --> 01:32:36,560
We believe, and this is part of our principles of secure by design, is that it needs to be a business decision.

1374
01:32:37,120 --> 01:32:37,560
Right?

1375
01:32:37,860 --> 01:32:53,120
And, you know, we know that there are a lot of different methods, like well-lit paths, for instance, to you know, have certain components that are already done, right, and approved and things like that, and you know, for use in other parts of the product.

1376
01:32:55,020 --> 01:32:59,260
But truly, the business leaders, right, CEO, you know, the CEO, the managing director and the management have all been gonna do business with security by design.

1377
01:32:59,280 --> 01:33:05,960
know and that level are the ones that need to to really push that in their

1378
01:33:05,960 --> 01:33:11,160
company can't just be the security team right or that you know the the technical

1379
01:33:11,160 --> 01:33:18,220
officer or the the CSO right has to be from the top and we know that this is

1380
01:33:18,220 --> 01:33:28,860
going to be a shift because you know that that decision you know might be

1381
01:33:28,860 --> 01:33:33,460
relatively new somewhat novel but we think too it's very much like quality

1382
01:33:33,460 --> 01:33:37,820
right and again we know that that is a business decision that comes from the

1383
01:33:37,820 --> 01:33:44,080
top as well so something just the one last thing that'll add that the the

1384
01:33:44,080 --> 01:33:47,740
point of regulatory harmonization is to actually streamline things and hopefully

1385
01:33:47,740 --> 01:33:48,020
reduce

1386
01:33:48,220 --> 01:33:53,120
costs like that that goal is part of the RFI that we've put out on regulatory

1387
01:33:53,120 --> 01:33:58,960
harmonization so that we don't have conflicting regulators where you are

1388
01:33:58,960 --> 01:34:03,360
having to comply with one over here and then do the exact same process spend a

1389
01:34:03,360 --> 01:34:05,840
lot of money do the exact same thing over here for a different regulator

1390
01:34:06,560 --> 01:34:09,820
reciprocity is a big part of that and so hopefully getting to a point where

1391
01:34:09,820 --> 01:34:14,680
regulators will accept the results of an assessment on one hand and the other

1392
01:34:14,680 --> 01:34:18,080
regulator on the other hand will also be able to accept that the the goal of

1393
01:34:18,080 --> 01:34:24,160
that is to reduce costs instead of increase them and with that let's go

1394
01:34:24,160 --> 01:34:27,480
ahead and please thank our panelists I think it's been very informative and

1395
01:34:27,480 --> 01:34:33,340
please do also scan the QR code leave your feedback I promise it is not a

1396
01:34:33,340 --> 01:34:38,900
rickroll but you know it's also DEF CON so you got to be a little bit careful

1397
01:34:38,900 --> 01:34:40,880
with the QR codes you're scanning thank you