Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Defense Digital Service Acting Director Katie Olson on drones, DEF CON and Hacking the Pentagon
Guest:
Katie Olson
Published:
Updated:
Duration:
37 min
Episode summary
Defense Digital Service Acting Director Katie Olson heads up a team of about 80 technologists working on some of the toughest challenges facing the U.S. Department of Defense. Since Katie started leading the team, often called the Pentagon’s “SWAT team of nerds,” it has increasingly focused on the threat from drones, cybersecurity risks in space and the consequences of climate change. In this episode, Katie talks about this cutting-edge work, how DDS helped the Pentagon reduce the impact of COVID-19 and what big issues her team will tackle next. Why you should listen:
Learn about some of the most cutting-edge work going on inside the Pentagon.
Better understand emerging threats such as drones and risks associated with climate change.
Hear how DDS helped the military rapidly deploy technology to reduce the spread of COVID-19.
Bug bounties exposed major blind spots DDS has run about 30 bug bounties over roughly five years and found more than 2,000 vulnerabilities from low to critical severity across DoD organizations.
Researchers can report without fear The expanded vulnerability disclosure program lets anyone report a flaw in a DoD public-facing system without retribution, part of treating security researchers as partners.
Energy management is a security problem Discovery sprints showed energy tracking is left to individual bases working with local utilities, which leaves gaps in both energy visibility and cybersecurity practices.
Hacking space systems informs design DDS and the Air Force ran satellite hacking events and a Mars rover simulation at DEF CON to learn how quickly someone could gain remote control and what that means for future equipment.
Recruit where technologists actually are DDS hires across the US rather than only near the Pentagon and uses LinkedIn, Twitter, and Instagram instead of traditional job boards, guided by its Break the Code playbook.
Topics covered
Attack Surface Management
U.S. Public Sector
VDP
Notable quotes
I just felt like it was where engineering meets art.
…wouldn't you rather have those people working for you… and helping to… secure your perimeter before we have something at that scale?
…if we're just treating it like a utility problem and not a cybersecurity problem, we're missing the boat…
We need confidence in the data and the algorithms that we're producing.
Questions this episode answers
What is the Defense Digital Service?
A team of about 80 highly technical people, mostly from the private sector, including designers, product managers, engineers, and data scientists. It surges for the Department of Defense during a crisis, then finds long-term owners for what it builds. Read this section
What is Hack the Pentagon?
It was DDS's original program and, at the time, the first federal bug bounty, inviting outside researchers to test public-facing DoD assets. Katie notes that such assessments are now commonly accepted at federal, state, and city levels. Read this section
Are hackers more willing to work with the government now?
Katie believes attitudes are shifting, pointing to strong interest in the satellite hacking events at DEF CON. She sees space as an opportunity for white hat hackers who want to contribute to national security. Read this section
How should the government approach AI and machine learning for security?
Katie says the department first needs confidence in its data and algorithms, ensuring data is accurate, usable, and interoperable, along with the talent to analyze it and good hygiene practices. Read this section
About the guest
Katie Olson joined the Defense Digital Service in 2019 and, at the time of recording, was its acting director, leading a team of about 80 technologists and reporting to the deputy secretary of defense. She is the first woman in the DDS leadership role. She previously worked for the City of Chicago for about eight years and ran the City Tech Collaborative, a public-private partnership.
And I'm Jeremiah Roe. Today, we're talking to Katie Olson, acting director for the Defense Digital Service, the Pentagon's self described SWAT team of nerds.
She's heading up some really interesting work on drone security and trying to figure out how to improve cybersecurity for satellites. Yes. Space can be hacked. We'll talk about that and more. But first, a quick word from our sponsor.
WE'RE IN is brought to you by Synack, the premier crowdsourced platform for on demand security expertise. Synack delivers 20 fourseven testing, intelligence, and vulnerability management from a global network of researchers whose work is enhanced by smart technologies to accelerate your critical cybersecurity missions. And now here are your hosts, Bella and Jeremiah.
