Season 3 Episode 20

Lt. Gen. Lori Reynolds on the evolution of cyber warfare

Guest:
Lt. Gen. Lori Reynolds
Published:
Duration:
34 min

Episode summary

Lieutenant General Lori Reynolds’ (Ret., USMC) career journey from a Naval Academy graduate to a key figure in cybersecurity and information warfare illustrates the progression of military communications and cyber operations. Initially commissioned as a Marine Corps communications officer in 1986, Lori’s career took her from managing traditional radio communications to leading the Marine Corps Cyberspace Command. 

Tune in to hear how she played an important part in integrating cyber operations into the Marine Corps’ combined arms approach and later spearheaded efforts to create a comprehensive information warfighting function.

Listen to learn more about: 

  • How China’s cyber operations have become more sophisticated, quiet and focused on long-term strategic positioning
  • Why the threat now extends beyond cyberattacks to include technological exports and influence operations 
  • How Russia and other state actors are also engaged in hybrid warfare, operating below the threshold of conventional conflict

 

Listen to the episode

S3 E20 · Lt. Gen. Lori Reynolds on the evolution of cyber warfare WE'RE IN! Podcast · 34 min

Key takeaways

  1. Communications and cyber are different jobs Communications officers build and defend networks, while cyber operators can also attack. Lori calls them close cousins but stresses that one is not the other.
  2. Each service brings its own culture Rather than creating a separate cyber force, she argues every service should have its own cyber experts, with the Marine Corps contributing a bias for action and a warfighting culture.
  3. China now hides and waits China has shifted from loud, clumsy intellectual property theft to quietly embedding in critical infrastructure, as seen with Volt Typhoon, which she sees as a sophisticated form of deterrence.
  4. Future conflict stays below the threshold Hybrid wars kept just below the level of declared war will play out in cyber, space, and the spectrum, and she says the U.S. must adjust to that construct.
  5. Narratives can threaten financial stability From her bank board seat, she warns that deposits can leave a bank very quickly based on bad information, making information campaigns a real risk.

Notable quotes

…it's not the big that eat the small, it's the fast that eat the slow.

You never learn while you're talking. You learn when you're listening, right?

We may never declare war because they'll keep it just below the threshold where any president has to declare it.

…deposits can leave a bank very, very quickly just based on bad information.

Questions this episode answers

What is the difference between military communications and cyber operations?

Communications officers build and defend the network, while cyber officers can also attack. Cyber operations add the ability to maneuver in cyberspace as part of combined arms planning. Read this section

How do the service cyber components work with U.S. Cyber Command?

Each service defends its own part of the DoD information network under a common commander, and also provides cyber forces to combatant commands. Marine Forces Cyber directly supported Special Operations Command with defensive and offensive teams. Read this section

Should the U.S. create a separate cyber force?

Lori argues against it, saying each service brings its own culture, experience, and history to the cyber fight, and that every service needs its own experts in the domain. Read this section

How has China's cyber threat evolved?

Around 2018 to 2020 China was loud and brute force, focused on stealing intellectual property. Today it is more sophisticated, quietly embedding in critical infrastructure and waiting, as shown by Volt Typhoon. Read this section

Will AI help cyber defenders or attackers more in the next year?

She gives the near-term nod to defenders, who can use data to find anomalies, for example in anti-fraud and anti-money laundering work, but worries about attackers using AI to weaponize vulnerabilities quickly. Read this section

Full transcript

00:01

Intro

Carry nearly 80 gigs of data in my head.

00:03

Intro

Getting the mainframe. It's eating to great entire system.

00:06

Intro

Access is coded. Gigabyte of RAM should do the trick. We're in. In. We're in.

00:13

Intro

We're in. We're in.

00:15

Blake Thompson-Heuer

Hello, and welcome to We're In, a podcast that gets inside the brightest minds in cybersecurity. Today, I'm excited to welcome lieutenant general Lori Reynolds to the podcast. Lori was first commissioned as a communications officer in the US Marine Corps, where she went on to lead a distinguished thirty five year career culminating in her assignment as the deputy commandant for information. Now retired from the Marine Corps, Lori serves on the board of directors for a major banking company and is vice chairman of the board of trustees for the American Public University System. I can't wait to jump into our conversation, but first, here's a quick word from our sponsor.

