Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Mike Witt on NASA’s cybersecurity mission in space
Guest:
Mike Witt
Published:
Updated:
Duration:
28 min
Episode summary
Mike Witt, NASA’s Senior Agency Information Security Officer and Chief Information Security Officer for Cybersecurity and Privacy, has a long history of public service. In addition to serving 10 years in the U.S. Army, Mike was the director of the United States Computer Emergency Readiness Team (US-CERT) at the Department of Homeland Security and a key cybersecurity official at the IRS. Now, he’s leading NASA’s efforts to secure spaceflight centers nationwide and their missions to the final frontier.
Tune in to the latest episode of WE’RE IN! to hear more about how NASA balances its out-of-this-world mission with real-world concerns about cybersecurity resulting from increased activity from other space agencies and commercial interests alike.
Listen to learn more about:
How NASA responded to the Log4j vulnerabilities revealed in 2021
Why the SAISO position was created
How NASA’s stellar reputation helps it address the cybersecurity talent shortage
Listen to the episode
S3 E21 · Mike Witt on NASA’s cybersecurity mission in spaceWE'RE IN! Podcast · 28 min
Key takeaways
Contain risk within each mission Mike tells mission teams he supports their ambitions as long as the risk they accept stays within their own environment and does not affect another mission or other parts of NASA.
Build for life beyond the mission Spacecraft often keep returning useful data for years after their planned mission life, so resilience and security must be designed for those bonus years.
Prior security work saved a launch When Log4j surfaced about 96 hours before the James Webb launch, existing security controls let NASA apply mitigations, launch on time, and patch at launch plus 60 days.
Partners must show third-party assessments NASA requires partners to provide independent third-party assessments, similar to how FedRAMP works for cloud providers, so it can judge whether risks are acceptable.
Plan a military transition early Mike recommends starting six to eighteen months ahead and points to the DoD SkillBridge program, which his team uses to bring in active-duty service members.
Notable quotes
…whatever it is, the craziest things you want to do in the world, I'm your biggest fan, but we've got to make sure whatever risk you're taking on, that risk is contained within your environment…
We're no longer in space by ourselves. Right? There's other spacecraft up there, and they may reach out and touch you…
But really what saved that launch from not being delayed was the due diligence of the James Webb team around security…
…anybody from anywhere can do anything as long as you put your passion into that and you focus around it.
Questions this episode answers
What is the difference between a SAISO and a CISO at NASA?
The senior agency information security officer title comes from federal law and distinguishes Mike's agency-level role from the CISOs at each NASA center, who report to him. Outside NASA he uses CISO because people understand it. Read this section
How did NASA handle Log4j before the James Webb Space Telescope launch?
With about 96 hours to launch, NASA worked with the Webb team to put mitigations in place and accept the risk of not patching immediately. The launch went ahead on time and patching started at launch plus 60 days. Read this section
How does NASA assess risk from commercial and international partners?
Partners must provide independent third-party assessments, as NASA requires for its own systems under authority to operate, followed by ongoing risk assessments. Mike compares it to FedRAMP for cloud providers. Read this section
Do astronauts use two-factor authentication?
Yes. NASA takes multifactor authentication seriously, but instead of PIV cards it uses other technologies suited to space, and it has to account for latency. Read this section
How can veterans move into cybersecurity careers?
Mike recommends following your passion, starting to plan six to eighteen months before leaving, and using the DoD SkillBridge program to gain experience at agencies before separating. Read this section
About the guest
At the time of recording, Mike Witt was NASA's Senior Agency Information Security Officer and Chief Information Security Officer for Cybersecurity and Privacy, a role he had held for about eight years. He served ten years in the U.S. Army working in IT, helped stand up US-CERT at the Department of Homeland Security and later served as its director, worked at the IRS, and was the first CISO of the Consumer Financial Protection Bureau.