Yeah. We're really looking forward to to getting to chat with you today. So, let's jump right into it. You are the acting director of the US Defense Digital Service. Can you tell us what that is and how it fits into the rest of the Defense Department?
Sure. DDS is a team of about 80 highly qualified or highly technical nerds. We are mostly from the private sector, although we do have some, people who come to us from careers in government and the military as well. Typically, the profile is what you would see on a software development team. So designers, product managers, engineers, and data scientists. The goal of DDS is to surge for the department when there's a crisis. And when the work is done, we find long term owners for the products and services that we've stood up.
Right. You know, there's been a couple of what I would call technology crisis crisis within the department where we sort of realized there's a missing technology gap. And then, of course, the crises that we've been experiencing on a national and global level. So, for example, during the pandemic, the Navy reached out to DDS because they had sailors aboard ships without enough doctors or masks, and we're very far away from a vaccine. So they wanted a solution for triaging cases. So we built an app for them in about forty eight hours that they, is still in use by both the Navy and the Air Force. And at one point was supporting, I think, three dozen bases and and ships, and people logged their symptoms, and it would tell the, the services to quarantine people who had a COVID exposure. So we were able to keep the the numbers of of cases down, especially in in tight quarters somewhere like a ship.
Another example from the pandemic, during operation Warp Speed, we partnered with the National Security Agency on this cybersecurity mission around developing the vaccine. So those are examples of of crises where DDS was in place as a as a highly qualified team of experts to be able to surge quickly and develop solutions that weren't otherwise readily available.
That's wild. I can't imagine when you said developed an app in forty eight hours. I feel like that would be the most intense forty eight hours. But what is it like... And I'm just thinking about this. Like, what is it like after you finish one thing before you get the next crisis? What is that in between period?
In the in between period, there... I would say we we turn our attention to more slow burning fires, if you will. So for example, a big portion of our portfolio right now is counter UAS. So countering small drones, UAVs. And that's a crisis that was, identified initially by secretary Esper when he was the the secretary of defense. And we absorbed a team in early twenty twenty, so right before the pandemic, which is, you know, great great time to, to onboard tons of people going into a sort of work from home situation. But, we we onboarded this team that allowed us to focus on how we sense, display, and defeat drones that are, you know, both CONUS and and OCONUS, you know, bases around the world. So in the in between time, we do have a steady portfolio of things like that are, if not impacting us currently, going to impact us at a at a pretty large scale.
The threat really is is you have these, you know, unmanned aerial devices where you can be... You know, the operator is obviously very far away from from the device, and there's always the risk of of what the the drone might try... You know, might be carrying. For example, increasingly, we're seeing changes in protocols, in speed, in direction, in their range, you know, how far from the operator they have to be. So what we're trying to do as as DDS is, you know, continuously improve the sensing capability of of where the drone is, but also create a good user experience, frankly, around the around what the user is seeing, you know, if they're doing sort of force protection or base protection so that the user can see what is coming and choose sort of the adequate defeat mechanism.
I just kinda wanna back up a minute because because that's that's that's also a little bit tied to hack the pentagon. Right? The hack the pentagon program. I was wondering if you could speak a little bit more to that for the listeners.
Sure. So hack the pentagon is probably DDS's... I think it's DDS's original sort of original program. The first thing that we we stood up when we became a team in twenty fifteen, twenty sixteen. So hack the pentagon is a... It was at the time the first federal bug bounty program. Now I think we we... There's pretty common acceptance, in the federal space and at the state and city level as well around, conducting intentional cybersecurity assessments, having outside researchers look at public facing assets such as websites. But at the time, it was a very novel thing to do, especially, you know, sensitive place like the Department of Defense to intentionally expose assets to outside researchers to, you know, to perform as a cybersecurity assessment.
So I've been following DDS for quite some time. I think that they do some fantastic work. And in following DDS and a lot of the initiatives that have that have taken place going forward, how have you seen, things change from inside the Pentagon to some of the defense branches from the air force to DARPA? How has that benefited across the board for you all, the collaboration between the branches, and for the general public?