00:50

Sponsor message

Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution. The Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.

01:32

Blake Thompson-Heuer

Well, thanks so much for joining me on the podcast, lieutenant general. Really appreciate having you here.

01:37

Lori Reynolds

Oh, it's great to be here. Blake, thank you for the invitation.

01:40

Blake Thompson-Heuer

Of course, of course. I'd be curious to kick things off, if you could walk us through what led you into the security and cybersecurity industry. Your educational background, I noticed, is in poli sci and national security policy. So curious how you went from there to infosec.

01:54

Lori Reynolds

Yeah, it's a great question. Well, graduated from the Naval Academy and I learned at the Naval Academy that my strength was in the history and English parts of academia. I learned that really fast. I was commissioned as a second lieutenant in the Marine Corps. And, you know, Blake, in 1986, when I graduated, there weren't a ton of things that women could do in the Marine Corps. And I knew only that I wanted to be a platoon commander and I wanted to maybe someday be a company commander. And one of the jobs that enabled that for me was the communications MOS. And in the Marine Corps, communications at the time was push to talk radio, maybe multichannel radio. Today, it is obviously and clearly much different.

02:45

Lori Reynolds

So I grew up in the Marine Corps as a communications officer.

02:48

Blake Thompson-Heuer

Very different kind of communications than my communications with Synack, which is a little more critical on the communication side for you.

02:55

Lori Reynolds

Yeah, it's really important to make that distinction. So sometimes you say communications and people think about strategic communications or public affairs or It wasn't that. It was install, operate and maintain a network so that your commander at whatever rank can communicate with his or her own forces or those up the chain of command. So that's what I did for the first probably twenty five years of my career.

03:20

Blake Thompson-Heuer

So fast forward, I do have some questions about your assuming command of Marine Corps Cyberspace Command. Let's start with the basics there. For those unfamiliar with the mission of Cyberspace Command, how did your work help to enable the warfighter?

03:35

Lori Reynolds

You know, US Cyber Command, when I took command as a component commander, meaning the Marine Forces Component Commander, it was 2015. And I served there until 2018. But this was relatively early, like in the days of the cyber force. Until US Cyber Command was created as a component then of US Strategic Command, we really didn't have a force that was dedicated to operating and defending, creating cyber forces. Now, it's kind of important probably to say that when we're talking about cyber and what US Cyber Command does, it's about maneuvering in the information environment. It is about either operating or defending, attacking or defending. While what a communications officer does is build the network.

04:26

Lori Reynolds

Your job is to build and defend. And they offer that only because a lot of people think that cyber is communications and communications is cyber. And while they're, I think, they're really close cousins, communications officers don't have the ability to attack. Cyber officers do, right? So how does a cyber operator enable the warfighter? Obviously, using intelligence to defend the network, to maintain a secure network, again, all part of what a CAMO or communications teams do, but I think they do that in partnership. But I think also increasingly we have more and better capabilities to actually add cyberspace, the ability to maneuver in cyberspace as part of a combined arms construct. So the Marine Corps is really big on this idea of combined arms.

05:20

Lori Reynolds

So how do you integrate ground operations with aviation operations? Where does the logistics piece come in? Where does naval gunfire come in? And increasingly, how do you use space and cyber as part of that combined arms kind of planning and execution to achieve whatever your mission may be. And what I think I would offer there is, you know, from the time that I was a commander, trying to figure this out really for the first time, very early in the delivery, no kidding, of cyber operations.

05:54

Blake Thompson-Heuer

I think we're all still trying to figure out cyber operations years later.

05:58

Lori Reynolds

Yeah, no, absolutely. And it's really good. Like, is hard. It is a journey. Are we doing more very interesting things in cyberspace right now? Yeah, I think we are. Do we have it to a point where we can synchronize it in time and space? Maybe. But that's hard. But it's definitely an asset to the warfighter, right? The ability to at least temporarily have overmatch in the cyber domain is really important.

