Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Mara Winn on protecting America’s critical infrastructure from cyberthreats
Guest:
Mara Winn
Published:
Updated:
Duration:
36 min
Episode summary
A first-of-its-kind 2016 cyberattack on Ukraine’s power grid was a wake-up call for countries around the world to shore up protection of vulnerable energy resources. Mara Winn, Deputy Director for Preparedness, Policy, and Risk Analysis at the Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER), is in charge of acting on just that. From securing electric vehicles to safeguarding electric substations, Mara and her team help to ensure the resilience of the energy sector against cyber, physical and climate-based disruptions.
Mara takes a holistic approach to risk management, considering both physical and cyber threats. In the latest episode of WE’RE IN!, she cautions against focusing too much on the “flashy object of the day” and describes why she imbues diversity in risk management for the best outcomes.
Listen to hear more about:
Why early implementation of security measures in product development is necessary for distributed energy resources like solar, wind and battery technologies
How to educate investors, entrepreneurs and designers about understanding the full risk picture in business decisions
The role of the National Association of Regulatory Utility Commissioners and the Federal Power Act in defining federal and state responsibilities in the energy system
Listen to the episode
S3 E9 · Mara Winn on protecting America’s critical infrastructure from cyberthreatsWE'RE IN! Podcast · 36 min
Key takeaways
Risk is threat, vulnerability, consequence CESER works with the intelligence community on threats, federal and private partners on vulnerabilities, and asset owners on consequences, then funds research, training, and response where gaps appear.
Training creates a defender community CyberStrike grew from lessons learned on the ground after the 2015 Ukraine grid attack and has trained more than 1,500 people. Mara says the lasting benefit is a peer network defenders can call when something looks suspicious.
Don't chase the flashy object Focusing on one company or component feels tangible, but adversaries simply move to whatever product is most popular. Mara favors systematic approaches like consequence-driven cyber-informed engineering.
Build security into DERs early Distributed energy resources involve many owners with different understandings of risk. Mara urges investors, entrepreneurs, and designers to plan security for the size they expect to reach, since each device is an entry point to the grid.
Consistent baselines beat a patchwork With NARUC, CESER developed cyber baselines for distribution systems and DERs so states considering regulation, and unregulated developers, share one view of what good looks like.
Topics covered
Talent Gap
U.S. Public Sector
Notable quotes
I think the biggest risk is getting stagnant in our resilient measures.
An adversary will just move on to the next one, Our adversaries are not paying as much attention to an individual component or entity. They want to know what's most popular.
But if you are making business decisions without looking at the full risk picture, then you're not really making good business decisions.
The adversary doesn't sit down and say, okay. I'm done learning for the day.
Questions this episode answers
What does the DOE Office of Cybersecurity, Energy Security, and Emergency Response do?
CESER works to keep the energy sector secure and resilient against cyber, physical, and climate disruptions. It analyzes risk, funds research and development, runs training, and coordinates the federal response when incidents happen. Read this section
What is the biggest threat to US critical infrastructure?
Mara said the biggest risk is becoming stagnant in resilience measures. She stressed protecting the crown jewels against climate, physical, and cyber threats together. Read this section
What are the security challenges of distributed energy resources?
Instead of one operator controlling a plant, many parties with varying risk awareness run DERs and virtual power plants. Building security in early is the most cost-effective approach, and small companies should design for future growth. Read this section
What are the energy sector cyber baselines developed with NARUC?
CESER brought together utilities, state organizations, and federal experts to create cyber baselines for distribution systems and DERs, so states do not end up with a patchwork of requirements. Anyone can download and use them, regulated or not. Read this section
What is the Liberty Eclipse exercise?
It is a CESER exercise on Plum Island, building on the DARPA RADICS program, where national lab red teams attack utilities playing fictitious utilities so participants experience what a cyber attack does physically to the power system. Read this section
About the guest
At the time of recording, Mara Winn was deputy director for preparedness policy and risk analysis at the Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response (CESER). She holds degrees in physics and engineering and has worked in radiological and nuclear detection, medical device development, and at the Department of Homeland Security, including the Cybersecurity and Infrastructure Security Agency and TSA. She is a mother of two teenagers.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer. And today, we have a very special guest on the program, Mara Winn, deputy director for preparedness policy and risk analysis at the Energy Department's Office of Cybersecurity, Energy Security and Emergency Response or CESER. Mara is a bit of a renaissance woman holding degrees in physics and engineering, gaining experience in radiological and nuclear detection, and even developing medical devices in the private sector before going on to lead teams at the Department of Homeland Security and now the Department of Energy. But a common thread in Mara's career is a keen interest in managing risks facing some of the most critical infrastructure we all rely on each day. I expect Mara and I will cover a lot of ground from grid cyber threats to China linked advanced persistent threats, but first, let's hear a quick word from our sponsor.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.