Carry nearly 80 gigs of data in my head. You're in the mainframe. It's eating to great entire system. Access encoded. Gigabyte of RAM should do the trick.
and welcome to We're In, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer, and I'm thrilled to be joined today by Mike Witt, NASA's senior agency information security officer and chief information security officer for cybersecurity and privacy. Mike has an extensive public sector resume that includes a decade of military service and a stint as director of the US computer emergency readiness team within the Department of Homeland Security. Before we hear the latest about Mike's work securing NASA's critical space technologies and personnel, here's a quick word from our sponsor.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party testing. We cherry picked the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.
do at NASA, a day in the life, if if you will. And what is the difference between a senior agency information security officer and a chief information security officer for cybersecurity and privacy? I'll start with the second one first because I actually kinda get that one quite
a bit. So NASA had basically went forward with this position, and they're kind of following out of the Federal Information Security Management Act of 2014. This is the word, SAISO, if you will, was actually put into that law. So that's kind of where they got that language. And that's a, you know, we probably, we have like 10 centers, right? When you start thinking about Kennedy Space Center, you know, and Johnson Space Center and stuff like that. Each one of those centers also has a center chief information security officer at those centers that report directly to me. Right? They're kind of my boots on the ground, if you if you think of they're at the center. So to designate the difference so that from my position to the center CISOs, I'm referred to as the SAISO for NASA. Right? And then we have CISOs at each of the center. I'll say outside of NASA, I tend to use the word CISO because that's what people understand and stuff like But inside NASA, it was really used to designate the agency level from the individual center levels so that there was no confusion.
Now cybersecurity might not come to mind for most people when they think of NASA and its mission and its history, which obviously is a storied agency, really incredible work throughout the decades. But how do you make sure that cybersecurity as an issue gets the attention that it deserves both within the agency and among external stakeholders?
No. Hey. Great question. I will tell you, I I had to tackle that on day one coming at the agency. I joined NASA almost exactly eight years ago and coming in... The good thing about it was is I had experience working at this level at other agencies before coming to NASA. So it wasn't my first rodeo, so to speak. But coming into NASA, it was a different challenge, right? Because as you kind of mentioned, NASA is all about, you know, like science and space and aeronautics and stuff like that. Right? They're not here for the cybersecurity. Right? They're here for the, I'll call it the fun stuff. Right? Right. Right. So, but going in to make sure that cybersecurity was integrated as part of those missions, especially from a risk standpoint, I really had to go out and engage the leadership at each one of those centers, lean into the leadership across the various missions.
But I also had to get in at the leadership level of NASA, right? That's the administrator, the deputy administrator, the associate administrator level so that they understood the importance of cybersecurity. And I'll just say when I joined NASA about a year ago, of what we had to kinda change kinda some of the ways we're doing because they were still very much operating from the standpoint of space. And I'll say at the internet was friendly. Right? And it's like the threats have changed. Right? And so it was really just kind of, I'll say an education part of that, but that also included me doing, and I still do it today, town halls across every center. I've done town halls at every center in NASA where freeing the entire population of people that work there in and brief them of what's going on, educate them, answer questions. Honestly, some of them are questions.
They're pushing back, right? Because they don't want me stopping them from doing what they need to do in their passion. And so that's kind of where I help educate them. I'm part of the team just like you. I'm here to make sure that what you're doing, it's done securely so that your data is protected, your science is protected and stuff like that. So it's really... Was just really an education along the way to to make sure that the one we're partners in this. I'm not here to stop you. I'm here to help educate you. And then and honestly, this is about doing risk management. So I've even kind of went so far as whatever it is, the craziest things you want to do in the world, I'm your biggest fan, but we've got to make sure whatever risk you're taking on, that risk is contained within your environment, and you don't accidentally impact another mission or another part of NASA because of the amount of risk that you take on it.
