Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Melanie Teplinsky on the value of cybersecurity policy, a zero trust model for small businesses and her start at the NSA
Guest:
Melanie Teplinsky
Published:
Updated:
Duration:
43 min
Episode summary
Melanie Teplinsky fell in love with cryptography at an early age, which led her to landing her first job at the National Security Agency at 16. From there, she found her niche in cybersecurity at the intersection of technology and the law.
As a senior fellow at American University in the Law Tech, Law, and Security Program, Melanie helps craft cybersecurity policies that scale and attempt to solve big, societal problems. First, she has to understand how cybersecurity technology and models, such as zero trust, are implemented at companies and organizations of all sizes. Then, she applies those principles to existing laws and government mandates to understand the pitfalls and gaps.
Between her early start in cyber and national policy-making, Melanie has a unique perspective to share with the infosec community. Listen to the episode to hear more about:
How cybersecurity policy can transform small- and medium-size businesses’ approach to zero trust
Why protecting innovation efforts at universities and small companies is paramount for the cybersecurity industry
The positive outcomes from collaboration between the public and private sectors
Small companies cannot defend alone About three quarters of the defense industrial base is small and medium-sized companies that lack the budget and staff to stop nation-state theft, and Melanie argues they should not be expected to build security programs on their own.
Transferable tax credits could fund providers The proposal would give tax credits to companies that use certified expert providers of zero trust and threat hunting, and make the credits transferable so unprofitable companies can pay providers with them.
Least privilege is part of zero trust Melanie describes zero trust as a set of elements including identity management, least privilege, and monitoring, built up in layers starting with steps like two-factor authentication.
Reporting enables crowdsourced defense Mandatory incident reporting lets the government push threat details back out through structures like ISACs so other companies can look for the same attack.
Policy must move at digital speed Melanie says adversaries do not consult lawyers before attacking, so democracies need to uphold their values without letting process slow their ability to act.
Notable quotes
We have an enemy that does not need to get lawyers in the room to get things done.
Perimeter security would basically post a guard at the entrance to the building. Zero Trust takes a different approach. It posts a guard at every door, every hallway, every elevator.
While there's a lot of writing about very hard topics, much of the writing admires the problem.
We have to figure out how to move at the speed of digital.
Questions this episode answers
How did Melanie Teplinsky start working at the NSA?
Her father introduced her to cryptograms at eight. At 14 she wrote to the NSA director asking for a job, was told to write back in a couple of years, and started as an analyst at 16. Read this section
What are transferable cybersecurity investment tax credits?
Congress would give companies tax credits, dollar for dollar, for using expert cybersecurity providers. Making the credits transferable lets companies that are not profitable pay providers by transferring the credit to them. Read this section
What is the difference between zero trust and least privilege?
Melanie says least privilege is one of the elements of zero trust, alongside identity management and monitoring the network for intruders. Read this section
How can small businesses implement zero trust?
Melanie argues that expecting each small business to become a security expert does not scale. Instead, tax credits should spur an industry of certified providers that deliver zero trust services, similar to how investment tax credits grew renewable energy. Read this section
Why hasn't Russia launched bigger cyberattacks during the Ukraine war?
Melanie noted that what has been seen, such as the ViaSat modem attack, is mild compared to Russia's capabilities. One view is that Russia expected a quick win; another is that it is saving its best tools for the West. Read this section
About the guest
Melanie Teplinsky started her career at 16 as an analyst at the National Security Agency, then studied law and practiced as a lawyer at Steptoe and Johnson, building a thirty-year career in cyber law and policy across the private sector, government, and academia. She served on CrowdStrike's pre-IPO advisory board. At the time of recording, she was a senior fellow with the Technology, Law and Security Program at American University's Washington College of Law.
And I'm Jeremiah Roe. Today, we're talking with Melanie Teplinsky, a senior fellow with the tech, law, and security program at American University's Washington College of Law.
Yeah. The Remix Kitten one is very eye catching, though I don't think Melanie picked the names. In any case, we're really excited to catch up with her and learn about her awesome work at the intersection of law, tech policy, and cybersecurity. First, let's hear from our sponsor.