Lots to talk about. And so you're deputy director for preparedness policy and risk analysis at the Energy Department's Office of Cybersecurity, Energy Security, and Emergency Response, otherwise known as CESER. So I... I'd like to hear more about what your work entails. But first off, for listeners who may not be familiar with CISA and and what it does, what can you tell me about The Office and its mission?
Sure. Besides that title, I swear, being the longest on record. It's a very long name when you say out everything. And as you said, we do call ourselves CESER. It's much easier in that way. But, really, CISA's mission is to focus on the energy sector and make sure that it is secure and resilient from cyber, physical, climate based disruptions. You name it, we're an all hazard shop. And we look from cradle to grave. So, CISA is looking at what are the actual risks. And risk is threat, vulnerability, consequence, right? So we need to work with the intelligence community and understand what threats are out there. We work with all of our federal partners and private sector partners to understand the vulnerabilities. And then we work with our private sector partners who actually own and operate that infrastructure to understand the consequences. And this allows us to really think through how do we work and prepare as a nation for that secure energy infrastructure.
We then, if we're finding that we don't have the right tools and mitigations, CISA also does research and development and deployment activities. So we can partner with private sector, universities, national labs to try and get the right solutions out there. We know that it's not easy fixing the problems in this space, and so you need as many great minds as possible. But at the end of the day, you also need training and workforce development. These are hard problems. We want to make sure those who are hands on keyboard, physically on-site at our utilities are prepared and know the latest to be able to react. And then finally, when the bad day happens, we are the response organization, too. When the hurricane comes through, we do the federal government coordination. When the cyber attack happens, We're doing reach back and support to make sure that we're able to repair and restore the infrastructure and get recovery back in place.
Well, it's interesting that you joined, CESER. As as I understand it, you spent part of your career with another kind of security focused agency on dealing with a lot of these issues at the Cybersecurity and Infrastructure Security Agency or CISA. What can you tell me about the different cultures at at CESER and at CISA? I guess both agencies are relative newcomers to to the federal space. So how would you compare your experiences there?
Sure. Well, I I do think here, while CESER itself as an organization is relatively new, the mission space has been around for a while in the department under various other office and organizational structures. But but really, I I think DOE elevated it to its own office, recognizing the importance of the work. And more CISA really looks across all 16 critical infrastructure sectors and tries to to think of that more cross functional holistic approach as well as their sectors that they're the sector risk management agency for. You know, we and CISA are diving in deep into the energy sector. And I have to say it's a lot of fun, right? Because in this energy sector, and I know you spent time working and looking into the sector, you're the underpinning of the nation. We like to think that the rest of the nation can't function without us, which gives a sense of gravitas, a reason to be connected and for the importance of making sure that we're safe and secure.
It also brings together all of our private sector partners as well because they also appreciate it. So you get a lot of fantastic commitment and focus in... On the work here in CISA, and it allows you to to get a little more targeted direction as well, is which is pretty great for me.
As you were alluding to there, Mara, I used to cover the energy space quite closely in my role as a reporter and later editor at a publication called E and E News. And I always used to joke, even covering it from an objective standpoint or whatever, I always had a pro energy bias in the sense that when I turn on the lights, I kinda want them to work. And being a digital only outfit back then, it was a little bit important. And I guess that kind of maybe flicks up my next question of cyber workforce challenges. These can kind of persist in the in the in the private and public sectors of attracting talent, and it can be sometimes especially challenging for government agencies to recruit the really top tier cyber talent. How do you navigate that at CISA, and and how have some of the recent moves, I guess, by the White House or other groups impacted that ability to attract and retain talent?