I'm sure for any other chief information security officers listening to the podcast, they can relate even if it's just at the stakes of, like, an app. Developers wanna go build fancy things and do cool things and not have cybersecurity looking over their shoulder being like, wait a minute. You... Don't do this or that's not secure. So that sounds like that communication and that town hall strategy. And maybe you can replicate that a little bit here for our listeners. What are some of the biggest cyber threats that you're seeing in space these days?
Part of the challenge that especially that we've kinda had to tackle is the mindset of, oh, well, once you, I'll call, leave planet Earth, you're secure, and everything is good. And again, old mindset from it.
we do with the communications and stuff like that, kinda the older days of like, we don't need to encrypt any of this communications, and you don't have to worry about patching anything or doing any updates or whatever. Those days are over. Those threats have changed and stuff like that. We're no longer in space by ourselves. Right? There's other spacecraft up there, and they may reach out and touch you, let's just say, right, from a... From an electronic standpoint.
So it's really kinda coming at this from from the standpoint of really working with our mission stakeholders so they understand when you build to go to space, because you're not going up for ninety days, we're sending things in just going into space. And let's just say it even goes up with a five or ten year mission. We've got things that once that mission life kind of planned life ends, there's still good data to bring down work. So then we go into those plus years. So it's really trying to make sure that they understand you've got to build in the resiliency of that mission plus beyond that mission life, because we tend to always take, I'll say, advantage of bonus years. That's the one thing that we kind of really see a lot at NASA.
Absolutely. You mentioned patching in your response there, and I covered a couple of those really cool Hack-A-Sat competitions back when I was a journalist reporting for for E&E News and Politico. And I I I learned from those, some of the hackers that were taking a crack at these really replica satellite pieces of equipment, It really highlighted just how difficult it can be to patch something once it's up in space. How do you navigate some of those mission critical updates when you're not not necessarily gonna be able to just go on a spacewalk and plug something in?
Yeah. It's a lot of it's coordination and stuff like that. We do absolutely do the patching in space. I'll just put it that way. The International Space Station comes to mind. We've got people up there, but we've gotta make sure that those systems stay up and they stay secure around that. I will share with the audience. They... If they're not aware, I'll I'll I'll share a little story with you. Everybody's heard of the the James Webb Space Telescope, one of the greatest creations we... That we've we've we've had, and it's really cool. The images we're getting back.
Exactly. About ninety six hours before its launch in French Guiana, there was a vulnerability that came out around Log4j that was impacting the Internet. Guess what we had running as part of the infrastructure around James Webb, right? Log4j. We had to work with that team, and this is literally like days before Christmas, right? And we had to work with that team. Luckily, that team had done a phenomenal job working with my team and their own cybersecurity team over the previous few years. And we had a lot of really good security built in there around that system. And we were able to, I'll just say, put in some mitigations that allowed us to accept that risk of not doing some immediate patching. We built in some mitigations around that, working with the James Webb team.
And we were able to launch on time, there was no delay of launch or anything like that. And then what we ended up doing was launch plus sixty days. That's when we actually started to apply the patching around the James Webb infrastructure and stuff like that. But really what saved that launch from not being delayed was the due diligence of the James Webb team around security, what they did honestly, the two year prior. That's what really what made it a success. And Again, internet, nobody knew anything about it. We were good to go. Everything went off good, and we were able to do all of what we needed to do from a security standpoint, launch plus sixty days.
That's the thing with these previously unknown vulnerabilities. They can crop up at the most inopportune times. We often complain in the cyber industry of like, oh, yeah. It always seems to happen around the holiday. Well, we're not thinking about launches, so that's a whole different... Adds a whole another wrinkle into the mix. What does interoperability mean to the space mission? Kind of an open ended question.
It means a lot different things these days. Right? I mean, when you go back to, you know, honestly, like ten, just even ten plus years ago with NASA. Right? But NASA did everything for, I'll say, from cradle to grave. Right? But now we're using a lot of commercial technology, commercial industry, SpaceX comes to mind and stuff like that. But also, when you start thinking about the Artemis program that we're developing, right, we're not doing this alone. Right? We have the European Space Agency that's involved. We've got JAXA, Japanese. We got the Canadian Space Agency. We have partners now that we're doing this. So when you start thinking about, you know, gateway that'll go up to kinda gonna be that central point where we send astronauts up to and the shuttle will go down, down to the to the planet stuff. We've gotta be able to have that because other other organizations are building a lot of these different vehicles.