Attackers scan your systems daily. You just don't get the report. Synack Security Testing Platform stands out by drawing on a trusted network of global security researchers. From web apps to headless APIs, our platform helps you find and fix gaps in your security posture. Learn more at synack.com. That's synack.com.
Welcome to the show, Melanie. It's it's so exciting to have you on. I know there's a lot of things that you've got going on right now. There's a lot of things that you're working on. But first, I'd like to just kinda talk about how you got started in cybersecurity. What brought you to the realm and and and what kinds of cool things you've been working on?
Absolutely. Well, thank you for having me. I'm delighted to be here. What kinds of things brought me to cybersecurity? My dad did. When I was eight, he sat me down with the Washington Post and showed me my first cryptogram, and I fell in love with puzzles. And that led me at the age of fourteen fourteen to apply to the National Security Agency. I wrote to the director in a move that I still think was amazingly bold for a 14 year old, and I asked if I could work for him. And he was nice enough to write me back and let me know I was way too young to do that, but if I wrote back in a couple of years, they'd think about it. So when I was 16, I reapplied, and I started my career as an analyst at the National Security Agency. After that, I went on to college and to law school, switched over from being a math major because I got very interested in the intersection of law and technology and policy and started working right out of school as a lawyer at Steptoe and Johnson.
I worked there for many years. I loved my work there and had a number of other positions across the private sector, government, and academia over a thirty year career in cyber law and policy. And, now I serve as a senior fellow at the technology law and security program at AU's Washington College of Law. I've done some work for CrowdStrike, which your listeners may know. It's a leading cybersecurity company. I served on their pre IPO advisory board, and now I'm doing a lot of work with, AU's tech law and security program, which is very exciting.
That's really awesome. So you knew when you were younger that you wanted to potentially work for the NSA. What what kind of brought you there? That's that's such an interesting... Because I don't know if I was thinking about the NSA at a young age.
So I grew up in an interesting household. My, dad was a PhD in computer science. My mom was a math educator, and my sister was really interested in, weather models. So she spent a lot of time trying to understand weather systems and eventually went on to be a PhD in computer science. So when I was a little kid, very early on, I knew I loved math. I got interested in puzzles, and I read everything I could read about cryptography, but it turned out the literature stops at about 1945 because everything else is classified. And I decided I wanted to know more than was available in the public space, and the only way to do that was to work for the agency.
I have to assume that, like, at 16 years old working at the NSA, you must be probably working around a lot of folks that are older than you, different backgrounds than than you. I guess being a 16 year old, you don't have much of a a background at that point yet. What was that like? Like, was it was it weird?
It was. I think I was the only one whose mommy dropped her off in the morning, but I was very privileged. A lot of lovely and wonderful people took me under their wings. One gentleman in particular who liked to say that he had raincoats that were older than I was, But I had a lot of wonderful mentors, and they taught me the basics of cryptanalysis. They taught me an enormous amount about computer science, massively parallel supercomputing. So I was privileged to get a strong technical background from some amazing folks.
That's so cool. That's really exciting. So today, you're a senior fellow working in the technology, law, and security program at American University, as you mentioned earlier. What does the day to day look like for a senior fellow?
So day to day, I do a lot of things for the program. I'm actually a recent joint. So I joined last spring. And so first, I was learning the ropes. But what I love about TLS is that they've been active at that intersection between... Technology, law, and security. They look at how the law addresses technological challenges to privacy, security, free speech, and democratic institutions, and we look at all of those questions in the context of security. When I say security, I mean national security as well as the security of, democratic systems and the international rules based order. So it's a very active group of people who are phenomenal. It's run by Gary Corn, who's a retired army colonel. He was active for about twenty five years in the US military, the last five of which he spent as general counsel to the US Cyber Command. And this incredible group of talent is working on some of the hardest problems at the intersection of law, technology, and security.
We have projects that focus on national security and artificial intelligence, privacy across borders is one of our projects led by a scholar in residence named Alex Joel. They're taking a really deep dive into questions of transatlantic data flows post Schrems II. And we also have a project on harmful content, looks at the varying degrees to which actors have the power to cut off or deny key services to undesirable actors in the system. We have a free speech project. So they're really engaged at these central questions, at the intersection of technology, law, and security. It's a fantastic undertaking.
