WEBVTT 00:00.000 --> 00:07.940 Our fourth presentation is a duo from the Office of the National Cyber Director at the White House, and here I thought I had a good office with a view. 00:07.940 --> 00:11.040 Our presenters are Tanya Sims and Lauren Williams. 00:11.060 --> 00:14.320 Tanya is the Director for Cyber Policy and Programs. 00:14.340 --> 00:17.780 Lauren is the Senior Advisor of Strategy and Research. 00:17.780 --> 00:29.760 Together, they will be speaking about how current and emerging threats to the space ecosystem is front and center as an area of intense innovation and growth across civil, military, and commercial sectors. 00:29.900 --> 00:36.640 They will speak to the current gaps in today's policies and offer ways for the audience to get engaged in change. 00:36.760 --> 00:41.580 To start that engagement, please give a round of applause to Tanya and Lauren. 00:45.310 --> 00:47.670 So, hi, good afternoon everyone. 00:47.670 --> 00:49.290 My name is Tanya Sims. 00:49.370 --> 00:58.910 As that wonderful, I think, AI voice just said, I'm the Director for Cyber Policy and Programs within the Office of the National Cyber Director at the White House. 00:58.910 --> 01:15.070 My role there is really to focus on how our nation is governed on critical infrastructure-related policies and programs, and space, of course, is no exception to that. 01:15.830 --> 01:30.050 And hi everyone, again, I'm Lauren Williams, also with the White House Office of the National Cyber Director, and my focus and prioritization in our team at ONCD has been on space and cybersecurity as both a policy and a strategy imperative. 01:30.050 --> 01:35.790 And so we're looking forward to talking to you as we go forward about the de-prioritization that we placed on that issue. 01:36.090 --> 01:37.050 Next slide. 01:37.290 --> 01:50.290 All right, so to start, we want to situate the broader issue of space and cybersecurity into the Biden-Harris administration in particular's broader strategic objectives and broader prioritization related to cybersecurity. 01:50.690 --> 02:01.370 So, may or may not be news to you all, but the administration released its most recent cybersecurity strategy, national cybersecurity strategy, in March of 2023. 02:01.530 --> 02:16.030 And this document notably lays the foundation for what we most care about as an administration when it comes to cybersecurity prioritization writ large, and that is working toward a defensible, resilient, and values-aligned digital ecosystem. 02:16.030 --> 02:32.350 And there are five key pillars of that strategy, which focus on defending critical infrastructure, disrupting and dismantling threat actors, shaping market forces to drive security and resilience, investing in that resilient future, and then last but not least, 02:32.350 --> 02:36.770 focusing on how we can leverage shared international partnerships to achieve those goals. 02:37.090 --> 02:48.810 And our objective here is very much to tie these broad principles into everything that we do within ONCD, including to tackle very tangible challenges like cybersecurity for space systems. 02:49.350 --> 02:57.750 And so, all of you may be thinking, right, strategies, a lot of really awesome keywords. 02:58.150 --> 03:12.270 So, really what good is a strategy without some accountability, as well as some implementation prongs to make sure that different government agencies are following through on the commitments that we set forth in the strategy. 03:12.270 --> 03:18.650 And so, we recently issued the implementation plan to tack on to the strategy. 03:18.650 --> 03:37.590 And I would say that this is probably the first time that the White House has done something like this, where we are actually saying, hey, these government agencies are accountable for 69 different actual measures within the strategy to make sure that we can actually track progress and follow through. 03:37.630 --> 03:39.750 And we actually tasked ourselves. 03:39.750 --> 03:43.450 We tasked ourselves with 14 of those measures. 03:43.450 --> 03:48.190 And I think that's also the first time the White House tasked ourselves to do something. 03:48.190 --> 04:05.510 But all of this to say is that even in forecasting what would be the implementation plan, and really holding ourselves accountable, right, we started convening with private industry, as well as different government leaders in the most White House way at the White House. 04:05.670 --> 04:27.190 And earlier in March, we gathered a lot of the top executives within the industry and brought together a lot of govies to the White House to talk about some current threats, really contextualizing why cybersecurity needed to be important for them in the context of the entire product life cycle. 04:27.510 --> 04:28.510 Sorry. 04:28.710 --> 04:30.530 Closer to my mouth. 04:30.530 --> 04:31.330 Okay. 04:31.850 --> 04:35.950 And Lauren and I, we love these slides. 04:35.950 --> 04:37.010 We're in the arrow. 04:37.010 --> 04:46.710 It's the red arrow in the corner, really talking and hearing about, you know, what are really the perspectives from industry leaders, right? 04:46.710 --> 04:53.030 All of you are practitioners, but how do your CEOs, right, think about cybersecurity? 04:53.030 --> 04:54.770 Are they even thinking about cybersecurity? 04:54.770 --> 04:57.310 How do we make this relevant for them? 04:57.310 --> 05:06.450 And so this was something that really kicked off our approach to focusing on space policy directive five. 05:06.450 --> 05:12.630 I mean, it may surprise you to find out that really this is something that was released in September 2020. 05:12.630 --> 05:18.710 It's still the current national policy when it comes to space system cybersecurity for the U.S. 05:18.830 --> 05:30.290 And it's, you know, three years old to say the least, but also it provides a really nice sounding list of principles. 05:30.290 --> 05:34.730 We can't say that this is not our current policy and we don't approve it. 05:34.730 --> 05:42.170 We have to approve it because it is our current policy, but it is a set of very nice sounding principles. 05:42.490 --> 05:43.530 Lauren? 05:43.530 --> 05:48.210 And they're essentially what are listed on the slide here. 05:48.210 --> 05:52.190 They are to, oh, one more. 05:52.830 --> 05:53.710 Thanks. 