It is hard because everyone is in need of these skills. But I do believe that we have a special sauce here in the energy sector in that we are transitioning at a record pace, and we're able to hook into a lot of that entrepreneurial spirit in the distributed energy resources to get people in and focus in on the energy sector. But it's still hard, right? I mean, most of our sector utilities, especially our small ones, I mean, even on the electricity side alone, we have over 3,000 different utilities across the country. And a lot of those are really small rural co ops and municipal governments, and it's hard to attract the right talent there. But one thing that we do know is that we can try and entice people who have the skill set already, but we can also upskill those who are there.
And that's one of the things that we focus in on in the department. I have a couple of programs that we look at. We have CyberForce, which is where we get the excitement in the collegiate space to be able to engage with those who are in process of their education. And I use that term pretty widely because the last CyberForce, I think we had people there from universities, colleges, community colleges represented, and people from all walks of life. And so those are our next generation. And getting them engaged in the energy sector work is to show them how fun and exciting it really is. You're solving real world problems. These are real on the ground issues. It's not some fictitious place somewhere else. And also, defending is hard.
Right? So you talk about some of the offensive side of cyber, and that's exciting. But there, you get to plan it out here. You don't know when that attack is gonna come, so you have to always be on the ready. And for a lot of people, that's an exciting space to be because they have to make sure they're always on their game. They're always thinking ahead of the adversary. But for those that are already in a utility, we have programs such as Cyber Strike and OT Defenders, and they're the ones who are training those who are already in and embedded in the organization. CyberStrike has educated more than 1,500 individuals, both domestically and internationally. I say CISO's superpower is that when we build something for our domestic market, it is so good that all of sudden we get asked to use it internationally to all of our allies and partners, and CyberStrike is a great example of that. So it really started in 2016 with the people who were actually on the ground in Ukraine when Ukraine was first having its attacks.
And the team of people who were on the ground from The US bringing that knowledge back to The US and saying, Okay, this is how Ukraine was attacked. How do we teach people how to defend ourselves? And it's grown, right? Because a lot has changed since 2015, 2016. And so now we have new components like Storm Cloud that looks at DERs, making sure that we're staying relevant to the real utilities today. And then also looking at OT defenders. We do a lot in the IT space. That's pretty well known and has lots of training and skills. The OT side's a lot harder, right? It's more nuanced, it's not as regular. And so looking at those who are mid level in OT space to train them on cyber, help them understand the federal government side, connect them in with our national lab experts, and most importantly, create a community for them. These are the people when you're having those hard days, when you have something that's suspicious, you want to call up a peer who understands where life is, where you're trying to defend against, what that particular thing that doesn't really feel right is going on and can talk you through it.
And so while we do the the education and training, really, that benefit is that lifelong networking commitment, because that's really also creating that whole of government, of nation benefit. We're always learning. We we can't stop learning. The adversary doesn't sit down and say, okay. I'm done learning for the day. So we have to always be in that space as well.
Yeah. That operational technology focus is is so important. And I'm glad you mentioned the on the ground trip all the way back now in 2016. For listeners who may not be familiar with that episode, Ukraine suffered really the first of its kind grid cyber attack in December 2015 that actually was later traced to Russia, but actually had the effect of cutting off power in the dead of winter to several, I believe, several 100,000 residents in in Western Ukraine, which was truly kind of a shot across the bow for others. And so I... As I recall, The US sent quite a big contingent to learn from that and make sure that, you know, as as much as we can repair as possible over here that that doesn't happen. And sounds like with the names you've got going, Cyber Strike, Cyber Force, I I I feel ready. I feel good about that. Like, that... That's You
we want. Right. Well, on on on the flip side, the... You know, blue... Bloomberg did report that power... That attacks on The US power grid did recently hit an all time high, I guess, in in 2022. What did we see in 2023? And I guess, what do you think that this year will have in store for us on the on the risk front?
It is a concern. Right? Those that want to affect our way of life understand the importance of the energy sector, right? It is in your face, as you said, you like flipping the switch and having the lights go on. You like showing up and being able to put gas in your vehicle if you have a gas powered vehicle. You like making sure there's natural gas coming to your house. If you heat your home with natural gas, those are important things. And so it does provide a big target. But I also think we are one of the most cognizant sectors to protect ourselves as well. There's a great community amongst all of the sectors, and across all of the energy sector, whether you're talking electricity, oil, natural gas, DERs, and all the other components that make it up with an understanding of the importance of their work on our nation, right? And so, there's an increase, especially in the physical attacks, and we're always doing our due diligence to make sure we're resilient.