There are a lot of people that are working in this space, but we try and take a look at issues where a deeper dive is necessary. What we found is while there's a lot of writing about very hard topics, much of the writing admires the problem. And so our approach has been a little bit different. We take key people who have expertise in the space, and those people make a deep dive and try to make substantive recommendations of value in the areas where they're working. And we've had a lot of of success by applying strong expertise to tough problems.
I'm just imagining these are such massive kind of projects or topics to be thinking about and working on. How do you know when something is, like, done? Is there done on a project of this type?
That's a great question. Sometimes there is a done. Sometimes the idea is to understand the problem space. But often, the purpose of these projects is to understand what needs to happen next. Think about problems like, encryption or privacy across borders. These are issues that have been around for almost twenty years, and they have a tendency... The debates have a tendency to just repeat themselves. And so our effort really has been to bring together folks across industry, government, academia, bring some of the best minds to bear and try and come up with some creative solutions, things that we really haven't seen before in these spaces.
I'm sure when you throw in things like quantum computing and, sort of that next generation, I'm sure that is difficult to sort of figure out how it ties into being innovative today and solving tomorrow's problems.
It is. But one of the great things about this field is that the values that underlie our decisions in this space don't change. So while the technology shift quickly, our values often don't. And so if you can understand the problems in a deep way, often you can translate that understanding to new technologies. And it doesn't mean we know all the answers now, but it does mean you can find a framework that can be applied as you try and understand the next generation technologies, whether it's quantum computing, lattice encryption, or artificial intelligence.
Has there ever been a time or could you envision a time where some new technology just totally shifts the types of solutions that you're coming up with? I know you just mentioned our values stay the same, so as technology shifts, the approach that we're taking really doesn't. But what if there's some brand new technology that that really does shift things? What would that look like?
Absolutely. This is what I dream about at night. The thing I love about this field is that the changes that are taking place can be transformational. They are not just... Right. This is kind of like when we got the railroad or when we got the car or when we got the telephone. These are not technologies that
Exactly. Right? They change our lives. And so that's, I think, what folks in my field dream about at night. We love when we get something that is so transformational that we need to rethink how we deal with it, and it reminds me of a course I took in college about the history of technology. And we learned about the fact that when people learned how to spin cotton into thread, they had to change the way that it was done. Originally, people did it by hand and one motion worked, but when we started to use machines to do it, turned out there was a better way to do it by machine. And if you... Instead of trying to copy the old methods of how we did it by hand, instead we came up with a new method that machines could do better, we got much more efficient and effective use of cotton, and that allowed for the textile industry to grow. And I think that's what we're seeing here. Right? We have to figure out how not to just take our old processes and copy them.
So clearly, you you have and do spend a lot of time thinking about, you know, technology, cybersecurity, and specifically cybersecurity policy, how the government can compel businesses to do a better job of both protecting consumers and also safeguarding their own systems. I know that you've talked recently about incentives like tax credits for businesses to build resilient or more resilient architectures. Can you tell us a little bit more about this approach and why you think it could work?
Absolutely. Let me start by telling you the problem that it's designed to solve. There's a really long standing problem in this space. The private sector is vulnerable to cyber intrusions, but particularly for well resourced threat actors. Think China. Think Russia. And this problem has been brought into stark relief over the past year. There's been a series of headline grabbing cyber incidents. I'm sure you guys have spoken about them on this very podcast. We had the ransomware attack that shut down Colonial Pipeline, which folks know is one of the country's largest oil and gas companies. We had the Chinese state sponsored hack of the Microsoft Exchange Servers, and that really served to intensify these repeated government warnings about China's ramp in cyber espionage. FBI director, at one point, was talking about, China's efforts to steal its way up the economic ladder.
And, of course, we had SolarWinds, which was the supply chain hack that enabled the Russians to spend months inside of a large number of US government and private sector networks that impacted DOJ, treasury, commerce, energy, hundreds of Fortune 500 companies, all the branches of the military. I can go on and go on and on that, you know, triggered an emergency meeting of the National Security Council. So we've seen all of these incidents just in the past year, and what they really do is bring into relief the fact that the private sector is extremely vulnerable. So the proposal that I've been talking about is designed to fundamentally change the cybersecurity landscape and provide the basis for a more resilient cyberspace. Most of the private sector companies that we have just aren't in a position to defend against these sort of threats on their own.