And if we don't get it right, we've got to make sure that things, when they land and connect and they dock and they communicate, all of that interoperability that you're talking about, it's got to work. Again, this isn't NASA doing everything cradle to grave. It's us with our partners, and we have to work together to make sure that we have that interoperability connecting between us.
The flip side of that is, of course, you are working with a lot of essentially third party entities, whether that's commercial, other governments. How does your risk appetite change with that? And how do you assess risk across such a vast landscape of tech stacks, which you can't possibly go under the hood and peek at everyone? How do you go about doing that?
A lot of it really gets into just like what we do with our own systems, right? We have what's called an authority to operate. So there are system security plans or stuff that's built along like that. And then we bring in an independent third party assessment of those systems to make sure that all of the appropriate security controls are in place, or if something is not going to be implemented, right? Because again, we have to, in some cases, accept risk, but it's what mitigations are in place to mitigate or minimize in some cases that level of risk. So it's those independent third party assessments that we rely on that help us understand what our, I'm going call it our initial risk is going into that. And then we do risk assessments going forward. We have those same requirements on our partners. As part of that, we require those partners to provide us with those third party assessments so that we understand what those risks are and those risks are acceptable.
And when you start talking about some of our space partners, that's no different than the way that the FedRAMP works under GSA with our cloud providers. Right? We use our cloud providers, whether it's Microsoft, Google, AWS, others. They're bringing in the independent assessors to independently assess that risk so that we can understand what risks we're taking on. And that's kind of how it works across the board.
That's a really good answer. And it makes sense. Yeah, you can't do everything, but there are ways that we've developed to mitigate some of those risks and assess them as best we can. And now I would be curious to hear how your position at NASA... You mentioned, you know, this wasn't your first rodeo coming on board. How does it compare to your previous InfoSec roles? And I'd be especially interested to hear about your time at the Consumer Financial Protection Bureau, which was essentially brand new when you joined. So you were really starting up a cyber program from scratch. What was that like?
So it was funny. So I was actually working at the Internal Revenue Service at the time, and I got a call from the federal CIO at the time. And it was like, Hey, I want to talk to you about an opportunity. I went down to the White House the next day and met with the federal CIO. It's like, Hey, so we're standing up this brand new federal agency out of thin air called, you know, CFPB, right? Consumer Finance Protection Bureau. And we'd like for you to help us stand it up as the first CISO, if you will, for the agency and stuff. Right? And so first I asked him, you know, well, how'd you get my name? Right? And stuff like that. And it was it was a lot of it was when I had joined the Department of Homeland Security for the first time for standing up the US CERT, United States Computer Emergency Readiness Team. When I walked in, it was two people in a standalone computer at US CERT, right? So stood US CERT up out of thin air as well.
So that was kinda how my name came up. I agreed to do it and went in for the first year to help them get everything stood up. And there was already some people that were already working to stand up the organization and stuff like this. And so when I walked in the door on day one to CFPB, I was the information security team. That was it. It was me and no one else. I really, like you said, I just, it was standing everything up out of thin air. It was going in and understanding what we needed there, how we needed to do things, justifying the budget, justifying how many people we needed, right? Whether they needed to be actual government employees versus to maybe do it to these positions, some of these positions be contract support. This all ties to money, which is the agency's budget and stuff like that. So having to work with a brand new CIO, if you will, that's trying to figure this out as well.
