Public-Private Collaboration Advances in U.S. Cybersecurity

00:07 Joyce Hunter | ICIT: Good afternoon. My name is Joyce Hunter, and I'm the executive director of ICIT, which is the Institute for Critical Infrastructure Technology, and welcome to Public-Private Advances in U.S. Cybersecurity. I would first like to thank Synack and Accenture Federal Services for their thought leadership in cybersecurity and sponsorship of this event. The Institute for Critical Infrastructure Technology is the nation's leading cybersecurity think tank,

00:38 providing objective, nonpartisan research, advisory and education to legislative, commercial and public sector cybersecurity stakeholders. Our mission is to cultivate a cybersecurity renaissance that will improve the resiliency of our nation's 16 critical infrastructure sectors, defend our democratic institutions and empower generations of cybersecurity leaders. Please check out our website, www.icitech.org

01:10 for events and publications. It's been almost a year since the Biden administration issued Executive Order 14028, Improving the Nation's Cybersecurity, to encourage Washington and the private sector to work more collaboratively, share information and increase partnerships to confront the growing threat landscape. The Executive Order mandated that federal agencies follow emerging private-sector practices such as zero trust and more transparent alert reporting.

01:42 So how are we doing? That's what we're going to find out today. In addition, the Biden administration's presidential Management Agenda challenges leaders of all industries to collaborate across public, private, and federal-state entities. We look forward to your participation in this. If you have any questions, please put them in the chat. I'd like to introduce our panelists. Dr. Allan Friedman, senior advisor and strategist at CISA.

02:13 Steve Luczynski, deputy lead, OT/ICS Security Practice, Accenture Federal Services. Mark Kuhr, CTO and co-founder of Synack. Shawnee Delaney, founder and CEO of Vaillance... Sorry, Shawnee, Vaillance Group. Let's start out with the first question that I'm going to address to all of you. Last May the Biden administration issued the

02:44 executive order that I referred to above. How have you seen it? So how has it gone so far? I mean have you seen any kind of advanced collaboration? And we could start with Dr. Friedman. Dr. Allan Friedman | CISA: I think we have seen some great collaboration. Now the challenge is the goal of a lot of that EO is to build around very explicit government rules. And so there are guidelines about how the government can

03:14 engage when we're talking about formal rules. But I think what's been great is to see every step of the way. So let's look at Section 4 of the EO. And I know, guys, the EO is really long. Section four details how software should be produced securely. Right? The idea is, hey, there's some basic stuff I'll have such as, you know, my favorite issue of SBOM, but also a lot of other things. Are your developers using MFA in their environment? Are you using basic security tools? So it's a bunch of things like that. And then the first thing is that NIST and the U.S.

03:47 government asked industry, "Hey, what do you think about this? How should we scope this?" NIST took that feedback, created the Secure Software Development Framework, created a guideline. Then OMB, the Office of Management and Budget, which is part of the White House, picked this up and asked industry, "Hey, now we have to turn it into rules." Right? A framework is nice, but it's not concrete to get rules. So... And then there was a comment period. Yesterday, there was a workshop where we had great panels so that the community could hear industry perspectives and federal CISO perspectives.

04:18 So I think there has been some collaboration a lot around a number of these issues, especially given the constraints that we have. Joyce Hunter | ICIT: Great. Thank you so much, Dr. Friedman. Shawnee, what do you think? Shawnee Delaney | Vaillance Group: Yeah it's a good question. So personally I've seen a lot of interest in increasing collaboration among both private and public sectors but really especially in industrial control systems and law enforcement. I think both sectors really understand that there are unique risks and that actually, you know,

04:49 private sector does have some interesting insight into how to mitigate those risks. Insider threat, for example, I've been working with law enforcement where they are understanding that there are threats to them, where people want to infiltrate whatever, you know, the reason, be it a nation-state or fringe group. And so they're looking into other ways to enhance cybersecurity and things like that. Personally though, I think that increasing webinars and events like this is really a great way to spread the word and help organizations

05:20 on both sides see the utility in this and get the insight from experts like my colleagues. I think, you know, especially in these days and times, the collaboration is so critical that we have to do things like this. Joyce Hunter | ICIT: Steve, what do you think? Steve, you're on mute. And Steve wins for the day. Steve Luczynski | Accenture Federal Services: Because I am just brand new at this whole system.

05:53 So the one that jumped out at me, I started my career in the Air Force and flying as a fighter pilot. So what really jumped out at me is the Cyber Safety Review Board. And the idea of this has been around, it's been talked about in different areas, but the fact that now the government is on board, Rob Silvers of DHS is leading that, and there's that public-private participation. And what I'm looking forward to is what I saw in the military, it's the NTSB model.

06:24 If there's an aircraft accident, let's figure out exactly why it happened. Let's get to the root cause and let's make sure we tell everybody else so they don't make the same mistakes. We did the same thing in the military. I saw it both as a pilot and leading an investigation board where we had to figure out what was the problem that caused the accident and quickly get operations back for that aircraft so things could go on. So now on the cybersecurity side, whether it's on the information technology or the operational technology, there's so many lessons.