06:25

Blake Thompson-Heuer

Absolutely. No. And I appreciate the kind of two tiered distinctions you made there already. One between the strategic comms that I was talking about and the more tactical comms out in the field. And then in addition to that, the difference between comms and the fact that you have a cyberspace command capable of going on offense as well when the situation calls for it. Sounds like it was a bit of a shift for your military career as well. What was that like starting something new and going in a little bit of a different direction?

06:53

Lori Reynolds

That too is a really good question because I think for the last six years of my career, so I spent 2015 to 2018, and very clearly the commandant at the time when he sent me up to Marine Forces Cyber in 2015, and he sent me up to Mar Force Cyber, he said, Lori, go figure out what the Marine Corps is doing in cyberspace. Right? Because there were a lot of people back then saying that's not what Marines do. Right? Marines don't do cyber. We're like a close with and destroy. We're like at the pointy end of the bayonet kind of team. So my job was to figure out, number one, you know, are we organized properly? What is this cyber thing? How can we properly integrate it into the rest of the Marine Corps? But then really, what is our role? What is the Marine Corps role in cyberspace? And Blake, there are a lot of people right now, there are a lot of studies that are happening that say that maybe we should have a cyber force like we have a space force.

07:50

Lori Reynolds

Maybe we shouldn't leave it up to the services to figure it out. Maybe we should just create a cyber force and let them go. I would argue that every service brings their own culture and their own experience and their own history to the cyber fight that is relevant and necessary. In the Marine Corps, we bring a bias for action. It's kind of an attack and a constant readiness mindset. And I think it has been helpful to US Cyber Command to help bring a war fighting culture to cyberspace. So I would be in the camp that says, let the services do what the services have to do. I think it's very difficult. Cyber isn't everything, as you well know. There are cyber threats in every piece of kit that we have. There's the information environment that we have to fight through.

08:41

Lori Reynolds

So I would argue that every service needs its experts in this domain. From 2015 to 2018, you know, my job was to figure this cyberspace thing out, figure if can we get on target here? Can we figure out how to do war fighting in this domain? Taking what I learned there in those three years, I put on my third star and I had another smart commandant, General Bob Neller, who said, We need to figure this information fight out. As a three star in the Pentagon in my last three years, my job was to create the information warfighting function, which is how do you best bring together cyber, space, influence, intelligence, communications and strategic narratives, Blake, yourcom, strategic narratives.

09:32

Blake Thompson-Heuer

A little bit of strategic narratives in there. Appreciate the shout out.

09:35

Lori Reynolds

Yep. Right. Yep. It's not unimportant today, especially. Do you bring all of those things together in a comprehensive way and then compete more effectively in the information environment?

09:48

Blake Thompson-Heuer

No small task. Yeah. No small task.

09:50

Lori Reynolds

Yeah. Really, for the last six years, my job was to kind of bring this different kind of way to think and compete to the Marine Corps. Not easy because the Marine Corps, as I have said, we are the first to fight. Most Marines are in their first term. They're between the ages of 19 and 23 years old. Their job is to be ready, ready, ready. Right? Their job is to be forward deployed, to give our nation's decision makers decision space by being on the ground today. Right? That's our job. This whole information fight is kind of a different animal. How do you begin to bring these different thoughts into that culture?

10:34

Blake Thompson-Heuer

I think as a civilian layperson here listening to some of your points, it makes a lot of sense. Right? You have different skill sets sitting with different branches of the armed forces, and it's not like you give the US Air Force exclusive domain over the air domain. Right? Like, you have other services touching that. Similar to cyber, everybody's gotta operate to some degree in cyberspace. It's just the world we live in now. And that comment segues well into my next question, which is how did you coordinate with the other branches of the armed armed services and with US Cyber Command writ large to avoid duplication of effort or just to to be as effective as possible?