We've worked with army, air force, and a number of organizations within the DOD, and we've run about 30 bug bounties over the, you know, the span of the last five years or so and discovered over 2,000 vulnerabilities ranging from low to to critical. So from a perspective of what we've done within the department, I think we've we've really created an awareness of of of huge blind spots. So that's sort of one piece. The second piece, and and we're seeing this in a... You know, especially with a mission like Operation Warp Speed, we've had the opportunity to collaborate with other federal agencies such as DHS and the CISA team. So we've been able to... Especially, you know, Operation Warp Speed is actually a great example of where we did bug bounties, you know, again, in sort of service of creating a a safe vaccine. So I think in addition to bringing better security within the department, we've also taught other agencies how to do the same thing with with their assets.
And, you know, and then to your to your question about what have I sort of seen change within the department. So I've I've been here about two and a half years. And even in the the span of that time, you know, however short, I've I've seen a number of really important changes. I I do think that increasingly, probably honestly facilitated by the the pandemic, we are seeing just increased awareness and attention to cybersecurity, which is which is great. You know, one of the things that we did, you know, early in my tenure is expand the VDP program, the vulnerability disclosure program, which basically allows anyone who sees a vulnerability on a DOD public facing systems, maybe a website, for example, to report it without any fear of retribution. So that's that's huge that, you know, a hacker would be able to come forward with something they found and and not be penalized for what they might be trying to do or trying to gain access to.
So I I think I think we're seeing a greater acceptance and and even a partnership with the security researcher community that we we want to work together to make our assets safer.
And how does that, like, relationship, that partnership, and that different culture, how does that help improve security for y'all, but also, I think, for the entire field?
So I I think there's a community of best... There's sort a community of interest and best practices that are are certainly springing up. You know, again, we have sort of Operation Warp Speed and the pandemic to thank, and really the election as well, to thank for sort of accelerating those partnerships. With the election, for example, again, we worked with CISA to build a true... A tool called CrossFeed, which scans for sort of... Does sort of automatic scanning for vulnerabilities within within various systems. And that was critical for for their use during election. And then, you know, operation warp speed, there was the VDP program. We also have been, you know, partnering with them as well on things like protected DNS. So what we're what we're sort of doing is is even if DDS or DOD is not the the ones originating the pilot, although often we are, as a community of cybersecurity experts across the federal agent...
Federal government, we are working together to build a body of best practices that whether it's internal or with the companies we work with, we can increasingly adopt policy around to, you know, to ensure that we continue to utilize these best practices.
And so with with that in mind, especially when touching on something so sensitive as potentially identifying things that can be exploited that happen to maybe touch on national security matters and maybe very secretive matters. What kind of culture shift are you seeing with the help of DDS pushing the Pentagon and Department of Defense forward in these in these initiatives?
It is a it is a really delicate area, but what I've seen shift in in my in my time here is making, you know, again, to making security researchers the good guys that we're we're hire... You know, we're hiring them. And you see, you know, expanded expanded CISO offices, and you see, you know, teams like DDS. You know, we had one security researcher, and now we have several on the team. And and we're... We even have some details from from other organizations within DOD that want to come here and learn how to how to do this work better. So I think what the biggest shift is this concept that wouldn't you... You know, it would be better for us to check our defenses first before we have some kind of major breach. And certainly, we've seen, you know, getting nationally and and globally a number of breaches throughout the past year that have been, you know, quite extreme.
You look at something like SolarWinds, for example. And I think that the idea is, wouldn't you rather have those people working for you, you know, and helping to, you know, secure your perimeter before we have something at that scale?
I know you have a background in city planning, and you worked for the city of Chicago for a while. Does that experience play into how you're thinking about your current job or cybersecurity generally?