06:56 There are so many things that when you have an incident that rises to the level of a unified coordination group, where you have all the agencies focused on fixing this, and we've seen that, there's a laundry list of those things, especially when it comes to critical infrastructure. So the more we can pull out of that, anonymize the information, pass the lessons learned, so it's not the smart folks on Twitter who do a great job and share it in other platforms, but let's formalize it,

07:27 let's dig into it, let's make sure folks are willing to participate. So the fact that that's going, and I look forward to seeing how that grows over the years. Joyce Hunter | ICIT: Dr. Kuhr. Dr. Mark Kuhr | Synack: Yep, all good points from everybody. I think one example that I like to give really quickly on Synack's model and its adoption by federal agencies, what we do is a little bit unique. We recognize there's a talent gap. There's not enough people out there to find these vulnerabilities.

07:57 And if you look at this executive order, it's really encouraging the government to find talent where maybe they can't find it today inside the contractor workforce or inside the government workforce. And so what Synack does is go out and recruit some of the best hackers in the world. And for government customers, US citizens, folks that wouldn't be working for a large defense contractor. And we bring them onto our software platform and deploy them in very targeted penetration tests. But you can think of it as an expert community,

08:27 a large community doing these penetration tests on critical infrastructure or on applications, whatever it may be. And these can be even deployed as continuous tests. And that fits that DevOps cycle that we're seeing that acceleration of software development. We need to have continuous testing if we're gonna have continuous software development. One example of this that's been adopted by an agency such as the Department of Defense is the Hack the Pentagon program, where they wanted to accelerate their development process, move to DevSecOps and recognize that they need very rigorous

08:58 testing that gets as close as you're gonna get to what the adversary is throwing at us. And so this model is, I think, a shining star of public-private partnership because they're tapping into citizens in a country that are not necessarily affiliated with traditional employment methods like contracting firms or even government personnel. And so it allows us to get access to talent and tap into them in a way that helps us solve our security problems and helps us scale.

09:28 I think the major challenge we're gonna face with Biden's executive order is just the sheer scale of it and the number of government systems that are out there. We need to consider alternative approaches to get us that rigorous testing that we know we need. Joyce Hunter | ICIT: You know, I'm gonna throw this question in here because this has been in the back of my mind for a little while. So this is your surprise question for the day. Let's take a look at you know you made me think of something Dr. Kuhr, is what about NASA?

09:59 Remember the early days of NASA? Well, I'm not that old, but during the early days of NASA you did have that public-private partnership because President Kennedy said we're going to get to the moon in nine years everybody kind of joined together in the moonshot. What happened? I think we're on that path. Go ahead. Dr. Joyce Hunter | ICIT: Friedman, you want to jump in? Dr. Allan Friedman | CISA: There has been some excellent writing on

10:30 the sort of moonshot analogy, including by some very smart people. I'm slightly skeptical of it myself as a powerful analogy because, right, a moonshot is a tangible measurable goal that can be easily decomposed. And so it's always tricky to use the Manhattan Project or the or the moonshot model. Although, again, some very smart people have been sort of talking about what it could look like,

11:00 mainly as a sort of focused concentration for federal spending. One thing I will acknowledge, NASA has been doing great leadership roles, NASA's expertise in software is incredibly advanced, and it's one of the leading models around that in the U.S. government. And that's something that they've worked to partner with the rest of government and partner with industry research and the open-source community in particular. That's another thing to watch. Okay, cool. Anybody else have any comment on moonshots and are they possible today and

11:33 the probability? Dr. Mark Kuhr | Synack: I think they're certainly possible. I think we're on the right path. I think this is trying to get to a place where there's more operational collaboration. So that data is flowing in from public entities or even private companies into government. And those indicators of compromise, indicators of attack flowing in being validated and then sent back out at line speed is where we want to go. We're not there yet.

12:04 It's gonna take time to build to that, But that's where this needs to move is to more operational cyber protection that is active and continuous and really leveraging technology to increase the speed. When we see a ransomware attack and we wanna block it, why can't we do that in five minutes across the whole country? Why? We should be setting goals that are very aggressive, moonshot-like, and attacking these problems with a firm concrete goal of actually solving the problem.

12:35 We've been working around this table for a long time. And I think with CISA's new leadership, we're excited to see what we can do. Joyce Hunter | ICIT: Great. Well, since we're on the topic of CISA, we'll go back to Dr. Friedman. So CISA is leading the charge in federal including the director calling it public-private operational collaboration instead of one-to-one partnering. She said that in her keynote speech last year at Black Hat. What's the impetus for this renaming and why does this encapsulate how the agency is trying to facilitate

13:07 cooperation with industry? Dr. Allan Friedman | CISA: Well, the challenge is the term public-private partnership has been around for a while. And as we were in sort of our pre-event green room, I was recounting the time that I was speaking at a SICON conference, and someone referred to the work that I've been doing over the years as public-private partnerships, and I took umbrage. I was like, no. My work is useful. It's not just this sort of sitting around in a room with the Washington Affairs team from all these big companies.

13:40 And I think there has been a certain approach, sort of saying, "Hey, are we getting nearly as much done?" The director, Easterly, herself referred to the public-private model as being a little hackneyed or stale. And so how do we move beyond that? So, one, we don't wanna abandon these partnerships. Right? There are some great existing high-level strategic discussions. There are technical advisory groups, and we're adding more to them. So there's sort of a hacker board and things like that that's helping CISA understand the complex dynamics.