05:53.710 --> 06:10.050 They are to, you know, directing both private sector and government operators to use risk-based cybersecurity form engineering, to have integrated cybersecurity plans, to leverage, you know, widely adopted best practices without defining what those best practices are, 06:10.050 --> 06:22.670 to collaborate, you know, across the public and private sector, to promote development of best practices and mitigations, and then finally to design space systems to be effective and able to manage risks. 06:22.670 --> 06:37.610 And, of course, these are the objectives that we should be working toward, but what is lacking, at least in the existing policy, are tangible, specific guidelines and steps for both the private sector and for the government owners and operators to actually implement those principles. 06:38.150 --> 06:55.650 And then finally, I would note that going back to the national cybersecurity strategy, it does reinforce the importance of upholding the current national cybersecurity policy, SPD 5, but what our task within our office has been is to think about how we can build on it. 06:55.650 --> 06:56.090 Yeah. 06:56.290 --> 07:02.750 And also, if I didn't emphasize this before, there's only one policy right now, and that policy is three years old. 07:02.790 --> 07:23.610 But the benefit of it is that it really does call on government to reach out and collaborate and work with private industry, wherever they may be, to make sure that there can be sort of a set of best practices, a set of standards that can be developed that further adds to the implementation. 07:23.750 --> 07:26.770 Those steps are essentially what we're focused on. 07:28.070 --> 07:29.370 Next slide. 07:30.130 --> 07:30.670 All right. 07:30.670 --> 07:33.790 And so this similarly will not surprise any of you. 07:33.790 --> 07:50.450 It won't be new to this audience, that the space domain and the space landscape, the exponential growth of the commercial space sector is continuing to grow, and the importance of private sector to driving that the growth of this ecosystem, including in relation to, 07:50.450 --> 08:06.950 as you can see there, kind of your traditional government, civil and military operators like NASA or DOD, the uses of space in that traditional sense are vastly dwarfed by the commercial space ecosystem and the growth there. 08:07.250 --> 08:20.550 And so when we think about what might be necessary if we're thinking about what comes beyond Space Policy Directive 5 as of several years ago, we're thinking about this landscape and the fact that there has been rapid change in the last several years, 08:20.550 --> 08:22.310 and policy should keep up with that. 08:22.910 --> 08:38.430 Yeah, so I mean, even when it comes to nation states like China and Russia, right, their commercial space fleets or dual purpose space fleets, they've grown from 2019 to 2021 by 70%. 08:38.430 --> 08:51.830 And so even from that context, right, it's not that we just want to outpace other countries or adversaries, it's simply a feature of how quickly the market is growing. 08:51.830 --> 09:02.330 And then even when we talk about sort of, aside from those growth areas, right, we're just talking about a large number of assets in orbit. 09:02.330 --> 09:11.410 It's not just that space is getting overcrowded, our orbits, when we talk about LEO, MEO, GEO, right, those orbits are getting overcrowded. 09:11.410 --> 09:21.530 And so it's not just an issue from an adversary or a threat perspective, it's literally a physical and a cybersecurity issue at the same time. 09:21.530 --> 09:35.810 We have companies like SpaceX, their Starlink fleets, right, that they have an incredible mission and they are launching 50 assets up into space in just one rocket. 09:35.810 --> 09:43.850 That's a significant number and that's why we see sort of that exponential growth of just how crowded our orbits are getting. 09:43.870 --> 10:03.070 And then when you think about even the market for embedded systems, right, and the space assets absolutely use embedded systems like secure bus or encryption, those are the types of things where I think In-Q-Tel recently released a finding where that market is expected to explode up to seven billion dollars a year, 10:03.070 --> 10:06.170 and a portion of that is of course going to the space industry. 10:06.170 --> 10:17.010 And so just from that perspective, what we're talking about also is that there's a large proliferation of satellites in low earth orbit. 10:17.010 --> 10:22.970 We're not even talking about the development of human spaceflight vehicles, we're just simply talking about satellites. 10:22.970 --> 10:31.850 And we see in the slide there, there's, you know, roughly 60 percent of all of our active payloads in space are in low earth orbit. 10:31.950 --> 10:53.810 And that means, I mean, it's important for us from a cybersecurity perspective because LEO satellites are also the ones that are going to be the most interconnected, they're also the ones that are going to be largest in number, and that means a larger attack surface and potential for collision is absolutely something that we care about. 10:54.250 --> 11:09.850 And so kind of thinking about this broad growth of and change and exponential kind of increase of commercial space activity as well as government activity over the last several years , it obviously creates a lot of opportunities in the ways that we've described, 11:09.850 --> 11:13.810 but we have to also think at the same time about the risks and the threats. 11:14.230 --> 11:30.790 And Odi, in the Office of the Director for National Intelligence, in that open source document mentioned there, very much highlights kind of the increased focus from threat actors, from nation-state actors on using offensive cyber capabilities against space assets. 11:30.790 --> 11:34.550 And so that risk obviously has been underscored by multiple U.S. 11:34.550 --> 11:52.790 government advisories, including several of the, you know, Department of Homeland Security, CISA advisories about routinely exported vulnerabilities related to kind of commonly used operating systems that we use across space systems as well as everything else that we do in our companies and in our government, 11:52.790 --> 11:53.830 you know, activities. 