Absolutely. So I worked worked for the city of Chicago for about eight years or so for the city directly. But then I also ran a public private partnership called the City Tech Collaborative, which was similar to DDS in the way that we partnered with government to bring, and in some cases, develop the best commercial technology, pilot it with the city of Chicago, demonstrate effectiveness, and then scale. And the lessons from that have informed my time at DDS tremendously, starting with good user design and and good user experience. Many, many projects that we did in the city of Chicago, would have gone a completely different direction if we hadn't done what we call DDS, a discovery sprint, where we embedded with users to understand what the problem actually was.
We could be going down the completely wrong path or the completely wrong approach unless we embed with users. So there's that... This user design and experience piece of it. There's also this... You know, just the whole concept of piloting, and the city or DOD doesn't need to rebuild something if it's a commercially available solution. Conversely, we don't need to buy a commercially available solution if it's a simple spreadsheet, if it's a simple... Something that can be solved with frankly better talent within the department. So, you know, I think a lot of my experience in Chicago also informed the choices that we encourage DOD to make and that we at DDS make around when do we build, when do we buy, and when do we acquire.
What are some of the kind of cybersecurity specific things that either do come up or that could come up when you're working on a project for users. What's something that you would learn when you talk about users that's specific to cybersecurity?
A good example is the work that we're about to embrace in the climate space. Climate is a priority of the deputy secretary and the secretary and should be something that we're all thinking about. And what we've done in... Or discovered in our initial discovery sprints that we've been doing in this space is that energy tracking and energy management is really being left to the individual base. So, you know, we have bases obviously around the country, around the world, and they have individual energy managers that are working with a local utility to understand usage and as well as to kind of govern the cybersecurity practices or measures. And that one is sort of concerning from the perspective that we don't have a complete picture of our energy usage as a department, and therefore makes it challenging to set real goals to reduce our energy consumption and our our reliance, which I would also argue as a...
Our reliance on energy is is also a national security issue. But then there's the... There's also a piece that, you know, if if we're just treating it like a utility problem and not a cybersecurity problem, we're missing the boat and and we're not, we're not bringing some of those best practices to bear at scale if we're leaving it up to the individual base level to think about cyber and think about usage.
So was my first DEF CON experience because I joined the team in 2019. And the first year I was in Afghanistan working on a different project. The second year was virtual. So, you know, I participated virtually. So this is, you know, two years into my time at DDS. It was the first time I was able to be in person, and I loved it. I just felt like it was where engineering meets art. And just some of the most creative people I'd ever met, including people from my own team that, you know, I was just like, I don't know you could do that. Should you be doing that? So it was it was just like very... It was very, very fun for me to just to meet that whole community and to, yeah, just watch very creative, people kind of run wild with with engineering.
And and, you know, the goal, I think, is really to expose, you know, back... Bringing it back to cybersecurity, what that means from a cyber perspective. You know, if an engineer is able to hack into something, gain control of something, what does it say about, you know, some of the public or private systems that we have?
So I went to DEF CON this year too. This is, I think, my third or fourth time going. I remember the first time I went way back when, you know, before there was a pandemic. And it was mind boggling to me because it's so massive and so huge. And it's interesting, like, if you look at any of the DEF CON culture sort of spread, how it how it started from its initial phases until where it's at today, it's overwhelmingly massive now. And you can get so much out of it. It was just blown. My mind was just reeling with so many potential avenues and opportunities and and things I just never thought of from, you know, a a both hacking perspective, like you said, policy perspective, and really unique ways of thinking about new problems in the space across all industries.
You know, I'll be curious to see what they do next year and future years. I should say if there's... If the risk of, you know, pandemic ever goes away because I I think, you know, it is a community that has been pretty closed, from my understanding. But by having some sessions virtually, there were, you know, participants from all over the world. So I think even one of our... You know, we ran a couple of hack a satellite programs in partnership with the air force. And I I want to say that, you know, one of the winners was from South Africa or something and, you know, that wouldn't have been able to attend otherwise. And so I'll be curious to see how the community evolves in this virtual, you know, in person hybrid.