14:12 But her point is this can't just be about the slow-moving policy side of things. We actually need to have operational capabilities. And that's the idea behind JCDC, which is bringing organizations inside. We can actually have some machine-speed approach, or if not some machine speed, having the operational side of our respective organizations work together. And I think that really paid off in the Log4j response, where we were able to easily connect to the right people in the right

14:42 organizations to make sure we understood the risk to the country and that these private organizations could understand as much about our data and our intelligence as possible. And then, of course, more recently, we have the Shields Up effort in response to the risks that are coming out of the tragic attacks in where we're sort of trying to make sure that we're prepared if there are more targeted cyberattacks against the U.S.

15:12 And again, that's not just having policy people talk. It's about focusing on the operational model. Joyce Hunter | ICIT: And I think you said the right thing, more cyber... It's not if, it's when. Because they're going to come. We just don't know where or how. But so we have to be very resilient in our infrastructure right now. Shawnee, I'm going to start with you on this particular question. Beyond the InfoSec community, what's your favorite public- private success story? Why and how can we replicate and scale that success?

15:45 Shawnee Delaney | Vaillance Group: You know, it's interesting. What I've seen is, outside of cybersecurity, I've seen good partnerships where when companies are dealing with things like massive-scale fraud, or theft of intellectual property or trade secrets, I feel like private sector is more comfortable sharing the findings of their investigations than they are on the cyber front. Specifically, if you look at the tech sector, right? I think a lot of times politicians can vilify tech companies.

16:17 And so the motivation and the incentive for them to disclose or share cyber threats or things that they're seeing, I think it's just kind of uncomfortable. Having companies understand like the benefits upfront, like if you're sharing this with the government, what are the results? What is the government gonna do for you? How is it gonna help me? Also with private sector, you're looking at a concern about leaks and shareholders, right? The government doesn't have shareholders. They don't care about that. It's national security.

16:47 So when talking about successes, like I said, companies are even getting more comfortable now working with federal law enforcement, for example, when they do have these incidents, because I think federal law enforcement has gotten better about publicizing X company shared this information. We went after the person, we're prosecuting the person, they were prosecuted, they went to jail for this amount of time. And so companies are seeing tangible results. They don't think that what they're sharing is going into a black hole.

17:19 Joyce Hunter | ICIT: Okay, great. Steve, what do you think? Your best example? Steve Luczynski | Accenture Federal Services: One that I really like is somewhat new. One of our partners, Dragos, is running the Neighborhood Keeper program. So communications between government and ISACs with industry and the folks that are having these vulnerabilities come up, but anonymized passing back and forth interactions so that where they aren't more open and willing like what Shawnee mentioned,

17:51 they feel like they're better protected, they've got a neutral party in between. And just the fact that folks are willing to do that, again, this kind of goes back to that Cyber Safety Review Board that I mentioned is to encourage that interaction, to encourage the openness instead of hoping she knows a guy that works here and Ferris Bueller's cousin's friend's cousin that can help with this, a formal method to increase the speed, to increase the effectiveness of doing this.

18:21 So I hope as that program grows, getting to watch it mature and the benefits that come out of that for everybody. So that's one that I really like seeing. Joyce Hunter | ICIT: Cool. And let's see, Dr. Kuhr. Any examples that you've seen? Dr. Mark Kuhr | Synack: There are many. There are a couple of major programs that are doing vulnerability disclosure programs. So letting researchers who see something, say something,

18:53 report it without fear of being prosecuted. I think this is a great way to engage that public-private partnership. And then follow on to that more advanced testing, leveraging a community of researchers to do targeted pentesting. The Department of Energy is doing this all over the place in critical locations of their stack. And it's important to be able to find those vulnerabilities and recognize that it's okay to find them. It's okay. We're not expecting everybody to be perfect.

19:24 We want to find all the issues ahead of the adversaries doing it. And so to do that, with our talent gap issues and not having enough staff to do all this work and scale to the number of resources that are online, we have to consider those alternative methods. So I think, you know, agencies adopting both VDP and crowdsourced or community- based penetration testing that is very targeted are gonna be more hardened than those that aren't against a third-party actor. You know, we have to be okay to find these issues and incentivize

19:56 the most aggressive level of testing possible, because we need to recognize that the adversary is, you know, nation-state level, and they're very well resourced. And so it's important to be able to be as close as well-resourced as they are. Joyce Hunter | ICIT: And I think that that's greatly important because, you know, we all know that a lot of the federal agencies aren't sufficiently staffed to do it all, so we do need that private partner,

20:29 public-private collaboration, in order to get over the hump. Dr. Friedman, do you want to weigh in here? Dr. Allan Friedman | CISA: Well, you know, it gives me a chance to plug the partnership that I've been involved with over the last few years, which is around software bills of materials. An idea that has been around for a long time. It was not a new idea, but in order to really take hold, it needed to have a common base, a common understanding of what it looked like. We all use the same software, especially open-source.

20:59 And so what we did at NTIA, where SBOM was based until recently, was sort of pull together the entire software community, security research community, and different verticals. Right? Automotive, medical device, national security, say, what do... What are the basics of what we need to have transparency in the software supply chain? What does the minimum model look like? And how do we sort of do it at machine speed, tell the use cases? And so we were able to... Where the government catalyzed. Right?