11:54.090 --> 12:09.050 As well as it's highlighted by a wide range of independent as well as think tank and academic research that highlights the threats that are currently affecting the space ecosystem from a cyber perspective. 12:10.910 --> 12:15.770 And with that, we will further kind of complicate this picture. 12:15.770 --> 12:23.130 We're talking about the change in the landscape, the threat environment, the increasing kind of attack surface and attack vector. 12:23.490 --> 12:36.290 And then from our point of view at the White House, we are very much focused on what we can do and where we fit in as the White House Office of National Cyber Director within the national policy landscape, which looks a little bit like this. 12:36.310 --> 12:39.450 And if you're overwhelmed by it, that's where we started our journey. 12:39.450 --> 12:40.690 This is a simplified version. 12:40.690 --> 12:41.450 Yes. 12:42.010 --> 12:51.410 And so what we want to say here and what we want to show through this slide is that, and this is actually just focused on the executive branch policy landscape. 12:51.530 --> 12:57.790 So a little bit kind of very much focused from our lens of how we're thinking about policy development. 12:57.790 --> 13:10.650 There are major players, including the National Security Council, our office, the National Cyber Director, National Space Council, who we very much partner with along this journey, the Office of Science and Technology Policy, the Office of Management and Budget. 13:10.650 --> 13:30.730 And each one of these kind of White House elements operate or kind of owns a different piece of the policy process that plays a role in developing, in particular, national cybersecurity policy, and then kind of narrowing down that lens to a focus on cybersecurity policies that are relevant and apply to the space ecosystem. 13:30.730 --> 13:34.610 So I'd note there in that kind of second tier of interagency U.S. 13:34.610 --> 13:49.190 government departments and agencies, that's about 30, 40, 30 plus agencies that not only play a role in operating space systems, but the majority are more so government agencies that utilize and or rely on space-based services. 13:49.190 --> 13:59.210 And so that kind of gets you a much broader scope of agencies that are implicated when we think about what cybersecurity and ensuring resilient and secure space systems means for the broader U.S. 13:59.210 --> 13:59.870 government. 14:00.090 --> 14:09.590 Yeah, and just to expand on a couple examples, I know we've been talking about SPD-5, but based on this chart, right, we really wanted to show you how that actually came about. 14:09.990 --> 14:23.590 So you had two elements of the National Security Council come together, along with the National Space Council, and maybe a little bit of input from the Office of Science and Technology Policy, right? 14:23.590 --> 14:27.050 I mean, there are 17 different policy arms within the White House. 14:27.050 --> 14:28.830 These are just three of them. 14:28.830 --> 14:37.690 But these elements came together to really develop and work with the interagency, the federal interagency, to come out with SPD-5. 14:38.110 --> 14:55.530 And so the ones circled in red are supposed to be ones that touch on cybersecurity and have some type of relevance for space systems, with arguably the only one in that list that is directly relevant to space systems as SPD-5, right? 14:55.530 --> 15:14.730 SPD-7 is on PNT, and the only section within SPD-7 that touches on cybersecurity is the recommendation that governments and private sectors should have cybersecure GPS, which is a really good general-level, right, principle to follow. 15:14.730 --> 15:15.670 What does that really mean? 15:15.670 --> 15:17.230 It doesn't get into it. 15:17.310 --> 15:33.930 Other things are Executive Order 14028, Improving the Nation's Critical Infrastructure, which is really a reflection of the importance of increasing sort of the growing importance of the commercial sector for different types of critical infrastructure. 15:33.930 --> 15:40.690 We have, you know, 16 different critical infrastructure sectors, and each of them with a growing commercial nexus. 15:40.690 --> 15:50.850 14028 calls on things like everybody should have sort of zero-trust architecture or principles in mind when developing their network architectures. 15:50.850 --> 15:58.730 They should have encryption, they should have incident response plans and incident planning measures in place. 15:58.970 --> 16:11.840 13905 also again touches on PNT to the extent that there should be some additional government and private sector collaboration. 16:14.240 --> 16:29.620 13636 is the one that provides sort of NIST, the directive, the National Institute for Standards and Technology, the directive to come out with a cybersecurity framework for mostly critical infrastructure sector owners and operators. 16:29.620 --> 16:45.900 And so this is just highlighting a couple of the national-level policies in place that should help critical infrastructure owners and operators, noting that when it comes to space system cybersecurity, again, it's really only SPD5. 16:46.740 --> 16:48.840 And so with that... 16:48.840 --> 17:00.720 To further complicate the landscape here, I think what we would say is that if the policy environment that we noted on the previous slide is not complex enough, then the U.S. 17:00.720 --> 17:11.700 government-only standards and requirements landscape is even more complex across commercial, federal, and an integrated kind of batch of requirements. 17:11.700 --> 17:28.460 Yeah, so these are again a snapshot of some of the relevant standards and guidelines that are out there that the space systems community can rely on or leverage voluntarily. 17:28.460 --> 17:34.080 And so this does not cover your international standards for IT systems. 17:34.080 --> 17:40.980 This does not cover every single government entity that has ever developed a directive or something like that. 17:40.980 --> 17:46.760 This also does not cover every single standard or guideline that touches on IT or OT security. 