11:10

Lori Reynolds

So the way that they organize the force in US Cyber Command is, number one, each service is responsible for defending its own terrain. Right? So you start there. But in the defense of what we call the DoD information network, the DODIN, So think about the Marine Corps network, the Army network, all of those networks as a DODIN, DoD information network. We all contribute and there is a common three star commander who also works for the four star US Cyber Command. So in defense of the DODIN, we all provide our own forces and we defend our own networks. So that's job one as a cyber service component commander. Job two is to provide cyber forces to the other geographic combatant commanders that are all around the world, right?

12:01

Lori Reynolds

So, think the commander of Indo Pacific Command out in Hawaii, commander of European Command, Southern Command, Northern Command. So the whole globe is broken out geographically. And then you have functional commanders like Space Command, like Stratcom, like Transportation Command, like Special Operations Command, who's also a global. So, each of the service cyber components are assigned to multiple geographic combatant commands. My job at Marine Forces Cyber was to provide direct support to Special Operations Command. So I created cyber protection teams to defend SOCOM's network, And we created offensive teams at the time to provide support to Special Operations Command's missions.

12:52

Lori Reynolds

Now, it has changed over the years. I'm giving you kind of the way it was. It continues to evolve, I think, because cyber continues to evolve. But that's how it's worked. You're given tasking by US Cyber Command and you have these direct support relationships to the other combatant commanders that are out there. And then you are inside their staff, you're providing support to their missions. You're defending their networks. That's how it works.

13:18

Blake Thompson-Heuer

That's helpful. And stepping back to your own career for a second, I read that you're the third woman to have achieved the rank of lieutenant general, three star, in the Marine Corps. What was it like to climb the ranks?

13:31

Lori Reynolds

Well, it was fun. I mean, I certainly wouldn't have stayed thirty five years if I didn't enjoy working with Marines. And really, Blake, I'll just say that that's what keeps you in. You just can't imagine working with a more focused or mission driven or just extraordinary group of Americans. I loved being a Marine and I loved working with Marines. I feel like I got really lucky. You know, I mentioned that I was in an MOS, a military occupational specialty that enabled me to command and in the Marine Corps, if you want to be successful, you have to command. You have to stand in front of a formation and you have to be in charge and you have to do well. It was good. It was a good run. I I as a lieutenant colonel in command, I took command in Kuwait and then deployed twice into Iraq, into the Fallujah area.

14:23

Lori Reynolds

And then as a colonel, it just so happened that the command that I took over that was going into Afghanistan. And so in that capacity, as a CO of what was Camp Leatherneck, which was the furthest Western US camp that adjoined a British camp. So I worked for about a year with British counterparts and I had, for the first time as a woman, having an area of responsibility, I had what we call an AO assigned to me, not because I was a woman, because I was the CO of the camp, but that happened to be a first. And then I was selected for General Officer right after that. And then just because the cyber thing was coming up and because the timing worked for me, I was able to stick around a little while.

15:14

Lori Reynolds

We just promoted our fourth three star in the Marine Corps. And while the Marine Corps is a very small organization, we should be further along than that. Well, I'm proud of what I did, but I wish we were further along, quite frankly. We lose a lot of good women. Think it's hard to have a career, to do well, to command, to have a family. So it's very, very difficult, and people make tough choices.

15:38

Blake Thompson-Heuer

If a young woman came up to you and was saying, hey, I read up about the marines, super excited about the mission set, seems like a really interesting crew of people, What would you say? What would you say to somebody who might be considering enlisting?

15:53

Lori Reynolds

I would encourage them with a ton of enthusiasm. I loved it. I really did. And listen, when I came into the Marine Corps after graduating from the Naval Academy, there was a few MOSs. There was a few specialties then that where where women could do what I was able to do. Like, there is nothing they can't do right now. Everything is open. Women couldn't fly in the Marine Corps. We have three astronauts right now. They wouldn't allow us to go aboard ship. And back in the late 1980s, the way you made your mark was go aboard ship with the Navy. That's what we do. We're forward deployed. And by policy, women weren't allowed to do that. Combat exclusion is no more. You can go do what you got to do. And I think that's appropriate and right, but it's just a righteous mission.

16:47

Lori Reynolds

Go defend this nation. That would be very encouraging.