21:31 The government pulled people together, but the work was done by the community to define the what, the why, the how, and then industry has sort of taken the ball and run with it. So now while it is entering federal requirements, there are also, every month, three or four or five new startups that I see that are devoted to saying, we can help organizations. We're helping specific sectors. And so it really is building a market around it. Sort of like a... Almost like a hackathon. Writ large, right? The challenge with hackathons is you do it once and no one

22:02 maintains it, Right? It's... They're never really good at promoting long-term solutions. The vision here is that the government can step in to pay attention. And there's a great line about open-source, which is, we used to talk about free beer versus free speech. Now it's about free puppies. Right? How do we make sure that we're following on and have that long-term view? That's something the government really can bring to the table. Joyce Hunter | ICIT: Okay. So so taking that, so beyond the info,

22:32 you look at it, Steve, overall, what can we learn from these successes? What is the art of the possible? What can both public and private do better to facilitate this cooperation? We don't want it to, you know, have this big fancy burst just because we recognize that we're in challenging times. We want this to continue after the challenging times are over. Steve Luczynski | Accenture Federal Services: Yeah. Education is what jumps out, and I'll use the

23:02 same example, but two perspectives, with a little more explanation for that. When I was in the private sector, I was a chief information security officer at a government contractor and standing up that security program, talking about, I don't know, I think the work we're doing in some instances would qualify us for CISA's services and some of the protection, some of the monitoring, things of that nature,

23:33 the services that would help us do better. And as a CISO, free services from the government? I'll take it. I'll take anything I can get to build out this program. But the problem was that the understanding from some other folks that I worked with was like, well, but if we compete for a contract, and what they thought was, and CISA knows where we're weak on cybersecurity, we're behind on patching, you name it, that could count against us.

24:04 And at the time, I didn't know any better. I'm like, that sounds reasonable. Then when I worked at CISA, I spent a year specifically focused on trying to provide the best cyber and physical security services to all the different companies, vaccine therapeutics, diagnostics involved in those efforts, manufacturing, distribution, things of that nature, the hospitals, all the rash of ransomware. And that's where I learned, no, that's not how CISA works.

24:36 That is a misperception that I had and others. And the work that CISA did when I'm actually out there talking to a global CISO who doesn't need some of the simple services but understands, okay, that's an easy thing to do and it's incredibly good value for, at the time when I was at CISA, what's going on in the sector, the health, how well communications, who's patching what, things of that nature.

25:07 But when we would engage with smaller companies that tended to have less mature security, less mature security programs, these services were great. Some were too much, others were just right, gave them lots... And the education part was, yes, I know I'm here from the government, I really am trying to help, and it's okay to talk to me, it's not gonna be used against you. There is extensive separation, extensive

25:37 protections that CISA has in place, and I believe is continuing to grow, which is great to see the recognition for that agency, and I assume it is similar for others, I'm just using this one example that I know, that this is what people need out there to talk to the government. And so seeing that from both sides, it's an education process. The same way you have your on-the-keyboard experts, your CISOs talking to the executives, educating them on cybersecurity,

26:09 it's an education across all those levels. Here's what government can do for you. Here's why we should look for this. Here's why we should help them, whether it's any of the number of things that we've all talked about that are of great value, continuing to educate as those younger folks grow and get into those higher level positions, the appreciation for that having dealt with it and the ability to now leverage that experience and continue passing that on. So any chance to talk about it, to share like this,

26:40 to talk with our partners and see how they're doing it, that I enjoy seeing because again, having lived both sides of it, it's such a difference and it's really a misperception and continuous work to overcome that. Joyce Hunter | ICIT: Interesting. Because I believe that in some areas that it is starting to work, but there's still that little bit of suspicion on both sides, Right? And on the government side as well the public side as well as

27:10 the private side. And I think it's going to take a lot of interaction and getting to know each other. It's the trust model that I think we really have to work on between those two entities. Let's see now, Shawnee. No, Dr. Kuhr. Let's go to you. The most recent mandate from the Executive Office of the President, which is now Memorandum M-22-09, requires federal

27:41 cybersecurity teams to follow zero trust principles. What are your thoughts on the focus on zero trust? Dr. Mark Kuhr | Synack: It can't hurt. I think the zero trust mandate is great in that it not only focuses on zero trust and fixing how we do authentication of users, but is more broad than that. And I think more importantly, it focuses on continuous security testing in the application space. If you think about everything you do on a day-to-day basis,

28:11 it's done inside a browser on some SaaS application. And that's where we're gonna find a lot of vulnerabilities. It's also where most of the changes are happening across an enterprise and even in government apps. So the more we can harden those apps, the more we can push continuous security testing and testing throughout the development life cycle as this pace of development is picking up, the better off we're going to be. And so it's nice to see that the executive order is not just myopically focusing on zero trust,

28:41 but also looking more broadly across the pillars here. We want to build a chair that has four legs, not just one, you know. Joyce Hunter | ICIT: Thank you. Thank you very much. Shawnee, according to CyberSeek data, there are currently more than 597,000 open cybersecurity jobs across public and private sectors. And that's just in the United States. We all deal with pain every day for the talent gap in our industry.

29:11 How can we increase, besides, you know, what we just talked about a few minutes ago when doing a military style trade for education? How can we increase the talent pipeline in our fields going forward? Shawnee Delaney | Vaillance Group: Yeah, so when I was in college, I tutored. I was a literacy tutor at juvenile hall in San Diego, and I will never forget there was this kid who was in juvie for cybercrimes. And I, as I met with him every week and we got to know each

29:43 other at that time in my life, I wanted to be a spy. I mean, that's all I ever wanted to be. I succeeded, but you know, I hadn't gotten there yet. And I just remember like talking to him about these amazing opportunities in the U.S. government. I talked about the NSA and I talked about cybersecurity and I talked about this world that he had no idea existed. And I bring this up because I think the ability to encourage diversity in the field, which everybody, it's a talking point now, but it is critical.