17:46.760 --> 17:55.440 But these are sort of a very, I think in our opinion, a complicated web, a snapshot of the ones that would be the most relevant. 17:55.620 --> 18:14.540 And so in terms of for the applicability to different segments of space, so we're thinking ground, link, user, space, there just isn't one that touches on every single segment, right? 18:14.540 --> 18:29.980 And so with those specifics in mind... Yeah, so I think that that is, we'll talk a little bit later about some of the work that we've been doing in terms of outreach to industry and listening to how our private sector partners in particular perceive this web of standards. 18:30.260 --> 18:48.760 But in particular, what we have taken away from those conversations is that a lot of these standards, which I'll touch on a couple of them, are applicable to kind of broader information security requirements and, you know, protection of kind of controlled information, 18:48.760 --> 18:52.880 but not specifically tailored to the space systems environment. 18:52.900 --> 19:01.000 And that's really a challenge when we're thinking about the differences and how we should think about securing space systems as opposed to kind of terrestrial and other sorts. 19:01.320 --> 19:18.780 And so a couple of requirements that we would flag, just maybe starting from the commercial side of the house, might be, you know, NIST standard SP 800-171, which is derived from, on the other side, the federal requirement for, you know, NIST SP 800-53. 19:19.200 --> 19:26.980 But that sort of crosswalking takes place in kind of the context of NIST standards, which are voluntary requirements. 19:27.320 --> 19:35.520 And then as Tanya noted there, there's kind of a few specific standards that apply, specifically apply to the space systems environment. 19:35.520 --> 19:49.500 And one of them, and actually recently released, and we would highlight for this audience, is NIST interagency report 82-70, which is, which applies the cybersecurity framework to satellite operations. 19:49.580 --> 19:53.240 And so that's a specific requirement that focuses on space systems. 19:53.240 --> 20:03.540 But many of the others, especially I would say on the federal government side of the house, are much more tailored broadly to information security. 20:03.560 --> 20:24.540 And so, again, to the element of kind of complication, I won't confuse us all by going into the specific weeds, but just for one example, CNSSI 12-53, which is a federal standard, includes 389 controls, which are cybersecurity controls, compared to, on the other side, 20:24.540 --> 20:29.760 NIST 800-53, which includes 262 controls. 20:30.080 --> 20:46.600 And further to some of the questions and conversations that we've had with our private sector partners, it would take, it has taken us kind of a binder about, you know, this thick, to kind of read through and understand this landscape here, much less for our private sector partners, 20:46.600 --> 21:11.520 who honestly have to invest resources, have to invest in, you know, personnel and man and woman power to kind of apply, understand this complex compliance environment, which in many cases takes away from kind of the tradeoff between actually being able to think about how to address the specific risks by trying to understand how to comply with the complex landscape. 21:11.520 --> 21:14.440 So that's what we would leave you with from this slide. 21:14.440 --> 21:15.460 All right. 21:15.460 --> 21:29.140 So maybe transitioning into what we've been doing, in particular, Tanya and I, and another member of our team, Anjana and the audience there, we have been traveling around the country for the last, ever since that executive forum that took place in March, 21:29.800 --> 21:32.580 which was a kind of CEO-level event. 21:32.580 --> 21:44.440 But we immediately realized, or we immediately took the parallel approach of engaging with working-level, kind of on-the-ground technical experts who were thinking about these issues on a daily basis. 21:44.440 --> 21:46.240 And so we have been on a roadshow. 21:46.240 --> 22:01.220 We started off in California at the end of April, where we, the companies there were primarily sort of your, you know, California startup, very kind of cutting-edge companies. 22:01.220 --> 22:04.900 And we went to, we held an event at the White House in Washington in June. 22:05.040 --> 22:08.300 We held an event at the Kennedy Space Center later in June. 22:08.300 --> 22:09.600 We went to Colorado Springs. 22:09.600 --> 22:10.480 We were at U.S. 22:10.480 --> 22:12.720 Space Command a couple weeks ago. 22:12.760 --> 22:16.920 We held an international engagement with international companies just this week. 22:16.920 --> 22:25.740 We will go to Texas and Houston, should any of you be in the area and like to participate in our conversations there, later this week. 22:25.760 --> 22:27.920 And that has led us to a total number of... 22:27.920 --> 22:31.500 Yeah, so just a couple things to flag here, right? 22:31.600 --> 22:36.360 The numbers have been updated a little bit from when we submitted these slides. 22:36.360 --> 22:48.180 So the international workshop that we held earlier this week had, you know, roughly 55 participants total in a hybrid sort of virtual in-person environment. 22:48.180 --> 23:01.040 We had multiple different international space agency equivalents, as well as some of their regulating entities and different industry representatives as well. 23:01.040 --> 23:08.300 And total participants so far, right, that makes it about 260 across sort of U.S. 23:08.300 --> 23:12.180 industry, international industry, U.S. 23:12.180 --> 23:26.320 government agencies, international space-related agencies, and including sort of your information sharing and analysis organizations, as well as different industry associations. 23:26.320 --> 23:28.980 So it's been sort of a wild ride so far. 23:28.980 --> 23:33.260 And then we are sort of going to end all of this in Texas. 