One of the things that we do have is that a lot of resilience is built into the system already. So making sure that that is in place, that we're following our standards, but also leveraging what are those learnings to get ahead of the game. How do we partner better with local law enforcement so that they understand how a utility works? So if they're investigating or taking action, that they're knowledgeable, we actually worked with the interagency to create a place matter, how to as a first responder, what are those things that are sticking up there? What's important, what's not? To make sure that we do take that whole of government approach to help. And then really, I mean, you have the cyber side, which continues to increase. We have seen all of the messaging on Volt Typhoon with China embedding itself in our infrastructure across all of critical infrastructure, and it's it's really concerning. But companies also have ransomware on a day to day basis that they're concerned with, and and we can't discount Russia in the latest annual threat assessment by the intelligence community that was published last month.
Well, you just list... Listed an eye opening bevy of various threats. Which one do you think is the single greatest threat to US critical infrastructure? And I guess we can open that up widely. It doesn't have to be cyber if... What do you think is really the biggest risk?
I I think the biggest risk is getting stagnant in our resilient measures. So I think when you when you really look at risk comprehensively... And and I would be amiss to not mention things like wildfires and the climate change issues that are happening across the board. You can no longer just plan that, oh, I don't live in a wildfire territory nowadays. We see them in Texas. We see them in Quebec. We saw them in Hawaii, and it was devastating. And so really, it's thinking about that resilience and and what are the... We call them the crown jewels. What are those things within the system that keep the main structure up and running? And how do you protect them, both from a climate change perspective as well as a physical perspective and then a cyber perspective? One of the reasons why Ukraine came back up online is that they hadn't gone to a more logic based computer system. They had people physically on-site and just went and flipped a switch.
That's not the way our infrastructure works. And that's great for so many reasons. It gives us a lot of flexibility. It allows us to be very agile. But that means we also have to plan our resilience into the same light. And honestly, it's also that understanding a cyber attack can also be mitigated through physical means, right? If someone doesn't have access, if you're doing your proper insider threat, you're watching your maintenance attributes. Those are all ways that that cyber comes in to play. So really thinking holistically, I think, is is most important.
I'm reminded of Andy Bochman, a longtime contributor through the National Lab Network there of the cyber... What was it? His philosophy of consequence driven cyber informed engineering. Right? Of keeping that
Yeah. Yeah. Keeping that kinda physical backstop. Right? In case Yep. If all goes haywire on the cyber side, you're still not gonna get to the crown jewels because there's the the final valve to pull or whatever, the final switch to flip, whichever. I guess on the flip side of that previous question, what's a risk or a threat that you feel like receives kind of a disproportionate amount of attention? Obviously, with the caveat that this is your your personal view here and not necessarily that of CESER.
Without a doubt, a personal view. You know, I I have been contemplating this, and I think that it is the flashy object of the day, right? So people are going to direct their attention like, Oh my gosh, company X from China is our concern, right? Particular component over here is the problem child. And that gets a lot of attention because people feel like it's tangible. I can do something about because I can point the arrow at this, right? And then the reality of the space that we live in, none of that is accurate, right? An adversary will just move on to the next one, Our adversaries are not paying as much attention to an individual component or entity. They want to know what's most popular. And you know what? If you all switch to a different one, that's now the most popular one that they'll do their research on.
And so making sure that bright shiny object interest is not detracting from the true systematic, that CCE. Also, we have cyber informed engineering where I know when I went to school as an engineer, we did not talk about cyber. I'm sure many of our power systems engineers out there and electrical engineers and computer engineers did not... Maybe the computer, but did not talk about cyber in the same space. Don't think the computer engineers
like, they... You know, we need to be talking about cyber because if an engineer understands how a cyber attack can happen, then they can plan that they're designed to have the proper protocols in place. If the physics doesn't allow it to happen, then it can't be a a vulnerability to allow it intact. And so I think that that's a a really important core attribute to be taking instead of the bright shiny object I'm pointing at this particular component or this particular company.