And we can see this in particular with the defense industrial base, known as the DIB. The defense industrial base really has continued to lose critical data as a result of nation state cyber thefts, and thousands of DIB companies essentially have been tasked with providing their own security. So the vast majority of the DIB, about three quarters of it, is made up of small and medium sized companies and they just can't generate effective cybersecurity capabilities on their own. They don't have the resources, they don't have the budget, they don't have the IT staff. And there's a lack of integrated cybersecurity offerings. So companies are just left to patch together available cybersecurity solutions and try to create their own effective cybersecurity program. So that was the problem that we were trying to solve.
With that problem set, I'm wondering if there's a fundamental flaw in the structure of the way that they do business as well. Just speaking out loud, of course, it makes it difficult to innovate a lot. So my background is in the DOD realm. And so when I used to operate in that realm, there's huge political boundaries, bureaucratic boundaries, and, of course, things that inhibit innovation, growth, and streamlining processes. And I'm wondering if that is also contributing factor to some of the difficulties in the cybersecurity demands that we're seeing today.
So it is. There's been an incredible amount of innovation in the private sector on cyber security over the last decade. You can see this, in the development of the services that are available. So I think on the private sector side, there's certainly been enormous innovation. But on the customer side, right, the people who need the cybersecurity, they often just aren't in a position to develop their own solutions whether because of resource constraints or because their job is to build a great widget and they don't want to put their resources toward cybersecurity. They want to put their resources toward building a better widget. And so there are a lot of barriers, think, to, ensuring that companies have the kind of resilience that they need.
And this... Is this where this kind of approach of of, you know, incentivizing businesses to focus on cybersecurity through tax credits, stuff like that, is that is that what that approach is aiming to hit at? Like, businesses don't have the resources and aren't incentivized to create the resources for this cybersecurity issue?
Yes. So this, idea, which was the brainchild of a colleague of mine, Frank Kramer, who was the former assistant secretary of defense for... In the Clinton administration, and another colleague, Bob Butler, who also has worked in this space for decades. The idea was how can we enable companies, particularly companies in the critical infrastructure sector, think water companies, power companies, electric companies. How can we help these companies to develop the capabilities that they need? It's been about twenty years that we've been talking about this problem and we haven't been able to solve it. And so the idea was, well, if we could spur the development of an integrated cybersecurity service offering so that people that are in the critical infrastructure space could go out and buy what they need, that would be great.
Now, of course, we all know when I say buy what we need, this is not a package. You don't go out and buy zero trust. Right? So our thinking was, well, how do we put that together? Well, we would wanna be sure that that any cybersecurity provider that was providing services would have certain expertise. So for example, they'd need to be able to implement Zero Trust architecture. And for listeners, I'm not gonna get technical here, promise. I'll just say think of Zero Trust as an alternative to the traditional perimeter security model of cyber. The perimeter security model focused on keeping the bad guys out. Perimeter security would basically post a guard at the entrance to the building. Zero Trust takes a different approach. It posts a guard at every door, every hallway, every elevator. The ZT model, Zero Trust Security Model, assumes that bad guys have gotten into your network, and it takes a deny by default approach to protect critical assets.
It says if you don't know someone, don't let them in. And then if you combine an architecture that's based on Zero Trust with threat hunting, right, threat hunting, again, not technically, threat hunting is the equivalent of having a security guard patrolling the hallways. So it's used to detect attacks that might have been missed by other security controls. So when you combine an expert provided Zero Trust architecture with a threat hunting capability, you're essentially providing the equivalent of what the federal government has recently asked itself to do in terms of security in the cybersecurity executive orders that president Biden signed. So we're saying, let's bring that same level of cybersecurity to our critical infrastructure private sector companies. And to do that, we propose this new paradigm of establish, basically spurring the establishment of of an industry of these expert cybersecurity providers.