23:33.600 --> 23:47.900 And I think maybe the other point to make here is that what the fact that we have been kind of investing our, you know, White House resources, time, and energy in traveling around to hubs of space industry across the country and listening, very much listening to our private sector partners, 23:47.900 --> 24:02.120 I think speaks for us, speaks to the fact that you can't think about securing the space ecosystem, especially in the United States and as well as abroad, without having a private sector-first informed approach. 24:02.120 --> 24:05.200 And that's what we're going to look to take back into the U.S. 24:05.200 --> 24:07.260 government internal sort of policy process. 24:07.420 --> 24:07.700 Yeah. 24:07.700 --> 24:12.860 And so to close out this part of the slide, right, or the presentation, what have we learned? 24:12.860 --> 24:14.240 What are our key takeaways? 24:14.240 --> 24:19.520 So far, we talked to small, medium, and large-sized companies. 24:19.740 --> 24:32.840 And really, one of our first key takeaways is when it comes to cybersecurity by design, how are these different-sized companies thinking about baking in cybersecurity by design through each aspect of the product life cycle? 24:32.920 --> 24:47.500 And what we're getting is that people all have different, no matter what the size is, even large company to large company, medium to medium, small to small, right, they're not going to have a same set of opinions in terms of what standards, what guidelines, 24:47.500 --> 24:51.500 what best practices to even follow, right? 24:51.500 --> 24:56.460 There is a missing sort of standard baseline there that everybody can agree on. 24:56.460 --> 24:59.140 And then the second, right, is about resourcing. 24:59.140 --> 25:04.600 Resourcing not just from a monetary challenge, but also from a people perspective, right? 25:04.600 --> 25:15.940 We talk often about the fact that this is a community where it's traditionally been aerospace engineers and then cybersecurity or network engineers and the like, right? 25:15.940 --> 25:18.760 And so those two have not traditionally talked. 25:18.760 --> 25:29.060 And then what we're saying right now is that your rocket scientists need to also appreciate cybersecurity or have at least an understanding of the risks and the threats associated. 25:29.080 --> 25:34.340 And the cybersecurity folks need to understand some of the priorities from the engineering side. 25:34.340 --> 25:37.920 And so there's a resourcing challenge in terms of how do you even find these people, right? 25:37.920 --> 25:40.260 Where are these pink unicorns? 25:40.320 --> 25:43.120 And we don't really know where they are, right? 25:43.120 --> 25:45.140 The government agencies are struggling. 25:45.140 --> 25:46.480 Private industry is struggling. 25:46.480 --> 25:49.580 And so this is a huge resourcing challenge. 25:49.580 --> 26:05.500 And this is, I think, why in terms of what we've done, what ONCD has done earlier, right, in issuing the National Cybersecurity Workforce Strategy is really imperative in that these conversations are going to be flushed out further in terms of how do we create incentives? 26:05.500 --> 26:13.240 How do we create mechanisms that helps alleviate some of the stress of just finding people to do the work? 26:14.120 --> 26:18.540 And then I think there were a couple other key takeaways, right? 26:18.540 --> 26:25.400 The next one being differences in sort of contractual language that industry is faced with. 26:25.400 --> 26:34.500 So when you think about companies that want to do business with the government, a lot of the requirements that they have to follow comes from contracts. 26:34.500 --> 26:44.900 And so from those contracts, there may be cybersecurity requirements that are not complete or are limited in scope or not actually applicable to space systems. 26:44.900 --> 26:59.400 And so that gets us back to the issue of the lack of standards, the lack of applicable standards in the earlier slide for different aspects of the space ecosystem that is highly complex and very segmented. 26:59.400 --> 27:03.600 Yeah, maybe last but definitely not least because we have learned so much from these conversations. 27:03.600 --> 27:15.320 We've had very lively conversations related to information sharing and specifically whether or not that is being done well in a kind of bi-directional manner from the federal government to the private sector. 27:15.320 --> 27:23.540 And when we receive information from the private sector, is it coming back in a way that allows the private sector to be able to address the threats that they're facing? 27:24.000 --> 27:36.900 And also have heard generally that that information from the federal government in particular is not always actionable or in kind of less cases than we would like as government officials, it is not actionable. 27:36.900 --> 27:41.040 And so that's another key takeaway that we are taking from this conversation. 27:41.040 --> 27:48.940 So how to get involved now that we've talked about how what we're doing, how do you actually get to help? 27:48.940 --> 27:56.660 And so we actually have two things on here, not just one, but the first that we'll touch on is regulatory harmonization. 27:56.660 --> 28:20.580 So we recently issued a request for comments or request for information from the public on different types of regulation that might be impacting their companies or their organizations and how do we actually harmonize some of what may be perceived to be competing or contradictory regulations. 28:20.620 --> 28:30.820 And so for the space community, right, why this is relevant, right, space is not yet designated as a critical infrastructure sector formally within the U.S. 28:30.820 --> 28:42.600 However, even when you're talking about some companies that have a global footprint, right, you're talking about a lack of standards or regulations within the U.S., but then you may have certain companies like the U.K. 28:42.600 --> 28:43.820 or even the E.U. 28:43.820 --> 28:48.060 that have designated space as a critical infrastructure sector. 28:48.060 --> 28:59.360 And so how are the regulations that even companies are following internationally contradicting with some of the standards or guidelines that companies need to follow in the U.S. 28:59.360 --> 29:02.180 and what is the delta there, as a perfect example. 