16:50

Blake Thompson-Heuer

Well, and I think you kind of alluded to basically a lot of progress that's been made on that front. And I think kudos to you for helping trailblaze that pathway. I mean, really, that doesn't just happen automatically. We don't just advance as a nation or as a armed services brand. So I think for listeners, I'm sure they appreciate the contributions that you've made on that front. And do you think that the cyber industry needs to invite more diversity, whether it be of gender background, thought, professional military experience? And if so, how?

17:23

Lori Reynolds

I think diversity is really important. It's not, you know, I think about diversity from a mission perspective. I want the input of as many different types of people as I can possibly get. The fascinating thing about cyber to me, and the thing that I used to talk about in Recall all the time was, it does not respect lines on a map. It does not respect borders. It does not respect any of that. So you fundamentally have to rethink how you organize your brain to get after cyber operations and to think about opportunities that might be available for cyber operations. And in that case, I want one of everything. Think about a toolbox. Think about having every tool available to you for whatever your problem might be. That's the name of the game with cyber.

18:14

Lori Reynolds

It's across whatever kind of diversity you might think. Being a cyber commander, listen, I have to tell you, I understood communications. I did not understand cyber. There's so much signals intelligence that goes into it. There's so much all source analysis. There's so much legal that goes into it. There's so many pieces that contribute to a really healthy cyber environment. And I had to learn that while I was in command. And what it really helped me to understand is I needed to know, as a commander in cyber, who was blocking my access to the good ideas that were out there, right? So when you think about hierarchical organization where colonels are keeping their Lance Corporals or the lieutenants from making it into the boss's office, I needed to break those barriers down because I needed the good ideas.

19:05

Lori Reynolds

Right? So, the good ideas are coming from the youngsters and they're coming... Right? So, that's a long answer to a short question, but I...

19:13

Blake Thompson-Heuer

No, no, it's a good answer. Yeah.

19:14

Lori Reynolds

You need access to every perspective and every experience that might be out there.

19:21

Blake Thompson-Heuer

Well, and it's funny you say you knew relatively little about cyber. I feel like even just by acknowledging that, you probably just made yourself a better commander. I'm only skeptical of somebody who comes in, you know, hasn't been around that long as a domain, really, like really, especially cybersecurity. And so anybody who claims to know it all is... I just have my doubts.

19:39

Lori Reynolds

It goes to, like, you never learn while you're talking. You learn when you're listening, right? And so if you're doing all the talking, you're not getting smarter. Humility really is the name of the game.

19:49

Blake Thompson-Heuer

We've spoken a little bit about some US operations and our setup and how we're kind of preparing in the cyber domain. Let's talk about our adversaries and some of our competition here, so to speak. I've read a little bit about some of China's influence of hacking operations in The US. How has that threat evolved in recent years?

20:08

Lori Reynolds

It's really fascinating to see the path that China has been on. I think in the early twenty twenty, maybe in the late eighteen, nineteen, they used to be very loud on the network. They were very loud, very clumsy, kind of brute force kind of approach. But it was all about stealing intellectual property, right? It was about competing with us as a nation, whether it's in the defense industry or whether it's just snatching data because they knew AI was coming or snatching our data because they're in a quantum race, right? But it was they didn't really care if you knew they were coming. They just grabbed it. And today, I would say that China is a little bit more sophisticated than that. And I think we know, given, you know, what's been publicized about Volt Typhoon, that their approach is different.

21:02

Lori Reynolds

I wonder, Blake, if enough people really have wrapped their brain around what Volt Typhoon really means in terms of much more quiet, embed yourself in the critical infrastructure of your nation's adversaries, and sit and wait, right? Collect still as much as you can, but you will wait. So that is a much more sophisticated deterrent than other forms of deterrence, right? And it speaks to the vulnerability that we have as a democracy, where we still need the American people to have the will to fight back. But if you take down the banking industry or if you take down the water industry or if you take down the electrical grid, will we have the focus and the attention and the will to be able to stop China from doing what they want to do?