I have not been to DEF CON. Maybe one year. Not sure. But I know a little bit about it. I know that at one time, feds were not really welcome at DEF CON. And there's a well known game of spot the fed at hacker conferences. But do you think that that attitude has changed and that security researchers are now becoming more open and willing to work with the government on national security efforts?
Well, hack hack the Fed or spot the Fed is funny to me because I feel like, you know, the joke in DC is like everyone is just always wearing their badge around to... You know, for self importance. So I'm I'm sure there's there... You know, it's a hard habit for people to break. So I'm... I I don't know how hard that game would be. But but I I think, you know, to your point about the the willingness to work with government, I do think I do think that's shifting. You know, we went two years in a row virtually and then in person this year with the air force because there is interest in the community about just space in general and and space is the next frontier. And that's something that, of course, we're seeing sort of personal, you know, Elon Musk and Jeff Bezos and and to people exploring it at a personal level. But for now, the the primary, you know, experimenter or pioneer or tenant of space is is really the government.
But, you know, how we're designing that technology and certainly where it intersects with some of these geopolitical questions can only be done via the government. So I think that there there is interest in seeing the assets that we have and and, you know, for those white hat hackers who want to contribute to national security, it's a huge opportunity to to look at some of the the architecture that, and sort of the way that our, our assets in space are designed and to to do the scan for vulnerabilities.
I'm a huge space nerd myself, so I'm just gonna stay there as long as I can. The hack the satellite initiative that first came about was was a sort of a thing that doctor Roper worked in tandem with on multiple levels to get that to happen and was commonly referred to as Hack-A-Sat. Right? That was so interesting to me. And I remember when there were talks or buzz around that whole process. And I know somebody in the in the space community who I was chatting with randomly about that one day. And they were like, he's gonna do what? Where? Yeah. Yeah. What's what's the program name? I'm like, I have I have no idea. I don't know what's going on. It was like it was like there's so much pushback to that because it's just never been done. Yeah. And now it has, and I think there's been some great benefits from that.
Yeah. No. Absolutely. One of the, you know, one of the things that we brought to DEF CON this year was a simulation of the the first Mars rover. And it was... The goal was to allow people online. And this is one where the sort of... Again, the virtual has its its benefits. It allowed people not in the room to try... The the goal is for them to gain control remotely, which is, of course, what you have to do if you're trying to hack into something in space because, you know, you're going to not be in space also. So, you know, those are the types of experiments that we want to, one, just sort of teach people about so that, hopefully, we're building a generation of engineers and researchers that are thinking about not just... That are thinking about technology in a totally different environment, but also we can bring those learnings back to the DOD to say, guess how quickly someone was able to gain access of of this satellite and to reposition it or to reposition this rover.
We've talked about how beneficial some of this all virtual has been where, you know, more people are able to participate and and, like, kind of increasing that culture of of, you know, getting hackers to work with the government. What are y'all doing to increase diversity in cybersecurity, particularly in the government? And what role can the government play in addressing the, you know, the issue of the lack of diversity in cybersecurity as a as a field?
So we as a team value diversity and inclusion. And even before the pandemic, we made the decision that the top talent... That we made the decision that we would hire all over The US and that the... Not to see of ourselves at the top engineering talent is going to live in DC near the Pentagon. And we pivoted quickly in 2019 to... And in 2020 as the as the pandemic emerged to recruiting top talents from a range of backgrounds across communities throughout The US. We also developed a tool, or playbook called break the code, which is is proliferating throughout the department, for how we recruit and how we hire differently. So most government jobs, you see a position description that has, you know, government that has this sort of what the the grade is and how much you're being paid and and, you know, demands that you have x y z skills.
And we start to think about in terms of, you know, what what do we want you to do? What are the types of work that we want you to accomplish? You know, are you a a designer? Are you, you know, an an RF engineer? So we think... We try and think differently, and and we don't use those more traditional platforms like USA Jobs or, you know, we use LinkedIn and Twitter and Instagram, and and we've used a number of of platforms over the course of the past two and a half years that I've been here to make sure that we're finding, you know, remaining technologists where they are, which is usually not USA Jobs and not always in DC. I'm hopeful that that also goes a long way towards improving our diversity and inclusion because we're making sort of a... We're creating a flexible, welcoming environment that supports a variety of family situations.