29:02.180 --> 29:13.760 The second one is really just to better understand what are the standards and frameworks that you all are following and really just a listing of them so that we can add them to that really complicated chart that we showed you earlier. 29:13.760 --> 29:25.740 But it's really just to figure out what mechanisms are you all using when it comes to making sure that you are following with regulations or lack thereof, right. 29:25.740 --> 29:37.900 And then also to touch on that, right, even when your specific space assets in the development of them, you might leverage cloud services. 29:37.900 --> 29:58.720 And so cloud is not a regulated sort of type of service within the information technology sector, but many of you that touch on cloud or use cloud services may be a regulated entity because you touch on other or you provide services to another critical infrastructure sector that actually is regulated. 29:58.720 --> 30:17.920 And so in that sense, when we think about cloud as 65% of cloud or tax against cloud is from misconfigurations, right, it's something where we definitely want to hear from the community in terms of how is this impacting you, how do you view this issue, 30:17.920 --> 30:32.280 are there competing sort of requirements or regulations or standards that you all are thinking, well, this applies to my work here for this sector, but it doesn't necessarily translate over to my work or my product in this space sector. 30:32.600 --> 30:47.480 And then last but not least, and so hot off the presses that it is not on this slide, ONCD also recently released an RFI related to open source software, and our colleague Anjana and I see others who are involved in the development of that are here today, 30:47.480 --> 31:13.790 and we have further had very lively debates in our conversations with commercial space operators about, you know, what the federal government guidance and our prioritization of utilizing memory safe software languages in everything that we do, what that means for the space ecosystem. 31:13.790 --> 31:20.310 And so that makes it very exciting for us here today to announce that we have an RFI that is open. 31:20.310 --> 31:29.890 It was just released this week, so it's not up on here, but if you just Google White House RFI, or ask any one of us and we can share the link with you. 31:29.890 --> 31:35.870 I believe the deadline to provide information back to us is on October 9th. 31:35.870 --> 32:04.490 And so given the security risks, obviously, related to utilizing open source and commercial off the shelf software, we are looking for information as the White House to help the development and kind of build out of a strategy or action plan related to moving toward the usage of memory safe languages in the future and going forward in order to reduce the vulnerabilities related with the use of kind of the opposite. 32:04.490 --> 32:23.610 And so with that, those are two kind of open out for public comment RFIs that we very much urge and ask for your active engagement with, because there are ways for us as a government to hear from all of you and help inform the direction that national strategy and policy takes. 32:24.030 --> 32:25.330 And so with that... 32:25.330 --> 32:28.730 I guess we'll take some questions if you have them for us. 32:28.730 --> 32:30.190 Thank you for that. 32:30.250 --> 32:37.110 So I guess the question is, NASA has some particular ways of going about doing their business. 32:37.110 --> 32:38.850 How have we worked with them? 32:39.350 --> 32:39.790 Great. 32:39.790 --> 32:40.030 Yeah. 32:40.030 --> 32:40.610 Okay. 32:42.730 --> 32:48.710 So NASA has been an integral player in all of the workshops that we've been convening. 32:48.710 --> 32:56.430 They've been listening to the input from industry and as well as providing some of their own thoughts, maybe some of their limitations as well. 32:56.430 --> 33:08.970 And so it's actually been really helpful to have not just the private sector owners and operators in the room, but also the ones that are responsible for a lot of the government scientific missions and all of that. 33:08.970 --> 33:22.310 So it's something that I think we will flesh out further when it comes to actual solution space, but it's something that we definitely have had their input on nearly every single workshop. 33:22.790 --> 33:22.990 Yeah. 33:22.990 --> 33:34.490 And kind of speaking of the real, you know, rocket scientists, which we are policy people and the rocket scientists and then the cyber security experts, yes, our NASA colleagues have really provided that deep, deep subject matter. 33:34.490 --> 33:42.530 You know, what are the differences and what are the challenges of operating on orbit, particularly for NASA systems kind of input into all of the conversations. 33:42.730 --> 33:47.850 Hey, so the RFI that you put out on the memory safe, what was the driver for that specifically? 33:47.850 --> 33:57.930 Was that feedback from industry that they really needed memory safe implementations on board as they feel like that's like the biggest threat vulnerability that they're dealing with? 33:58.070 --> 34:10.190 Yeah, I think specifically, right, it's one of the implementation prongs within, well, it's specifically called out within the national cyber security strategy under shaping market forces. 34:10.190 --> 34:29.370 So under that construct, we're saying, you know, it's not just up to the sys admin or whomever that is, you know, literally monitoring some traffic day in and day out and relying on them to be having a good day or a bad day that an entire sort of network outage happens. 34:29.370 --> 34:29.450 Right. 34:29.450 --> 34:47.570 And so every moving sort of accountability from maybe different levels of of the software that people use or the applications that they use, right, moving that accountability to different players maybe makes more sense. 34:47.570 --> 34:55.570 And so I wouldn't necessarily say that that was just simply, you know, ONCD saying, okay, no, this looks like a really good thing. 