So, the thought was transferable cybersecurity investment tax credits. Okay. That's a mouthful. I understand. But the idea there is that congress would establish tax credits for companies that rely on these expert providers. The credits basically reduce the taxes that a company pays on a dollar for dollar basis. So it effectively serves as monetary payment for the services that are provided. And the reason that we suggested making them transferable is simple. Some of the companies that need to purchase these services don't... They're not profitable or they're not making money, so they can't really take advantage of a tax credit. So by making the tax credits transferable, the companies can basically pay their cybersecurity providers by transferring the tax credit to the provider, and it effectively allows for payment directly. So that's the concept.
So with all of the things currently going on in cybersecurity, it's a huge topic right now. Right? I mean, you routed off several of the instances. Currently, there's the war that's going on with Ukraine. We've had Log4j, the Colonial Pipeline, the SolarWinds issue. Obviously, you know, cybersecurity is a huge topic. Given that context, where in your opinion do you think The US is most at risk right now?
Right. So certainly critical infrastructure would be where I'd want my shields up campaign, which is to ensure that American companies are ready if there is some kind of a cyber attack that stems from this conflict. I think the surprising thing to a lot of cyber experts right now is that we haven't seen more yet. The Russians are first rate at cyber attacks. They really have best in class cyber operations. And what we've seen so far, while concerning, has been relatively mild given what we know that the Russians are capable of doing. We have seen the attack on ViaSat, which, disabled some modems that were used in the ViaSat satellite communication system. The malware that was in the...
That was used in the attack bricked the modems, and it had some unintended implications for oddly, wind turbines in Germany. There's a thinking here that the Russians assumed they would win this con... You know, win this war, this conflict quickly, and as a result, really didn't bring all of their cyber tools to bear. That's one perspective. Others think that perhaps they're saving their a game to use against the West. So we'll have to see. I think for the moment, the, the knowledge, the conventional knowledge is shields up, increase your resilience, keep your eyes out, and see something, say something.
I find myself whenever whenever we we talk about particularly Russia, and the... This potential risk, I just find myself like my brain just can't slow down. I'm like, my goodness. There's there's just so much going on. I guess slightly switching gears a little bit, I know recently there was some legislation that was just passed regarding mandatory cybersecurity incident reporting, which I think is really interesting. I guess just wanted to get your take on it. Are you in favor of this? What do you think positively or negatively? What do you think this will do?
Right. So this is really interesting. This has been working its way through congress for a very long time. This is... President Biden basically signed a bill that expanded cybersecurity reporting obligations and, in particular, expanded them to critical infrastructure. On the one hand, this is not surprising. Right? The federal government has been interested in getting a better picture of what our cyber threat landscape looks like. And one way they do that is by getting reporting from private sector companies so they know when there has been an incident and what the incident looks like, and that helps them to develop situational awareness. So there's been an effort for a long time now to improve reporting. These are great steps. The Biden administration has been very active in cyber. There have been a number of executive orders. There have been a number of pieces of legislation, and we are moving in the right direction.
We now have Jen Easterly leading CISA. We have Chris Inglis leading the National Cyber Directorate. So we we have great people doing great work. We have Anne Neuberger on the NSC. All of these appointments are showing the Biden administration's attention to this issue and willingness to try to improve our position in this space. But it's still... There's there's more work to be done as always is the case in cyber. And, at this point, I think one of the key things that we can do is figure out how to improve our resilience. And then when we do that, when we do have an issue, we'll be able to focus our resources on the small... Number of serious issues that we have rather than having to try to defend all of our, assets.
I know that you mentioned, you know, sort of in the beginning of of talking about this new law, you mentioned that it's really important to get this data and that that it'll... It's useful data, right, finding out when cybersecurity incidents are happening. How is that data used? What makes it useful? Like, what happens once we start getting more of this data?
Right. So the reason the government wants to understand this data is that once they know that someone's been hit with an attack, they can push that information back out to other members either of the private sector or through the information sharing and analysis center structure to private sector entities in various fields like energy or electric or financial. So if there's attack on one company, other companies know to be looking for it. Right? And if we can understand better who's behind the attack, what's motivating the attack, how we can... Then it helps us to stop that attack before it progresses. And I think that's the important point here is that we are essentially crowdsourcing our knowledge. So instead of just having one company that's hit and they try and deal with the, the implications of that incident, we actually are able to say, uh-oh, there's been an attack.