By the way, I will tell you during my one year there of helping to stand up the agency, I went through five CIOs. Right? So what we're basically trying to get to do, we're dealing with even the churn of a new agency standing up and even retaining its own people and stuff like that, recruitment and everything, and trying to recruit in talent and the white talent. And by the way, while we're trying to do this and recruit talent to come in, this means also there is a brand new HR organization being stood up. We're begging for the HR of, Hey, I need vacancy announcements. They're like, we don't have anybody to do that. So we're working to stand up. So it wasn't just, I'll call it my team or even the CIO team. It was every team within CFPB and stuff like that to stand up. But the good thing about it was everybody came in and just running full speed ahead.
And it was really good. At the end of my one year, they offered me to stay on full time to continue with stuff like that. I do everything before I take any gig full time. I have a conversation with the actual boss and that's my wife. We sat down and Yeah, talked about we talked about it. And a lot of it was, I mean, as you can imagine, setting up a brand new agency out of thin air, that's not a Monday through Friday, eight to four job. I will just tell you that entire one year run, I had no days off. And I typically worked anywhere from twelve to sixteen hours a day that entire year. So I will tell you when my DDL ended, I went back to the IRS. I actually took two weeks vacation.
I was gonna And say I'm getting depressed. I hope so. I mean, it sounds like you're describing like bootstrapping a cybersecurity startup almost, really.
glad you kind of mentioned attracting and retaining cyber talent because I I meant to ask about that. I imagine it's, a, was probably particularly challenging at an agency like CFPB where you have... The competition is fierce for that kind of talent that has that specialized knowledge perhaps or, you know, are able to work in a financial context. But how does your team at NASA attract and retain cyber talent?
I will say I'm very fortunate at NASA because I'm just gonna say NASA's brand and reputation is probably like no other federal agency that I've ever worked for as far as just the amount of the buzz that it generates, the positivity, the excitement, really.
Exactly. Especially of our youth, right? I mean, they're not a whole... When you start thinking about federal agencies or even departments that get the youth jazzed up, NASA's really kind of in a class by itself. So even competing, I'll say again, other agencies that can even pay more or private sector and stuff like that, NASA's brand really comes a lot, stuff like that. So that that's where I've been fortunate. I will just tell you whenever I put vacancy announcements out, I absolutely have no problem with people applying. It's just really kind of rooting through those to identify, you know, who we're gonna actually interview and then who we're actually gonna kind of retain on full time through the selection process and stuff like that. It's been much easier with NASA because of their brand reputation.
That makes a lot of sense. And staying on the career point, you served for a decade in the army. What would you say to former members of the armed services who may be considering a career change into cybersecurity, even those without direct cyber experience?
No. I will just say, you know, during my time in the in the army, and just so people know, you know, I I I did IT in the army. So I just wanna put that out there from that standpoint. And as I was transitioning out of the army, I actually landed early into a cybersecurity role, if you will. And that's where I just fell in love with cybersecurity. I already had the IT, I'll say I was already in love with IT, just in general, but that's where I fell in love with cybersecurity and stuff like that. The DOD does have a program called SkillBridge. Soldiers are coming up to transition out of the military. They can join other federal agencies to start learning and honing their talent before they actually fully get out of the military to actually find their way into private sector or their next career from that standpoint.
Our OCIO organization, NASA as a whole, but I will say specifically my team, we participate widely in that program. I actually have a couple of active duty soldiers right now that are actually working on my team as part of that program around that. But I would just say for anyone that's currently in the armed forces, whatever your passion is, whether it's cybersecurity, whether it's IT, whether it's something else or whatever, find your passion and follow that passion. But I would just say, even from my standpoint, I started about a good year or two before I knew I was going to transition out to start thinking about that transition. You definitely don't want to wait last minute and just go, Yeah, I'm going get out of the military and just find it. You really need to start six, twelve, even eighteen months out, start thinking about that transition itself and stuff like that so that you land on your feet.