30:13 It's not just women. It's not just people of color. Like we need different mindsets, right? So being able to educate him that he could actually use his skills for good is very, very important. We had a conversation a bit ago about how there are countries now and their military services who are actually investing in students, you know, student age people getting into cybersecurity so that they're building that relationship with the student. They're also determining if that person is a good cultural

30:45 fit, which is a huge, huge issue in this space. I think that the U.S. is failing at this because, you know, while other countries go in and recruit their spies when they're young, the United States needs to go, and call it propaganda, call it whatever you want. They need to go and educate these younger students that there are these really cool jobs out there. And you could go work in human intelligence, you could work in, you know, all kinds of maps, cyber, you know whatever it is. So I think really there's room for everyone in this.

31:17 We're hurting, but we need to start investing in our future. Joyce Hunter | ICIT: Thank you. And you know, interestingly enough, Shawnee, when I went back to my alma mater, and we had this roundtable discussion, and they did some research on campus and found that liberal arts majors, not science majors, not data science majors, not computer science majors, but liberal

31:48 arts majors did better on tests for cybersecurity. Shawnee Delaney | Vaillance Group: That's interesting. Joyce Hunter | ICIT: Yeah. Shawnee Delaney | Vaillance Group: But that's the thing, like, these are people who think differently. I mean not to take more time but when I was being trained in espionage and how to conduct espionage, I took specific courses in how to target mathematicians and scientists and engineers because they think differently. So that just illustrates my point that if we are targeting one type of person, or we're just accepting one type of

32:19 person, we're not going to get these great creative minds, like to your point, who think differently. Joyce Hunter | ICIT: Yeah, yep, exactly. Exactly. Go ahead. Steve Luczynski | Accenture Federal Services: I think we have a little extra time, I'm happy to pile on this one. It's very motivating to hear what you said, Shawnee, and I've shared the same perspective in the sense of appreciating and seeing the value of the diversity no matter what type, skill sets, backgrounds, ethnicities,

32:49 all of those things. I know CISA, under Director Easterly, she's had a great push on those items. The time that I was there was only a year, but it was under Director Krebs that brought together the CISA COVID Task Force. And what was unique about it was using the CARES Act that Congress had passed and those authorities to hire quickly, to hire at different pay levels. And what attracted me was the opportunity to work with other cybersecurity,

33:22 I'm gonna say experts as if I'm in that crowd, but really smart folks, much deeper knowledge, background experience, also healthcare experts, infectious disease, data analytics, big data, all of those things with the government experts in this group very much focused on this national problem. And so you see that creativity of whether it's something like what Mark talked about with Synack, bringing the security researchers, a.k.a. hackers, into this.

33:54 I do a lot of things on my own in my private time, helping to connect government, industry and hackers. So whether it's hiring, Defense Digital does a great job with this, bringing folks in for temporary one- to two-year assignments, that's what I did in a different way at CISA, but any of those things that get people to see the government's not bad, you can do really good things, it's great to see that. And then, yeah, even better, once they get in, they're like, Hey, this is kind of cool.

34:24 How do I do more? I'd like to stay. Great, let's talk. And then, you know, carrying that conversation forward. So same thing, you know, anywhere, like you said, Shawnee, anywhere there's creative ways to do this, I'm excited to see that change and it's really good. And hopefully we can see that continue to grow. Dr. Mark Kuhr | Synack: Yeah, 100%. I'd like to pile on there too. It's one reason we have a crowdsourced model at Synack, just to get that diversity of talent. Get people that come from different backgrounds,

34:54 which is great, but also different ways of learning and educated differently. So somebody self-taught versus formally educated, very different mindset on the problem and they can bring, that combination brings exceptional results. One of the other things that this topic is touching on though, is where we really have a skills gap is in the practical knowledge of how to find these vulnerabilities. You know, I'm seeing, you know, schools, you can go get, you know,

35:25 the fanciest computer science degree from the fanciest school and you arrive day one on the job and they say, hey, go hack into this thing, do a pentest, whatever. They don't know what to do. So the vocational aspects of this should not be lost. We need people that can actually do the job and do that kind of work the same way that the bad actors are doing. We need people that can do that same work. And so I think there is room to shift the education

35:56 programs at our schools and make them more practical, not just the theory of how this stuff works. Because at the end of the day, we need folks that can do the jobs and not just tell us how computers work. So it's I think the other part of this is just one last thing is like, that specific talent that is super hard to find is that reverse-engineering talent pool at that hardware-software boundary where we're talking about really low-level stuff, exploiting the chip and the firmware level, that I think is the most difficult thing to find because

36:28 it requires not only the computer engineering knowledge to know how these things work, but also that hacker mindset. And so, if I had to choose one area to boost funding and beef it up, I think our malware and our adversaries are gonna move to a lower level. And so we need more reverse engineers with a security mindset. Joyce Hunter | ICIT: I think there was one more. Steve Luczynski | Accenture Federal Services: Somebody else have a...? Mark, your analogy, it resonates with me. I went to school, got an aerospace engineering degree.