Are other people going to be hit? Did anyone else see anything? Do we know where it's coming from? Do we have the ability to stop this? How can we keep it from becoming a larger incident?
So you envision this information rather than just going to the government, being analyzed by the government, staying there, and maybe informing some other laws or directives in general. You see this more being used by companies, like all companies. So do you think that would this be information where, you know, a company reports an incident and then immediately other companies find out about it?
I think the eventual goal, yes, is to have a kind of operational hub that in... When there's an incident, we can have real time immediate kind of reporting, and folks can use that kind of threat intelligence to stop future attacks.
That sounds really cool. I love the idea of companies kinda, like, helping each other watch out and and warning warning one another about potential threats. It almost sounds idealistic to me in some ways almost.
So we already have this construct. A lot of the... So for example, in the financial services industry, there are companies that have banded together to work together to try and provide early warning and sharing information. There's competitiveness in industries. Right? Of course, the different companies within these industries compete for customers, but when it comes to cyber, they're on the same side. None of them wants to be attacked by Iran or Russia or China. And so there is a real effort to work together, not to share competitive information, but to share information about threats that really go to the security of our homeland or go to our economic security.
So you mentioned... I wanna go back to, cyber resiliency. You you kind of mentioned that would be an area of focus that you would be looking at today as well. What in cyber resiliency would you be focusing on specifically or would you recommend focusing on?
Right. And I think that takes us back to this proposal that we were talking about. There's some critical areas in our, country that need protection. So we've written a report with the Atlantic Council recently about how to protect innovative small, medium... Small and medium sized enterprises and academia. Right? We have some small companies in this country that are doing incredibly cutting edge work, innovative work. If you look at some of the key technologies in the last twenty five years, they've come out of either small and medium sized companies or academia. The technology for the N95 mask came out of an academic project. The technology for the cochlear implant. Right? The technology for the cell phone, for the iPhone, some of the touch technology.
Many of these technologies are coming from very small businesses or academia, but they are the most vulnerable to attack. They don't have the time, the resources, the expertise to batten down the hatches. And so the concept is we have to come up with ways to bring resilience to these entities, particularly when these entities are doing work at the edge of technology. When they're working on innovative technologies, they're working on artificial intelligence, biotech, right, computer technology, battery technology, all of the technologies that are critical to our national security because those are the technologies, right, that folks who are interested in attacking us are most interested in getting their hands on. And so one of the thoughts here is identify your critical spaces and try and batten down those hatches.
Earlier you you mentioned a lot of amazing folks doing great work in Washington right now, you know, that are that are getting good stuff done, I think potentially including this law that we talked about earlier. What things do you think maybe in addition to this law or beyond this law, what things are people working on in Washington that are good, like that they're getting right in terms of cybersecurity?
So one thing we're getting right is we're learning to work with each other better, faster, and that's really important. We've also... We are working through Jen Easterly, for example, CISA. She's really working to develop a trust between the government and the private sector. It's more than just partnerships, but the partnerships are extremely important because trust is really at the heart of all of this. Other work that needs to be done, there are some really hard big questions in this space. I would say if you're looking long term down the road, what is our identity structure going to look like? Right? If... As we move toward concepts like zero trust, if you're going to try to limit access based on someone's credentials, We need to understand the underlying infrastructure, the credentialing infrastructure, the identity infrastructure.
And as you develop that infrastructure, that raises issues that are very difficult, questions of civil liberties and identity. So we have to be very careful that we structure our infrastructure properly so that we protect the core values that are most important in our society while still satisfying our cybersecurity goals.
So I think that's really interesting. Right? Like, that's kind of a technical thing for how we can do better. And I think Bella brought up a great point. You know, what are we getting right? But what are we getting maybe not so right on the policy side? What are things that we could do better on the policy side?
We need to be fast. I would say there there are really two things. Number one, we need to be fast, and right now, we're slow. So it is 2022, and we're getting some reporting legislation. We need to do that faster and better. We have an enemy that does not need to get lawyers in the room to get things done. Right? When they wanna come in, do a cyber attack, they do not ask their lawyers if it's okay under the constitution. And we are both emboldened and saddled by our own restrictions, so we need to figure out how to make our democratic ideals work for us rather than feeling hindered by those, by those restrictions. Right? They are very important. We absolutely need to make sure that we uphold the... Our values as we work in this space, but at the same time, we cannot let that become, a restriction on our ability to act.