You say bright shiny object, and all I can think about is AI and AI chatbots and generative AI and how, you know, that's the next big threat on the... Looming on the horizon or whatnot. And I'm like, is it? Is it? I don't know. We'll find out. Time will tell.
That's true. And I know DOE and various federal agencies have been using AI for quite some time. Now speaking of that, though, I have heard that there's somewhat of a... Can be somewhat of like a startup mentality. I know you mentioned the mission's been around for a little while, but that, you know, CESER's maybe not the the the largest agency on the block. So what what can you tell me about the the culture at at CESER and what it's like working there?
I do think we are we are small but mighty, without a doubt. CISA is not the largest office in in the department, and we are really focused on making sure we get stuff done right. Right? That's what that's what I really do appreciate about this team is we're focused on a mission. We're focused on building things as a team. I think risk management as a whole, and that's really what CISO does is is risk management, teaches you that the more diverse perspectives you have, the more diverse experiences you bring to the table, the better your solutions are going to be. Right? And I think when you keep that mindset in place, it holds together a team that appreciates and respects each other and has a single focused objective of what we need to do to take care of the nation and the energy infrastructure. That's probably the best thing about CISA, right? And that's one of the things that works really well for being a particular sector is we can really hone in on that, that we're driving towards it.
I always say at the end of the day, when a CISO is done doing its work, when I'm done doing my work, I actually have not achieved what I need to yet. It's when the sector actually goes and puts those mitigations into practice, when they're making better, more fulsome decisions. At the end of the day, that's when our job is done.
And speaking of diverse backgrounds, you've had... You you mentioned your own engineering background. You've had experience in nuclear areas and in, you know, CISA. How did you come to join CISA and be focused on these risk issues?
So it's one of those things where I think you just see what interests you and where the path leads. But to your point about culture, it's also being around people I want to work with. Right? I can work on lots of different problems. I've done immigration. I've stood up family reunification task force, you know, done stuff at TSA and Innovative Transportation Security. And every time, I'm reminded of the people I'm with, right? And in CISA, I have this team with me, the team of CISA who I get to work with on a day to day basis, but also that industry partnership. There's collaboration and feeling like you can achieve a goal in that. That's really what I've always looked for in the positions that I've taken is, am I doing something bigger than just me? Am I contributing to something much bigger than me and doing so in a way that is providing a greater value to the world.
That's great. That's great. And you flicked at this a little bit earlier, but talking about DERs or distributed energy resources and in CISA's goals and what's coming around the bend, you know, the Department of Energy writ large has announced a whole bunch of funding opportunities for boosting the resilience of energy infrastructure, whether it's cyber, physical, climate related threats. So what are some of the security challenges associated with those those DERs, that wind, that solar, that... You know, not not like one power plant in one location kind of kind of source of energy?
Yeah. I I think that that distributed... That word distributed is is key there. Right? And in our traditional mindset, you have one person that controls the entire natural gas plant that can ensure security is in place. With DERs, with virtual power plants, it's lot of different people. Right? And they have varying backgrounds, varying understanding of risk. And so with community that is building in DERs, we're working with them to understand the opportunity that they have. Right? We understand they have a lot of drivers. They're driving down cost. They're trying to have more and new products that perform better. But in order to have the longevity in those products, they need to build the security and resilience in early. That is the most cost effective way and the most efficient way to achieve the goals we're trying to have in our nation. The key challenge is helping those that are on the ground understand that importance, understand that, honestly, calculation, right?
It does come down to business, and we understand that. But if you are making business decisions without looking at the full risk picture, then you're not really making good business decisions. And so it gets into the education of the investors, the entrepreneurs, the designers to make sure that they're talking about things like cybersecurity in their design reviews, understanding they may only see themselves as a small entity. Oh, I only have a couple of these, but you're one entry point into the grid. And you might be small now, but what are you going to be later? If you achieve that vision that you have of whatever you're trying to do with your particular company or technology, then you're going to grow. And let's design those security practices now for where you're going to be in the future, not where you are at the moment or where you were even a couple of years ago. Those are key important attributes to take into account in this really fascinating, exciting opportunity we have to get into the ground floor.
It sounds like... Are you sure you're not a sleeper agent for CISO and CISO there? Because you're you're sounding a lot like a secure by design approach is what you're recommending here for some years.