36:58 When I went into pilot training, nobody cared. Can you fly the airplane? Can you actually use the formulas you learned? Steve Luczynski | Accenture Federal Services: So I totally agree with what you're saying. Dr. Mark Kuhr | Synack: The same thing happened to me at NSA. They were like, "Nice degree, but here's some training." Dr. Allan Friedman | CISA: Well, and so too, if everyone agrees, then we're doing a disservice to the audience. I'll put a slightly different perspective on the table, which is I don't know of any skilled field where you go from education to being useful on your first day on the job.

37:29 So I'm not a lawyer, but every single person I've met is useless to their law firm when they leave law school. And that's a three-year explicit focus on law. And guess what? You're still gonna spend three years just reading documents because that's all you know how to do. And so expecting it is quite tricky, and it's also dangerous. So someone who went to... Five years ago, there were very few programs in software assurance. But someone who got top marks from that program would be fundamentally useless for Mark's startup or Shawnee's

37:59 startup because they didn't learn about cloud-native computing. And they're certainly not trained on the skills to use the tools to move everything to an automated model, which is where we know we... So I wanna be careful about baking in approaches. And by the way, we don't have a good solution to this, but I wanna sort of be careful about sort of emphasizing the pure practical side because what's practical is going to change. Joyce Hunter | ICIT: Now one of the programs that...

38:29 me being a former Fed, was the Pathways Program. And I'm not sure whether any or all of you know about it, but it's a program where a high school student can come in through agriculture or commerce or any of the other departments. And it's a summer program. So they come and that's a way of getting them into the federal government space and getting them to do some different things. And we have found it to be very successful because there's no

38:59 obligation on the other end for that student to come back to that particular agency. But nine times out of 10 they do. They become part of the framework and part of the family over at that agency and they want to come back. And they don't have to go out pounding the streets looking for a job. So the Pathways Program is open and available to high school students, and they even have programs for graduate and Ph.D. students if you look online. So we all want to dream big.

39:29 We have these moonshot ideas. So if we have this conversation a year from now and I want you all to take time and answer this. What predictions do you have for the state of operational collaboration in our industry? You know, what are the... What's the SWOT? The strengths, weaknesses, opportunities, and threats. And we'll start with Dr. Friedman. Dr. Allan Friedman | CISA: I think we've had now, coming up on

40:02 eight months since Director Easterly announced the JCDC, really focusing the operational side in... at Black Hat last year. And, one, again, having her go to Black Hat. And some of you may remember her solving a Rubik's Cube while giving her talk. Pretty badass. It really impressed the press, but also kinda blew away all of the nerds in the trenches here at CISA. So we'll have some idea, and what's great about that is there actually is a pretty

40:33 solid internal retrospection approach of saying what's working, how do we expand it. We've started off with some of the predictable folks to join. How do we make sure that we can sort of pull out... You know, we talked about the importance of diversity. That also works with the operational collaboration side of the organization level. How do we make sure and develop a model for the small business side of things? Because, again, you know, Shawnee may not be able to afford the vice president of Washington public affairs who can just go to cocktail parties all day.

41:03 So how do we make sure that we're actually setting things up with that kind of collaboration? And then the last step that's been highlighted by Log4j and the White House's priority of open-source is making sure that we can engage in that side of things. Right? Not all of the points that we need to talk to follow the traditional model of companies. Joyce Hunter | ICIT: Okay, Shawnee, he called your name in his last statement, so I'll go to you. Shawnee Delaney | Vaillance Group: Personally, I really love the consortium style groups like

41:35 OSAC or InfraGard, right? So you have professionals from both sides of the equation. They're in a trusted environment. There are structured forums, there's training. I give training to InfraGard, for example. And so you get that good collaboration and you have that safe space, if you will. I think that what's really important to understand is this is a crawl, walk, run. This isn't gonna happen overnight. And we have to build it brick by brick, but we are all human. These organizations are staffed by humans. So we have to build relationships between our

42:07 humans, right? I think another thing and kind of to my earlier point is helping private, you know, being a former Fed as well, helping private sector understand that all of this is in the best interest of US national security. You can contribute to helping your country. You might be doing your normal job, but if you do just these little things or collaborate and things like that, you have the opportunity to help the greater mission, the greater good. And I think that's one thing personally that is lacking in the private sector, that sense of mission.

42:38 I do miss that, I'm not gonna lie. That's true. You know, instead of competitiveness, everybody's so afraid on the private side that you know somebody else is going to ****** their idea. Or get sued. Right? Yeah. Or be on the front page of the New York Times. Or the Washington Post. Right. Either one is bad. Yep. Both are very bad. That's not good at all. Joyce Hunter | ICIT: Steve, what do you think? Steve Luczynski | Accenture Federal Services: So the idea is the cooperation and what you

43:10 said, Shawnee, about getting the private sector to understand, that's a good thing and it's happening. My concern, the threat, is that a year from now, things have changed. And I'll even say a year and beyond, people change out of companies, people change out of the government, policies, whatever, these are solid ideas that should be sustained and should keep going so that even when we have a setback, even when somebody says something the wrong way,

43:41 even when it makes the headlines, we all know there's value in it. We all come back together. So that's a challenge for everybody. The willingness to go, yeah, okay, maybe something happens, my name got out there, but I'm still willing to come back and help because I know it's greater good. And we're all gonna learn from that mistake. So that is making sure we have that in place. And even as these known changes occur, we're ready for it and we're still willing to support. And that's what I want to make sure we find ways to do that.