So on the technology side that you just sort of mentioned, you brought in the concept of zero trust. I'm sure you're also familiar with the concept of principle of least privilege, which has which has been around for a while. Right? So what's kind of the difference between the two?
Absolutely nothing. One of the elements of zero trust is the principle of least privilege. So zero trust really has a set of elements that are essential to its adoption, and one of them is least privilege. It also would involve identity management. Right? You need to understand who someone is so that you can decide whether or not they have access to things. You need least privilege, meaning someone only gets access to the smallest number of things that they need to have access to in order to do their job. Right? You need monitoring. Right? You need to be walking the hallways of your network to make sure the bad guy didn't slip in. So there are a series of things that go into building a zero trust system, and least trust is one of them.
I have a question that is is just like me thinking about Zero Trust. I'm thinking a little bit about the analogy that you made now, but also earlier, this idea of, like, Zero Trust is not just having a security guard at the front door. It's having one at every single door and having one patrolling the halls. And while you were... While we've been talking about this, I'm thinking about how in a physical security standpoint, that's pricey, right? That goes from one security guard to like what? Five, 10, 20. Is zero trust... Like, is this specifically more feasible because we're talking about digital?
So absolutely. It it would be very pricey, it wouldn't scale very well if you were in the physical world. Fortunately, we scale better in the digital world. So, yes, the answer is... A simple answer is yes, but you're also right to call this out. It's not an inexpensive or easy thing to do things like zero trust and threat hunting. It requires an investment of time and energy. To implement a Zero Trust system, you need to understand what on your system is valuable, you need to understand how to protect it, and you need to build it up in layers. But you can start doing those things now even if you're not a sophisticated company. There are small measures you can take, right, two factor authentication, simple things that will start moving you in the direction of having the kind of security that you need. With regard to the person patrolling the halls, that's really an analogy for threat hunting. Threat hunting... The thing that makes threat hunting hard is that there's a human element.
There are people who look and see if there's anomalous behavior in your network, but we've figured out how to use artificial intelligence to supplement this human work. So what's happening with the most sophisticated threat hunting programs is we automate the portions of the threat hunting that are repetitive, and then we use the humans, have human intervention only in those places where we really need a judgment call. And by having a feedback loop, the more we figure out things that can be automated, the more we can develop our AI systems to really efficiently threat hunt. And then we can develop a pretty sophisticated threat hunting system that does scale pretty well. You still need threat hunters. At the end of the day, we still have that big problem in cyber, the workforce problem. Right? There just are not enough people to fill the jobs.
And that, I think, as a nation, is a place where we can invest. Congress has started to do that. I certainly, at American, am hoping to be part of solving that problem by helping train the next generation of cyber policy leaders, but that is a a national problem of resources. We have to do a better job of getting kids interested in STEM early, and here I put my money where my mouth is. My eight year old is learning to do Python, coding, and... Yeah. I mean, yes. I... I'm a big supporter of teaching your kids early. So she's eight. That's when I was sparked to get interested in encryption. So my view is, you know, expose them early and see if it takes my 15 year old, not interested in the least in coding, fantastic at English, singing, history, but not... Doesn't want a computer.
That's fair. That's fair. I've got a I've got a funny story about Python. Funny enough, I was recently reading somewhere, and I think it was a coworker who is also doing something very similar with with their children. They're explaining about coding, what coding is, and sort of talking about a coding language, Python, and and all of this to which their young child responded, so your boss speaks to you in a Python language? And so so... Immediately makes me think of of Harry Potter and Parseltongue and all that fun stuff, though.
Absolutely. Or as I like to say to my kids, coding is involved every time you get in the shower. If you ever read a shampoo bottle, right, it says lather, rinse, repeat. The computer scientists can never get out of the tub. Right?
quickly circling back around to zero trust again because it's such an interesting and fascinating topic for me, especially when we get into compliance and policy and technical implementations and figuring out the right way to do this because everybody's got an opinion. And so from an actionable strategy perspective with regards to small and medium sized businesses, how can they begin to implement zero trust, not just for these sort of one off things, but say they wanna go all in on zero trust? What sort of an actionable strategy they can take?