22:00

Lori Reynolds

So, it's just a much more sophisticated approach. That's on the cyber side. I think think about Huawei Technologies and TikTok and the threats that those companies, state owned enterprises, in partnership with the CCP, where they are either helping to export autocracy. Think about smart cities and things where it's all about control of populations. And oh, by the way, all that data goes back to China anyway. These are much more sophisticated approaches. And I think you just have to understand them and realize what this strategy really is so that you can effectively counter it. And then finally, would just say on the influence side, I think that there was a Microsoft report out today. Microsoft has a threat analysis center that's doing wonderful work. Clint Watts and his team.

22:50

Lori Reynolds

They're involved in kind of down ballot races with influence operations for politicians who may be either pro Israel or anti China. So are they out there? They absolutely are. But anything that they can do, I think, to undermine our trust in our judicial system or our election system or democracy writ large, they're going to do it.

23:17

Blake Thompson-Heuer

I know that recent analysis from the Microsoft Threat Analysis Center that you alluded to also cited in anticipation of election day, some influence efforts by Russia and Iran as well. Let's talk about the threat posed by Russia. We've seen them obviously carry out this hybrid war that Moscow brought to Ukraine. Obviously, the physical component of that rightfully takes precedence. I mean, you're not gonna have cyber operations that eclipse missiles bearing down on your cities and horrible ground invasions. I mean, that's just a totally different animal. But that said, from a US perspective, what should we be looking at from that? And what should we be preparing for given that we're probably likelier to see Russia in the near term, at least, hopefully, knock on wood, in the cyber domain?

24:00

Lori Reynolds

Well, I think we're learning a great deal, obviously. I think Russia has a lot of game. State sponsored malicious cyber actors who are doing many things, are very aggressive, very active. And again, without the state owning the problem, but certainly, you you think the rise of ransomware and all those other things that are going on that kind of keep our attention focused here. But I think on the Ukraine side, again, Ukraine is a struggling democracy, but they're a democracy, right? And so the information fight is real there. I think we're also watching a lot of electronic warfare, and we're learning a lot about how Russia might approach a larger war. But I think you have to take a step back even from that. I personally do not believe that China or Russia want to go into a conventional war with The United States.

24:57

Lori Reynolds

Phew. Yes, but we are optimized as a military force. We are optimized as a nation to know when we're at war and when we're not at war. We know when we, like, when, you know, when we're at war, you know, it's we're going to go try to win that thing. I think we need to really understand that for Russia and this idea of hybrid war, it's fighting below the level of what they would call a conventional war. We used to say below armed conflict. But my goodness, what's happening in the South China Sea with The Philippines? It's a conflict and it's armed, but it's not war, right? I mean, so we have to understand, I think, that war in the future is going to look very different. We may never declare war because they'll keep it just below the threshold where any president has to declare it.

25:53

Lori Reynolds

So we have to I think we have to wrap our brains around that. These hybrid wars where, you know, it's just this low level, maybe escalating every once in a while, where they take a shot and then we come back down. That's kind of the step. That's the way it's going to be. And it'll be in cyber and it'll be in space and it'll be in the spectrum. There'll be all these areas that I think increasingly are war fighting domains, right? Cyber is a war fighting domain. Space is a war fighting domain. I think we fundamentally just kind of have to take a step back to recognize that this isn't World War II. It is a fundamentally different construct for how great powers are competing and sometimes finding themselves in conflict. And what does that mean? What does that conflict piece look like?

26:42

Blake Thompson-Heuer

Side note, I'm glad you gave a shout out to Spectrum. I feel like on this podcast, we haven't talked enough about Spectrum and preserving access to that in general. That... And maybe that's the comms the comms background and you coming out a little bit because that's something that that is is really fascinating to me as far as, like, crowding that out, disrupting ability to communicate. Anyway, I'm sure we could go down on a whole Hey, tangent there,

27:06

Lori Reynolds

you know, Blake's spectrum is a finite resource. Yeah. And we are a hyper connected society. And so it is just getting harder and harder and harder. And in particular, it's very difficult, especially with these hybrid wars, because we're used to, as the biggest guy on the block, to going into another nation and owning the spectrum. That is not how it's going to be. We're going to have to kind of figure this out. And there's lots of pieces to the whole spectrum competition, I think, that have to do, by the way, commercial race that we... The commercial competition that we find ourselves in as well. China is, you know, probably ahead of us with a five gs fight because they own more spectrum and they can do more with the spectrum than our commercial companies have been able to do.