44:13 Joyce Hunter | ICIT: What on earth happened to the term fail fast? We're so risk averse these days. What happened to that? But before you answer that, Mark, what do you think we're going to be a year from now? Dr. Mark Kuhr | Synack: Well, I think it's gonna be about the same, to be honest. So we're gonna be planning to do great things and I hope that we get there. We all have a lot of grand ideas. I think the EINSTEIN program is a good example of that. I think in theory, it's all very good.

44:43 If you could streamline the dissemination of IOCs and IOAs out there and automatically protect organizations, this is where we need to go. I think if we can set the groundwork and like Steve said, making an enduring program and getting the collaboration going bidirectionally, where it's not just the private sector sending in data, but also CISA giving the private sector useful information from their intel sources or even scrubbing NSA, CIA intercepts here so we can get

45:14 some good data. I think that would be super helpful. There has to be some meaningful and useful dissemination of information. It has to be in an automated way. And if we can realize that vision and actually work together as a team, we can make things better. As Shawnee said, there's people in all these organizations and it's important that we do build those relationships. And these people that are setting these up must have a long-term view that we have to actually solve these problems,

45:46 not just talk about them. I think we're all getting a little more gray hair every year as we continue to talk about them. I want to see it resolved. We do have the power to do this. This is not like landing a spaceship on Pluto or something. This is stuff we know how to do and we know what would help. And even the basics, if a 16-year-old can own Okta with some simple ransomware, then we can certainly sort

46:16 out how to do this well. Joyce Hunter | ICIT: It goes back to being in kindergarten, right? Playing in the sandbox, nice together, sharing your crayons, things like that that we, for some reason, have fallen out of line on. And hopefully we can get back there pretty quickly. But I do want to go back to the questions since we do have the time. I do want to go back to the question of so what happened? You know we were doing fine.

46:46 We were talking about failing fast. You know getting these projects agile. What happened? Shawnee? Shawnee Delaney | Vaillance Group: I don't know. I might be a pessimist, but were we doing fine? Like, when were we doing well? Dr. Allan Friedman | CISA: Yeah, I'm with her. When was the golden age of this collaboration that we should hark back to? Joyce Hunter | ICIT: Probably, I would say back in the late 90s, early 2000s, when we were talking about

47:16 doing these projects and failing fast and you know going ahead and making those mistakes and knowing what we were going to do and not kicking ourselves, but continuing to move on continuous improvement. Dr. Allan Friedman | CISA: And and did we? That was my... That's my question. Did we? Did we really? I mean, so I... I'm with you in that if all of your projects are moving forward and none are taking off and

47:46 none are failing, you're doing it wrong. Right? And I'll allow the entrepreneurs here to sort of be more explicit about that side of things. And so I think there is... Organizations like ICIT can actually play a role of highlighting that, right, rather than just having these events, say, hey, listen, this didn't work out, but that's okay, and publicly defending things that don't work. If you don't do that, then we can't do anything, right? Government can't drive that because we have our own incentives. That's on you. Okay. Joyce Hunter | ICIT: Anybody else?

48:19 Catherine, do we have any questions from the audience? Catherine | ICIT: We do. We have a pile of really good questions, I'm going to start with one that seems like it's a logical extension of our last couple of comments. And that is from Joseph. What are the biggest hurdles hindering public-private collaboration? Shawnee Delaney | Vaillance Group: I'll jump in personally. I think from what I'm seeing is there's a lot of trust.

48:51 I also, a lack of trust, sorry. Maybe going both ways, but from the private sector, looking to public, like the earlier points, I think Steve was talking about, you don't know, like if the government's involved, you know, I used to work for ICS-CERT, and it was very common, just like you said, we're from the government, we're here to help. Now ICS-CERT had good success because we were helping people patch vulnerabilities and find vulnerabilities. But we had a tangible

49:21 act, you know, people knew what we were gonna do. I think building that trust is super important. And yeah, like I said earlier, I think that's just going to take time. Joyce Hunter | ICIT: Okay, next question, Catherine. Catherine | ICIT: Absolutely. So our next question comes from Michael. Your group and the Solarium Commission both advocate greater public-private partnership.

49:53 What are the exact steps for a tech startup in Austin to engage federal agencies? Dr. Allan Friedman | CISA: So I get notes from... Couple notes from startups every day. And, right, the challenge is what are they looking for, and what are we trying to get out of things? So one is it's a big government, and so I'm only working on one part of it. So the part of the challenge is, right, hey. They just see government.

50:23 They saw me give a talk at Black Hat or something. So they're like, "I will reach out to Allan." I can't help that. So that's one of the challenges that we have also given that last question is saying, hey, it's not efficient for a random technocrat to know everything that's happening in the entire U.S. government, so we need some models around that. And the other challenge is, right, there are organizations... So here at CISA, we... We've worked hard to build out our stakeholder engagement community, but at the same time, they're not the technical folks. And so that's one of the challenges there.

50:54 So the second is sort of having something clear. So probably a third of the folks who reach out to me want biz dev. And guess what? That's part of the reason why government is often not trusting the private sector is because once I speak at an event, I'm going to sort of get nonstop emails of, hey. We see that you're the government. We'd love some of those great federal contracts. So that's sort of how something else structurally needs to change. And the last thing is on the government side,

51:24 having that clear path to say, hey, this is what we're doing. This is how you can help. And these are the expectations. We love your engagement. We love your perspective. But we have to take your perspective and map it to all the other perspectives. So you're not going to be able to drive this unilaterally. And so I think those three perspectives of having everyone have those expectations are gonna be really important. Joyce Hunter | ICIT: Great. That's a great answer, Dr. Friedman. I know when I was in the federal government, the same thing. You go give a speech and everybody's ringing your

51:55 doorbell or your phone and saying, I'm so and so, and I wanna do business with the Department of Agriculture. Yeah. What do you want to do with the Department of Agriculture? So you're absolutely right. The people who want to do that absolutely have to do their research. Know everything you can possibly know about the agency so you can target where you want to go, what you want to do, how you want to do it and why should they care.