Okay. Got it. Got it. Got it. Alright. Sorry. You were there first. Noted. We were Let record show. So on on that note, you know, talking about some of these DERs, I'm not sure if electric vehicles technically qualify as a distributed energy resource. Not really a resource so much as it is like a load on the grid, I guess. But I I understand that CISA's recently published a blog series on some of the research you all have been up to in the electric vehicle space, which I might have a slightly vested interest in this subject as an EV owner myself in DC here. But what can you tell me about the findings there and some of the need for EV protections?
Yeah. I mean, it's an exciting space. I am about to be an EV owner myself. I also have a vested interest in in this with the the charging stations. There is a lot of computer engineering that goes into that and how it manipulates and leverages that battery charging is really important. And ensuring that there is a convenient, affordable and reliable charge for the EV is there, but also that it's not susceptible to hacking, that it's not susceptible to all of the threats that we see. And it is for that individual charger, right? But it's also if you could envision a future state where you have batteries being charged at truck stops, right? EV trucks. They're not a thing of science fiction. They're a reality, but that's a lot of draw. And we want to make sure that that draw is consistent, that is planned, and that no one is manipulating that draw.
But also, EVs provide a lot of potential resilience into the into the grid. Yes, it's it's a draw, but also especially those truck batteries that can be a mechanism to take care of your house in the future or to kick start a black start capability. And those are important things to also take in account the benefits and the reliability and the resilience that come with it. So within the three years, 2022 to 2025, CISA will have invested over $8,000,000 in several research projects with public and private partners to make sure that there's cybersecurity standards for the EV and EV supply equipment. Right? If you don't tell people what they need to know, you're not setting them up for success. And that's really CESER's role in all of this is is making it easy for people to do the right thing.
You mentioned black start capabilities. Don't don't even get me started. I'm so interested in those rabbit holes of, like, what to do if the grid... If the whole grid goes down, how you kick start it back up
There... Well, there you go. And so speaking of some of these risks and thinking about them and addressing them with, as I understand it, you know, CISA has done quite a bit of work with the National Association of Regulatory Utility Commissioners or NARUC. And I know we've we've covered a lot of acronyms here so far. So for for listeners who might not know about NARUC or the first thing about the utility structure in The US, can you help unpack the significance of that collaboration?
Yeah. So the way, and I'll get a little wonky on you for a second, but the Federal Power Act defines what are the federal responsibilities and what are the state responsibilities in our energy system. And at the bulk power, that's what sits at the federal level with FERC, right, where you're worrying about bulk power. The distribution system is with the states, and each state has their own regulatory authority how they implement that. Most of the time for what are investor owned utilities or larger utilities, they are regulated by the Public Utility Commission in that state. And their trade organization is NARUC. And so one of the things that we're mindful of is across all of the states, many of them are trying to figure out how to put in cybersecurity regulations into place at the distribution level.
Level. And we wanted to make sure in CISA that if that is under consideration, that we didn't have a patchwork of different requirements. Right? That wouldn't actually be beneficial to us all. And so what CISA did is it brought together all of these different utilities and representatives from different state level organizations and also federal government experts and said, Okay, how do we partner together baselines? Back to CISA, CISA had created some cyber baselines. This is the specific energy sector one. So we knew that the most important ones to hit right off the bat were distribution systems and distributed energy resources because there's not a lot there right now. Not that we won't hit the other sectors, but we're like, this is our biggest gap. We should address this first. And that's where we came together to try and say, okay, what are our cyber baselines?
Whether you use them for regulatory or not, we just want to make sure everyone has a consistent set of messages of what good looks like. And that's why we came up with these. You can download them. You can take a look at them. You can be regulated. You can be unregulated. You can be an inquisitive developer, and you can look and say, what are those cyber practices that I really need to be putting into place? We want a guidebook for you. We want people to understand, you know, what to do so they can put it into their planning. And and that's really what the cyber baselines work was created to do. More work to be done. There's implementation plans to create. We've got bulk power. We've got ONG to tackle. But it was it was really important to get these out the door quickly and also get the feedback from industry, from from states to make sure that they're reflective in delivering what's needed.
So what's coming around the bend for CISA? What's on your radar, whether from a research perspective, AI, next projects or exercises that you're hosting? What's coming up?