27:58

Lori Reynolds

And we'll figure that out eventually, but it'll cost us some money. This is all part of the competition.

28:03

Blake Thompson-Heuer

Absolutely. And just to muddy the waters even more, we have AI thrown into the mix. A question that I like to ask, do you think that AI will, on balance, help cyber defenders or attackers more in the next, say, twelve months?

28:20

Lori Reynolds

I'd have to say that at least in the next twelve months, it's going to most help the defenders. And I think this is really about, you know, how we more effectively use data to find the anomalies. You know, I happen to sit on a bank board right now where we're really looking at anti fraud, anti money laundering, those kinds of things where AI can be a great value. So, really, think in the near term, it's all about how do we optimize it for defense. But I do... It scares me a lot what smart attackers can do. Because as you know, Blake, the cyber fight is a fight about... It's all about speed. You know, it's not the big that eat the small, it's the fast that eat the slow. You know, if you can smartly use AI to kind of weaponize vulnerabilities, if you have an access, then it's...

29:16

Lori Reynolds

So it's gonna be... It's gonna get sporty, to answer your question, I think, the near term. The nod goes to the defense.

29:22

Blake Thompson-Heuer

Now, casually mentioned there that you sit on a bank board. I would be curious to hear some of what you've been up to since retiring from the Marine Corps as lieutenant general. And I do have a follow-up question about boards, but I wanted to let you bring us up to speed on what you've been up to lately.

29:35

Lori Reynolds

Yeah, thank you. I sit on a couple boards. I sit on a bank board learning so much. It's opened my eyes wide open. It's a phenomenal board. And I also sit on a board at the American Public University System. So an education, online education that has principally served service members. And I'm a little passionate about that one because I really believe that education is going to be what allows us to win in this competition. It's all about making service members smarter and more technology enabled. So education is really important to me. What's interesting, Blake, I sit on the risk committee and the cyber and technology committee of fairly large bank, and I've learned so much, but it's, you know, where my two worlds come together here is that if an adversary can bring down our financial system through cyber, through an information campaign, by the way, I think increasingly we have to pay attention to these narratives because deposits can leave a bank very, very quickly just based on bad information.

30:40

Lori Reynolds

And this narrative competition that we find ourselves in is one that we've really got to get a handle on. Look at what happened during Helene and the disinformation around FEMA. FEMA is not a political organization. They're there to help people, right? I mean, so if you really kind of take a step back and go, what in the world? That is a wake up call for anybody. And how do you guard yourself against those kinds of campaigns in the AFP?

31:09

Blake Thompson-Heuer

That's a tough one. That's a really tough one too, because there's no silver bullet for that kind of thing. I'm glad you mentioned education. I think that's a huge component, just making sure that we arm ourselves with the best, maybe not literally arm ourselves, but figuratively arm ourselves with that educational component to be able to suss out what's real and what's fake. Really interesting discussion. Really appreciate your time here today, lieutenant general. And finally, I do have a question that we ask of all of our guests, which is what's something we wouldn't know about you just by looking at your LinkedIn profile?

31:39

Lori Reynolds

Probably that I'm the youngest of five girls and I'm still the youngest of five girls, right? Still the baby in the family and I know my place in my family. I'll leave it at that. That's not controversial at all, but

31:53

Blake Thompson-Heuer

I'm sure some of our listeners will know exactly what you mean by that. So

31:56

Lori Reynolds

Yeah. You can be a lieutenant general and still be the baby in the family. It's all good. It's all

32:01

Blake Thompson-Heuer

That's great. Yeah. Well, thanks again, Lori, for joining me. Really appreciate it and great discussion.

32:07

Lori Reynolds

Alright. Thank you. Appreciate you having me.

32:09

Blake Thompson-Heuer

If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.

32:40

Sponsor message

We're in is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.

Enjoyed this episode? Browse all WE'RE IN! episodes →