52:27 Okay, Catherine, next question. Catherine | ICIT: This is a follow-up to the question we just had. How can contractors to the government assist their clients in developing collaboration efforts? Additionally, what security concepts do you believe are the most critical to prioritize when assisting federal clients?

52:58 Dr. Allan Friedman | CISA: So I don't work too much with federal contractors, but I just wanna share a little security truism that I came across recently, which is sooner or later, all cybersecurity problems become information management problems. And that's something that we need a lot of help with, especially as we develop new ideas and new technologies, saying, okay, we've got this wonderful capacity. We wanna empower automation, but how do we move the data around? So that's something that I think

53:28 we need some help with across the administration. Joyce Hunter | ICIT: Okay. Yes, and I would agree with you there. Catherine, do we have any more questions? Catherine | ICIT: We do. We're gonna keep going. This one is for Shawnee, a follow-up from your comment about trust. How do you build trust with your colleagues and clients in a zero trust environment? Shawnee Delaney | Vaillance Group: Million-dollar question.

53:58 Hey, no. I know, right? Anyone else? No. Again, Shawnee Delaney | Vaillance Group: I'm a human person. I used to be a spy. So I focus on the people. It's relationship building and we can't automate human relationships. So it's proving you do what you say you're going to do. It's respect, you know, when you are, I don't know, being truthful, like just being a good person, right? Being a good organization and helping, going above and beyond, really thinking outside the box.

54:30 All of those things, I think, build upon that trust. It's hard, it's hard. Especially again, not to harp on culture, but you're dealing with very different cultures, not just between public and private, which are polar opposites. I mean, look, look at insider threat, for example. It is mandated that all government entities and contractors working with the government have an insider threat program. Yet in private sector, nobody has it. Like, people are just now starting to do it. So the mentality is different. And then you get in different industries and the culture is

55:02 totally different. And then within that industry, each organization and each company is totally different. So it's the government understanding the language that that person is speaking or that organization is speaking and vice versa. You're never going to be able to speak and build that relationship if you're talking to each other at different places. I don't know if that made any sense. Steve Luczynski | Accenture Federal Services: I'm with you. And you know, the thing about the question, I think I'm gonna say apples and oranges because I'm on a computer network and I'm not just freely roaming around

55:33 because I've logged in one time with a basic username and password. That's the concept behind zero trust. But once I talk to you and you're like, yes, that's Steve. Yes, I know he has his act together. What he's offering, what his company does, his reputation, his company's reputation, the partners they work with, all of those things are what makes you want to work with me, whether it's me, Steve, on my own as a startup company,

56:03 or as part of like me, part of Accenture, the government, whatever it is, you might go to that single person or you'll go to that company when that person leaves because you know the reputation it's been built up. So there's a very big difference and don't let the trust word cause confusion there. Shawnee Delaney | Vaillance Group: I agree. It's kind of, you got to think about it kind of like dating, right? When you are dating someone, you are gonna do your due diligence. You're gonna ask them the right questions to find out if you are a good match. And it's the same thing, right? You don't trust initially.

56:34 You shouldn't trust initially. And with each date, you're learning more and more. Steve Luczynski | Accenture Federal Services: Starts at zero trust. And in that case, it goes to lots of trust, but that's a very different situation. Shawnee Delaney | Vaillance Group: Yeah. Shocking that I'm single. Joyce Hunter | ICIT: Before we get ourselves into trouble, Catherine, is there one more question? Catherine | ICIT: Yes, last question. How do you solve the disconnect between the tactical side and

57:06 the strategic side regarding a sense of urgency? Steve Luczynski | Accenture Federal Services: I will gladly jump on that grenade. I had to translate from the technical folks on the keyboard at Cyber Command to the generals and the high-level policy folks. It's not easy. The good news was I had to learn both. So being able to say, explain it to me like I'm four years old was very helpful so

57:38 that at the lower levels to get me to understand the technical and do that translation and it's understanding what both sides are looking for. What are your policy and strategic concerns so I can go address them and get the answers from the technical side? What is it at this level that's affecting you at the technical level? And it is an art. It's not easy to do at all, but I definitely appreciate the experience in the private sector. My analyst on the keyboard, the CEO and the board, what they needed, same thing in government and even now in the work that I do.

58:11 So it's an art form that takes some time to learn, but I do appreciate the value of it. Joyce Hunter | ICIT: Well, we are out of time, but I really would like to thank our panelists: Dr. Allan Friedman, Steve Luczynski, Mark Kuhr, Shawnee Delaney, and our sponsors, both Synack and Accenture Federal Services. We look forward to seeing you all at our in-person spring briefing. Yay! Playing to Win: Using Strategy to Create Your Cybersecurity

58:42 Battle Plan. It's on April 6 at the Ritz-Carlton in Pentagon City. Go to icitechbriefing.org to register. Thanks again. Have a good day. Live long and prosper. Nice. Thanks, everyone. Thanks, you guys.

No lines match that search.