There's a specific recruiting, thing that the Biden administration did, and obviously, you have no no clue whether your team suggested this particular approach or not, but it was it was, it was a really cool thing that they did on trying to, identify and hire individuals towards the cybersecurity team that they were looking to fill. And at the time, if you looked at the source code at the back end of the page
I'm a huge fan of Easter eggs, and I remember finding that because I saw it come about. And I try to stay plugged into cyber cybersecurity topics as much as I can just because I, you know, I I live and breathe kind of this this stuff. And I'm I'm always looking at stuff.
You know, think this administration has worked hard to increase, in particular, the number of women in in leadership positions. So I report to the deputy secretary, so it's the first female in the position, doctor Kathleen Hicks. There's a new female administrator at USDS. I'm the first woman in the DDS leadership role. I think there's there's also hopefully a... There's good momentum and and a community of us emerging, which is which is great.
Why is it so important, particularly in the work that you're doing, national security, cybersecurity, why is it so important to have diversity in those conversations when we're when we're working on this stuff?
Well, it's important for a number of reasons. One, we need the diversity of of skill sets. There are all kinds of problems that emerge within DOD and then back to the conversation about cybersecurity across the the federal government that we need to be prepared for. So I think in in terms of the engineering and technical talent, we need to be really comprehensive in terms of the skills that we're that we're bringing on. But I also, you know, again, a user experience perspective, it's helpful to have people who represent different geographies, different politics, different cultural backgrounds because we need to be able to talk to our users, and we need to be able to make relationships and communicate with the the people that we're intending to use our products. And and we can't do that if we all look the same way.
What are some of the things that that we can do to... Just as an industry as a whole, right, that we can do to improve pathways for underrepresented groups?
But one of the things that I also saw at DEF CON, which I I really appreciated, is you you have these sort of side forums. You have Blacks in Tech. You have Queer Con. You have all of these forums within some of these more larger established events or organizations that say, hey, there's a space for you here. So I think as we're developing conferences, again, whether virtual or in person or continuing to run large events, I think that's important to, in some way, signal that, you know, if you are, you know, a member of a minority group or female or, you know, in some way feel like there might not be a place for you traditionally in tech, it's important for us to signal that not only is there a place for you, but you are sort of uniquely positioned to help us think about things in a different way.
One of the things that I've seen across the industry to that very point there is that underrepresented groups tend to find folks more willing to help thrive in this industry in a lot of ways. There's still things that we need to flesh out and fix across the board. And I'm I'm I'm always curious to hear what what others think those are because, you know, I think I don't have the answer. And I know I know there are a lot of people that... But collectively, you know, we can come together and develop the way forward.
I I I really appreciate that. I I appreciate the the, know, the the devils and the details. Absolutely. So I appreciate you asking that question. And when I look at our team, for example, we have what we call the... A guild system. So communities of practice, engineers, data, design, etcetera. And within those groups, that's... So those groups are set up. So one, we can share resources. And if we're finding a project, it's short some engineers, you know, they sort can talk to each other and and figure out who might have cycles. But I think the smaller groups are also where, you know, you might see... Or even, you know, on the project level too, that's another sort of smaller group where you might see people not necessarily trained in, you know, in sort of inclusivity practices.
They're talking over each other. They're not, you know, they're not as willing to... Or they're not used to someone's communication style. And so they might not be taking advantage of their skill set in the full way. So I think for us, there's opportunities at the project and at the community of interest level to have real conversations about are we are we truly building environments where people can be heard, where they can contribute their skills, where we're being patient with some of the flexible work situations that they might need. So I think it's not it's not just thinking about teams or organizations as a a whole and saying, we have really balanced numbers, but what are the, you know, what are the practices at the at the working level that might present opportunities for, you know, people, people in the majority to correct some blind spots and and really have the benefit of hearing from their colleagues who might be, you know, marginalized for one reason or another.