34:55.570 --> 34:56.890 Let's let's work on this. 34:56.890 --> 35:15.010 I would say that a lot of this is also, you know, the National Security Agency says they've also come out with a lot of really good material to talk about some of the inherent risks in different types of programming languages, not to say that those programming languages are unsafe in and of themselves, 35:15.010 --> 35:20.410 but perhaps how they are being exploited, right, is and how do we best address that. 35:20.410 --> 35:23.050 And I think this is what this RFI is getting at, right? 35:23.050 --> 35:26.530 What are the perspectives out there in terms of memory safety? 35:26.530 --> 35:27.730 Is it an issue, right? 35:27.730 --> 35:32.490 Do people I mean, we've heard both sides extensively, right? 35:32.490 --> 35:40.310 We've heard that, you know, there's, you know, memory safe languages, right, can also be exploited. 35:40.310 --> 35:42.690 And I think there's a DEF CON workshop on that. 35:43.030 --> 36:01.610 But it's really how do we make sure that that there is a discussion around what is sort of the solution that we can all agree on to make sure that the software that we that we use, the off-the-shelf software that we use can be more secure. 36:02.030 --> 36:11.890 Yeah, and maybe to the to the purpose of the RFI and truly the request for for information and for feedback, particular to, you know, this space ecosystem as well as to other sectors. 36:11.890 --> 36:25.370 Again, we have learned along the way, including by very much leveraging our NASA, you know, colleagues expertise, some of the challenges that come with thinking about, you know, space systems that are a legacy that are being developed today and that will be developed in the future. 36:25.370 --> 36:30.490 And particularly for those legacy systems, what, you know, migration to memory safe languages might mean or imply. 36:30.490 --> 36:34.110 And so that's that is very much why we we open the door to feedback. 36:34.450 --> 36:44.030 So you've talked pretty specifically about space and there's a lot of overlap in the civil airspace and defense air military airspace sectors. 36:44.030 --> 37:01.630 Do you see the initiative that's going on in space flowing out to contribute to those regulations or do you think that's more of a start over because they come from a lot of different, you know, FAA and DOD and so on because they they get regulated differently? 37:02.150 --> 37:12.630 Yeah, I think the way I would answer that is also in an RFI context to the RFI that Tanya noted related to broader regulatory harmonization. 37:12.630 --> 37:36.830 I think that that RFI is very much open-ended in the sense that it's not scoped to any particular infrastructure sector or just sector in general because I think we do very much recognize kind of the broader just the broader criticism as well as reality that there are just so many different regulations and so many different requirements across different federal government agencies that apply to to each different sector. 37:36.830 --> 37:44.730 And so harmonization as a as a goal and as an objective is one that we are looking for for your your input and moving toward. 37:45.030 --> 37:53.470 Yeah, and then to the point of or to the question of, you know, can sort of what we're doing here be modeled for our work in other sectors? 37:53.470 --> 37:55.650 I think absolutely is the answer, right? 37:55.650 --> 38:05.230 And we only started focusing on space earlier this year, right, around the time of when the the National Cybersecurity Strategy was released. 38:05.230 --> 38:12.690 And so it's something where this is our first attempt to take a focused look at how do we have better conversations? 38:12.690 --> 38:16.230 Like we keep on talking about public-private partnership, but really what does that mean? 38:16.230 --> 38:21.650 How do we actually take this conversation on the road to meet industry where they are? 38:21.650 --> 38:25.690 And so that we can have localized perspectives from every single location, right? 38:25.690 --> 38:38.450 And so I think this is absolutely a model for even conversations that we that we could potentially have with other other critical infrastructure that may not be designated as a critical infrastructure yet, right? 38:38.450 --> 38:41.990 We don't necessarily, and I think we saw this with election systems, right? 38:41.990 --> 38:44.750 The bad thing happened and then the sector was declared. 38:44.750 --> 38:56.370 We want to sort of get ahead of that to say this is something that we see based on, you know, all of the growing market trends for that, you know, exponential growth that we saw earlier. 38:56.370 --> 39:03.210 We see sort of different attack vectors for connected space assets. 39:03.210 --> 39:14.450 We see our adversaries sort of exponentially looking at how do they not just go after our assets, but also proliferate their own space assets. 39:14.450 --> 39:33.830 And so there's this whole sort of trend in terms of how do we not just look at this as an important domain when something bad happens and then think should we declare this as a critical infrastructure sector, then slap on some regulations and make one government agency accountable. 39:33.970 --> 39:42.850 We're saying this is something that we're seeing as sort of the maturity or sort of the growth of this industry right now. 39:42.850 --> 39:50.550 And we really want to have those conversations before anything bad really does happen to our own assets here in the U.S. 39:52.230 --> 40:02.990 Yeah, I guess maybe the very, very last point I'd make on that is that it also, having these conversations with industry related to space and being humble, I think, we have tried to be in terms of kind of our listening posture. 40:02.990 --> 40:15.230 It's also helped us challenge our own kind of assumptions when it comes to, you know, what the right policy approach might be or what a specific, you know, policy adjustment might be needed specifically in that, you know, space policy directive five context. 40:15.290 --> 40:23.830 But I think very much is something that, you know, our offices is committed to across all sorts of different sectors and hopefully, I think, across the government at large. 40:24.130 --> 40:30.970 So you have the, actually just on the next slide, you have the list of like the myriad of applicable frameworks. 