I think we are really digging into a lot of the Volt Typhoon work, I think that is hard pressed to make sure that we are partnering with industry to have that complete package, the prioritization of mitigations that they need to do. I mentioned that we have a lot of really small utilities across The US that don't have a lot of resources. So we have our rural municipal utility cybersecurity program that was part of the IIJA funding, We call it RMUC. It's got $250,000,000 there to uplift some of our smallest of the smalls to make sure that they're capable and have the support and resources. And so making sure that they're poised to be responsive. We were looking at it through a five factor perspective. We are looking at risk, right? Like you have to understand what is actually your risk.
You have to have visibility. What is actually happening on your system? We have several programs and we partner also with CISA, and we partner with industry to use all of their sensors for information sharing so we know actually what's happening today and what do we need to see in tomorrow. It's much harder to understand the OT side and consolidate it. So what do we need to build and do and grow those? We also have hardening, right? This is where we're getting in and we're putting mitigations into place in partnership with our utility partners, making sure that when vulnerabilities are known, we help educate industry about how to close them as quickly as possible. We do our training and workforce development. We get a lot in the exercise space. CISA has some of my favorite exercises with Liberty Eclipse, which was over on Plum Island right now, taking over from the DOD RADICS program, the DARPA RADICS program.
And this allows companies to come in and actually physically experience a cyber attack. What does it physically do to shut down the power? And we set up our national lab red teams, right? The professional hackers to try and hack our utilities who are teamed up to fictitious utilities to try and defend it. And so really that live fire experience makes sure that when they return back to their entities, and really it's not just those that participate, but we disseminate the information across the entire sector. We're all better to defend and harden ourselves. And then at the end of the day, we also have our response. The bad day will come. Do we have the resilience in place to make sure that we can recover quickly? Do we have the procedures, the playbooks, so we know who to call and how to be in place so any situation is minimized?
And so we exercise those also regularly, but making sure that we have response protocols in place. So that's really, I think, how CISA is attacking this problem across the board, because you can't just have a one stop solution. We've got a lot of cool RD and D activities going on and then really partnering in to put it into implementation.
You mentioned of the Liberty Eclipse exercise and some of the red teaming and pentesting activities. I'm sure you've just set gears turning in any Synack Red Team member listeners of this podcast because they certainly are always interested in finding the next cool project. And have you been out to to Plum Island? This is like a remote
It is. It is. But you can totally geek out when you're there. It is a lot of fun. And and I also... For me, I'm not a hands on keyboard cyber expert, but I love watching all of those experts that we bring in, like truly the best of the best of industry, to see them learn and grow together. It is just absolutely fascinating. And also, they get very downtrend when the Red Team gets them. And all of a sudden, have the little used car flyer man with the wind that blows up, he deflates. And it's very sad. And then they go back in. But it's a learning experience, right? That's one of the things we have to know, that I would rather for us to find our faults so we can fix them, we can address them, than for an adversary. You have to have that sense of vulnerability and authenticity in all of your work to be able to to always say, how is someone else going to attack me?
And you can always fall back on the old mantra as a defender that attackers only have to get it right once and defenders have to get it right every time. Might be a slight oversimplification, but hey, if if I just got if I just got popped there by the best Red Teamers out there, maybe I'd use that excuse as well. Well, Mara, really appreciate all your insights into these really fascinating and national security relevant issues. We do have one last question we ask all of our guests on the WE'RE IN podcast, is, you know, looking at your extensive and impressive LinkedIn profile, what's something we wouldn't know about you just by looking at that profile?
So I think part of my passion for training that you hear in my voice, I I love training. I love that engagement, is because I'm a mom of two teenagers. And so it's in your face every day about the importance of the efforts that we're doing. Kids are watching you on your day to day basis. They're forming their world views and being mindful of that impact we have on the world and even not just the greater world, but on an individual. And so that comes through training, that comes through engagement. It comes through how I work with my team, my partners on a day to day basis. And so think that passion has shaped my efforts throughout workforce development internally and throughout the energy sector.
That's why we're doing it. Right? I'm I'm a new father myself, and so, yeah, I've gotta keep that keep that world secure and ready to go for the next generation. So
you. Thank you. If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little InfoSec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'reinpodcast@Synackcom. That's s y n a c k dot com. Until next time.
We're in is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