Well, it's interesting. NASA carries out a lot of important national security supporting military objectives as well, which I I think maybe not everybody realizes. Even when doing some of the research for for this interview, I was kind of surprised by how much of, you know, a lot of the research arms of NASA especially can assist with some of that. How do you collaborate with some of those other military stakeholders, we'll say, or or even US Space Force on shared threats and challenges? So we've got
a really good relationship with US Space Force, as you probably can imagine, stuff like that. We do routinely share information back with that. We do routinely just even work with them on general things to just to learn from each other and stuff like that. They're... Them being a newer organization, they did early on work with us from the standpoint of leveraging policies that we had so that they could look at them to see how they could transition them into, I'll say, DoD language because of that. NASA's different than DoD, very different than DoD. Our policies are definitely not a one for one the way that DOD would do business, but we absolutely share where... What we needed to share with them, whatever they asked for, so that they could take a look and try to learn from that Stanford or whatever. When you start talking about some of our centers out there, you might find some where we're either actually co located on a military installation or we're adjacent to a military installation.
In those cases, we work very closely with those bases, if you will, to understand not only physical security challenges, right? That's, you know, from NASA, that another organization does physical security, but also out of my office, we work with them to make sure that we work together around any, I'll call it cyber challenges and stuff like this. And this goes around drones. As as you can imagine, we have drone programs and stuff like that. So we make sure that we follow and we abide by any DOD policies or regulations, especially if we are co located onto a DOD base so that we don't upset them. Right? We need to be respectful of their policies and stuff like that and make sure we abide by what they need to as well.
I imagine, yeah, that kind of ups the ante a little bit if your neighbor's with somebody with with a a particular military needs. But it makes sense, right, the location and down to even launch zones and whatnot. I'm sure there's a lot of overlap there. Now I have to ask, do astronauts have to worry about two factor authentication?
Absolutely. We pretty much really take two factor very seriously at NASA. We've really made a push over that my entire time that I've been here, leaning into that, even really very much so, as you probably saw in the executive order 14,028 that came out a couple of years ago that the current administration really leaned into around multifactor authentication. So we have kind of done that due diligence swiveling into that. I want to make sure your listeners don't think that we're actually sending, you know, because in government, we use PIV cards, right? Like a credit card that you slide in that's got the chip on it. We're not sending astronauts up there with a PIV card that breaks in space and it's like, Oh, we need you to return back home to actually go to the help desk, get a new one. We've got other technologies that we've implemented along the way to kind of take advantage of that. Even some of the challenges that we do have around latency, right?
So it's not just... You gotta think about latency issues when you start talking about space and stuff like that. And that comes into into place when you start thinking about two factor authentication as well.
Oh, interesting. Yeah. Because you're 250 miles plus up there. That's an... Enough distance to get some communication gaps there. I didn't even think about that. This is why I'm not chief information security officer at NASA. Interesting. Well, this has been a really fascinating discussion. Really appreciate your insights. I'm sure our listeners will too. I love the Log4j anecdote. I can't believe that almost tripped up a launch. That's news to me. That's incredible. And kudos to the team who sounded like putting the legwork to make it possible to get that fixed on the fly. We do have one last thing that we ask all of our guests on the podcast, which is what's something we wouldn't know about you, Mike, just by looking at your LinkedIn profile.
Probably the one thing you wouldn't know about me that you won't definitely see on my LinkedIn profile is and I think this is something good for your to hear. I'm from a small, small, small, small town in Oklahoma, three stoplights, right? Grew up, you know, separate. And where I'm kind of coming from this is, is if a kid from a small town in Oklahoma with three stoplights can grow up to become a CISO at NASA to live out their dream and stuff like that, this is anybody. You don't have to you know, become from a big city, a big Ivy League college and stuff like this. Right? I worked my way through the military and got out of the military, and it's really about finding your passion, putting in the effort to hone your passion, and then basically just working your rear end off, to be quite frank, to do what you need to do around that and stuff like that.
Really appreciate that. That's a great point, and thanks for sharing that, Mike. And thanks again for for taking the time out of your busy schedule to join me on
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
We're in is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