40:30.970 --> 40:36.210 And I'm just kind of curious, because let's take like 853, for example, there's like a thousand and eight controls there. 40:36.310 --> 40:40.590 And the feedback you're getting from the commercial side is there's just there's a lot, right? 40:40.590 --> 40:41.630 I could sympathize with that. 40:41.630 --> 40:50.830 But I'm curious, because that really kind of jumps to step three, step one and two is about tailoring and implementing those controls and using threats to define like, what is the subset? 40:50.830 --> 40:54.650 It's like a catalog that you're supposed to... where do you think the disconnect is? 40:54.650 --> 41:03.510 Or what have you been hearing about the disconnect that informs and helps industry, like have an approach and methodology to making sure that you select the right subset of controls. 41:03.510 --> 41:08.010 And you don't worry about a thousand and seven things, but you worry about the right 90 things. 41:08.150 --> 41:14.870 My quick answer on that would be that the right 90 set of controls for any one of these standards, right? 41:14.870 --> 41:23.950 Which multiplies when you're talking about the complexity of the landscape that exists right now without kind of a common baseline standard. 41:24.050 --> 41:36.670 And so I think that just it speaks to the amount of time and energy and kind of expertise that's required, especially for smaller companies if they're kind of starting from scratch and have to pick up where things exist today. 41:36.670 --> 41:41.850 So I think even with that subset of controls, it scales quickly when you look at that standards environment. 41:41.930 --> 41:46.030 Yeah, and I'll go back to the resourcing point that we made earlier, right? 41:46.030 --> 42:00.370 And so we're talking about, I mean, even the stuff that we've listed here, we're talking like maybe 2,000 pages worth of reading and churning through and trying to figure out which ones apply to your segment or which one applies to your specific company. 42:00.370 --> 42:09.410 And so it's something where just from a resourcing perspective, like are you hiring people to just do reading and do compliance checks? 42:09.410 --> 42:17.490 Or are you really wanting to build people who understand the unique infrastructure that they're dealing with, right? 42:17.490 --> 42:23.610 And you're not going to get that if you're just going to have people sitting there day in and day out churning through these documents and these pages. 42:23.870 --> 42:40.170 And so even right here, right, you see there's a lot more on the federal side than there is on the commercial side when we're talking about companies that do business with government infrastructure, right, the ones that directly support national security systems. 42:40.170 --> 42:49.290 You're seeing even just a small smattering of different CNSS policies that are out there, but that's just for national security systems. 42:49.290 --> 42:56.770 Who's making the checks to make sure that those aren't conflicting with what is available for commercial industry? 42:56.810 --> 43:07.130 And I mean, with the sort of dual use nature of a lot of our space infrastructure, how do you actually just segregate the two types of requirements, right? 43:07.130 --> 43:11.910 And so there's that type of harmony that is kind of missing right now just from even this snapshot. 43:12.950 --> 43:19.950 So one of the feedbacks I've gotten from customers is that designated national security systems is like, why are we doing all this? 43:19.950 --> 43:24.530 To his point, they seem to jump to step three and ignore step one and two. 43:24.770 --> 43:29.770 And then my response has been, well, we're supposed to tailor these. 43:29.770 --> 43:32.150 And they seem to not understand that point. 43:32.150 --> 43:37.490 And after a lot of long conversations, we kind of come to a mutual point. 43:37.490 --> 43:44.570 But is the guidance... I guess my question is, is the White House going to try and clarify that? 43:44.570 --> 43:50.430 Are they just going to let the DOD and the DHS and the various branches put out their own guidance? 43:50.430 --> 43:55.310 Because it is really wildly complicated, but they don't seem to understand that at first. 43:55.310 --> 44:04.110 I think part of that, right, the challenge that you're talking about has to do with the availability of the contextual information that puts things into perspective for industry. 44:04.110 --> 44:16.690 And so a lot of the things... I mean, Lauren touched on the key finding that we had, or the key takeaway that we had from all of our conversations in terms of the disparity in how information was getting passed from government to private sector. 44:16.710 --> 44:21.010 We're talking about classified things that maybe shouldn't be classified. 44:21.010 --> 44:29.330 We're talking about the speed of things that should be... the lack of speed makes things not actionable. 44:29.330 --> 44:36.310 Or even the relevance of things that are shared are just not relevant for whatever industry that they're sharing to, right? 44:36.310 --> 45:02.110 And so even from that perspective, I think contextualizing or even working on ways to make it... make some of the standards and the requirements a little bit more contextualized in a uniform manner, that is something that we're trying to examine right now in terms of how do we improve even the reasons why somebody needs to focus on these types of risk measures. 45:02.630 --> 45:18.790 Yeah, and then instead of only, as we've been doing for the last several months, kind of gathering information from the private sector and seeking your perspectives, which has been incredibly helpful and important, we have, in parallel, been having conversations with our interagent... with our federal government partners as well, 45:18.790 --> 45:26.270 just because of exactly the landscape that exists and because private sector is engaging with multiple government agencies, which have multiple requirements. 45:26.790 --> 45:37.450 So we are thinking about both of these things in parallel from the White House point of view, and it's a hard challenge, but it's been a very intellectually stimulating one, and we'll continue with it into the future.