This climate work that we're embarking on is a really huge opportunity for the department to be forward leaning as a major consumer of energy to... You you can't track what you can't measure. So to get a better sort of better handle on how much energy we're using and then to set real goals in terms of sustainability or infrastructure. So I think that's that's an area that we're working on and really excited about. I think another area that we're supporting the deputy's office around is this data and AI space. For DDS, we're not necessarily... We won't be the ones to build a big data platform, for example. But because of all of the work we've done on the ground and where we run into challenges across a variety of projects, we are well positioned to inform the department on where basic tooling or infrastructure or talent is needed to be able to pursue some of these larger, goals, JADC2, etcetera.
So I think those are two areas that we'll continue to dive in on over the next year or so. It's really, you know, at a minimum, thinking about climate and then thinking about how do... You know, laying the conditions for for leveraging data essentially.
I know there are these huge budge... Buzzwords recently around around AI and machine learning and and sort of automating these detection mechanisms or automating offensive processes. What are your direct thoughts around those things and automating, you know, maybe a simulation around attackers or automating detection mechanisms and utilizing machine learning and artificial intelligence to close that gap?
We need confidence in the data and the algorithms that we're producing. So we need to ensure that the data that we're collecting, managing, and using is accurate, that it's usable, that it's interoperable. So I think I'm excited about the possibility of those things, but I do think that we need to build underlying trust in the data that we're that we're amassing. And then we also need different types of talent to process it, analyze it, look at it, and, you know, utilize it in some way. So I'm excited about the possibilities, but I think we as a department, and as a federal government need to spend time really thinking about good hygiene practices in that space as well.
You talked a little bit about identifying areas of threat that, you know, should be focused on as a whole going forward. What happens when you identify those areas? How do you stand up? Like, how do you work with other areas of the government to stand up more long term areas of focus or solutions, things like that?
It's a challenge for a for certain because when you're in the middle of a crisis, you can't and shouldn't be thinking about where does the funding come or who's going to sustain this long term. And when we were in the middle of the pandemic and the Navy asked for the COVID tracking app so they can start to quarantine people, it wasn't the time to figure out if it would be in a in a budget cycle somewhere or if, you know, could the Navy sustain in perpetuity. But as we stabilize the product, it was absolutely appropriate to, one, do an after action on why did you need DDS to stand that up? Is there somewhere within the services or the DOD that would be positioned for health tracking tools in the future?
So there's an after action on what was lacking that DDS had to be called in in the first place. And then two, for the tool that we actually built, are there places where it would continue to be useful? And again, what are the talent tooling and infrastructure that would be needed to sustain it? So the COVID tracking tool, for example, as the services get into the biometric and and health tracking space for troops and, you know, we we all have this sort biometric watches, smartwatches, things like that, that might be a really interesting application. So the question, I think, coming out of these crises is what can we do better next time so that we can continue to solve this or ideally be positioned ahead of the crisis to address it? And then two, what are the the things that we've learned or the the products that we've built for the crisis that can have an...
I will ask you the the final question, the potentially easy question. What is one thing that we would not know about you just from looking at your LinkedIn profile or other like online presence?
Well, I think I think you can tell from most of my online presence that I'm an avid runner. So Kathleen, our comms director says to to say that I just got engaged, that might not be immediately obvious. So
That's awesome. Thank you so much for for for talking with us today. That was that was really cool. I I don't know. Know, like, Jeremiah, I feel like you're so plugged in with everything that is going on with the government. I will admit that I'm not, and this was really interesting for me.
Great. And I I enjoyed being on and I thought you guys had asked really great questions. And obviously, the the work that we that we do is is is... We feel like it's critical and
Yeah. Cloud cybersecurity is a large penetration point for malicious actors. See how your organization can be at synack.com. That's synack.com. Check out the show notes to learn more.