Well, so that's why we think there should be these cybersecurity investment tax credits. Right? The whole idea there is that they don't have to do it. The idea is that we would spur an industry that would be able to help these small businesses do these things because I think at the end of the day, trying to rely on each individual business to become a cybersecurity expert service provider is a flawed concept. We're not going to be able to do that. That's like asking me to become proficient in Chinese and asking my husband to do so too and asking my kids. Right? It doesn't scale well, and it doesn't make a lot of sense. So it makes a lot more sense just like we did if you think about the energy sector. Right? When we wanted renewables to take off, we had investment tax credits for businesses that invested in renewable energy, and somebody spent a lot of resources to develop smart renewables, and then everybody else bought them.
We should do that here, right? You invest in an industry, you get the development of an overall industry of expert providers. You tell them that those expert providers need to be certified to a certain standard. I'm not saying a technical standard, not a prescriptive standard, but a standard of, capability. You're capable of providing zero trust services to your clients, and then you encourage those small businesses who can't afford to get this stuff, right, without some help. You say to them, not a problem. We've got you covered. The government's gonna invest here, and the way we're gonna invest is through these tax credits.
No. I think that's really important. It's also helpful because as we mentioned, you know, the principle of least privilege has been around for a while, and people have known about this stuff for a while. But I think some of the problems that have been holding people back have been these very monetary challenges, you know, that you just mentioned.
So I know... We talked a little bit, moments ago about talking to our kids, our families about cybersecurity. I know you mentioned that you talk to your kids about cybersecurity, I guess about tech in general. Beyond that, I I know that you have a sister
Phyllis Schneck. I hope I pronounced that correctly, who is the former top ranking cyber official at DHS, and now working at the Aspen Cybersecurity Group, which is so cool.
Wow. Okay. Even more credentials to add to the list. Yeah. So my my question is, I have to imagine that family gatherings must have at least some moments of just, you know, big nerding out about NIST frameworks, APTs. What does that look like when when y'all get together? Is it just like all cybersecurity?
Okay. So we are a family of geeks. I will say this. I feel for my mom who is one of the smartest people on the planet but does not do cybersecurity, but it it is. It is a family of geeks. My sister and I talk a lot about these things. And in fact, when I worked on this paper, I sent it to her and I said, tell me, what do you think of this? Give me some feedback. You know, is this something that you think would be valuable? And similarly, you know, she will ask me, certainly not about company proprietary, but generally about responses in this space. For many years, I worked on data privacy issues. So we've had a lot of talks about the intersection between data privacy and cybersecurity, how those two spaces interact. There was not a deep understanding of that certainly in the early days, and even sometimes now there's not as much communication as there needs to be among professionals in those fields.
Just kinda wrapping up here. I know we're getting close to time, and I've certainly enjoyed this conversation. Shifting gears to a little bit of a lighter tone, I was wondering if you could tell us, which is something we ask of all of our guests, if you could tell us something that we wouldn't know about you just from reading your LinkedIn profile.
So this is really where the word trampoline should have come in, I'm thinking. There are many things I could tell you. I love to play the violin. I am an avid tennis player. And let's see what else can I tell you? And I'm extraordinarily competitive, like, a fault, to a fault. So when my kids... I just coached the Cyber 9/12 team, and I will tell you my favorite thing that happened in the whole competition. Right after they won, one of my students, right, three of the four students were celebrating, but the fourth student looked up and she said, when do we get the score sheet? I wanna see how we did. And I thought, okay. Right. Competitive like that. Yes.
If you like today's episode, please give us a five star rating and subscribe wherever you're listening to this. It'll really help us get noticed on your favorite podcast platforms. Also, share this episode with your friends. And if you haven't already, make sure to check out all the other really fascinating people that we've already interviewed. We're also open to suggestions. If you know someone we should be talking to, drop us a line at we'[email protected]. That's WE'RE IN PODCAST at s y n a c k dot com.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
