Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Morgan Adamski on cybersecurity collaboration, nation-state threats and transparency at NSA
Guest:
Morgan Adamski
Published:
Updated:
Duration:
34 min
Episode summary
Morgan Adamski wants to talk to you about cyberthreats. As chief of the National Security Agency’s Cybersecurity Collaboration Center, she’s responsible for bringing highly sensitive threat information out from behind the walls of Fort Meade and onto the desks of defense industry leaders who can use it.
In the latest episode of WE’RE IN!, Morgan shares how she helped build the CCC into a vital public-private conduit for cyber intelligence, rewriting existing NSA operating models along the way.
“We knew that it was important to be able to have this type of direct engagement, because we knew the only way to really counter a nation-state actor is to get ahead of it,” Adamski said of the CCC’s “fast and furious” history.
Tune in to hear Adamski’s thoughts on:
Strategies for getting more women involved in the cybersecurity field
The Biden administration’s new National Cybersecurity Strategy
The importance of being part of something bigger than yourself
Context matters more than indicators Morgan says what NSA knows is less sensitive than how it knows it. Telling partners that IP addresses tie to a specific nation-state actor lets them pull the right APT playbook and prioritize resources.
Collaboration is harder outside a crisis Events like the Microsoft Exchange exploitation and Log4j make priorities obvious. The harder work is agreeing on threats and outcomes in day-to-day security.
Free NSA services for small DIB firms NSA offers free cybersecurity services to small and medium defense industrial base companies, focused on vectors threat actors target. Companies with an active DOD contract and access to nonpublic information can partner with the CCC.
Private sector visibility informed Ukraine advisories The best insights into attacks on Ukrainian networks came from private sector partners on the ground, which helped NSA publish advisories on Russian tactics for US defenders.
Joint disclosure fights patch fatigue In 2022 NSA and the UK's NCSC jointly disclosed a critical Microsoft Windows vulnerability through the CCC, publicly accepting attribution to draw attention to patching.
Topics covered
Talent Gap
U.S. Public Sector
Notable quotes
…what we find is that what we know is less sensitive than how we know it.
We knew that it was important to be able to have this type of direct engagement because we knew the only way to really counter a nation state actor is to get ahead of it in real time.
If you kick them out, they're gonna come back.
It's really easy to do public private partnership or operational collaboration in a time of crisis.
Questions this episode answers
What is the NSA Cybersecurity Collaboration Center?
It is a primarily unclassified facility outside the NSA fence line, plus a virtual platform, where industry partners work with NSA analysts and share threat intelligence in both directions. It was set up after the Cybersecurity Directorate was established in October 2019 and opened its doors in December 2020. Read this section
Which companies can partner with the NSA CCC?
Organizations with an active DOD contract and access to nonpublic information can partner with the CCC. Others are often referred to counterparts such as the Department of Energy or CISA. Read this section
Why does threat context matter more than technical indicators?
Defenders want to know why an indicator matters. If NSA can tie activity to a specific nation-state actor, companies can apply an existing APT playbook and prioritize mitigation. Read this section
How did the war in Ukraine affect NSA information sharing?
Morgan said the best insights into Ukrainian networks came from private sector partners helping there, which informed mitigations and many advisories on Russian tactics for US critical infrastructure. Read this section
What advice does Morgan Adamski give women entering cybersecurity?
Find good mentors and advocates, take advantage of free and paid cybersecurity courses, and be ready to get uncomfortable and ask questions. Read this section
About the guest
Morgan Adamski is, at the time of recording, chief of the National Security Agency's Cybersecurity Collaboration Center (CCC) at Fort Meade, Maryland, which shares threat intelligence with the defense industrial base and other private sector partners. She holds a bachelor's degree in peace, war and defense from UNC Chapel Hill, where she played Division I lacrosse, and a master's in strategic intelligence. She has spent almost fifteen years in the cybersecurity field.
And welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Sobczak, and we're here today with Morgan Adamski, chief of the National Security Agency's Cybersecurity Collaboration Center based not too far from me in Fort Meade, Maryland. I'll let Morgan speak to the particulars of the CCC's mission, but it's been a pillar of the US government's efforts to support companies in the defense industrial base in their constant battle with cyber adversaries. The CCC is one of the main conduits for getting cyber threat intelligence out from the halls of NSA and into the hands of people who need it most and can actually put that intel into action. I'm so thrilled that Morgan made some time to join me on WE'RE IN and share more about the CCC's vitally important work. But before we hear from her, let's catch a quick word from our sponsor.
Attackers scan your systems daily. You just don't get the report. Synack Security Testing Platform stands out by drawing on a trusted network of global security researchers. From web apps to headless APIs, our platform helps you find and fix gaps in your security posture. Learn more at synack.com. That's s y n a c k dot com.
Of course, of course. So we'll jump right in. I have to admit if there's ever a federal agency whose reputation precedes it, it's the NSA. So I was hoping you could share a little bit about what you do for the Cybersecurity Collaboration Center. What is that?
Yeah, absolutely. I'm really excited to talk about the Collaboration Center or the CCC as we refer to it. So when we established the Cybersecurity Directorate in October 2019 here at NSA, we really wanted a ability to directly engage with our private sector counterparts to do bidirectional information sharing so that we could share our threat intel, our insights, our technical expertise directly with net defenders who could actually action it to create, you know, to share information, to have that comprehensive picture of what was happening with the threat. And so in order to be able to do that, we really had to significantly change the operating model of the National Security Agency. So the Cybersecurity Collaboration Center is actually a physical facility outside of the fence line that is primarily unclassified, where we are able to have our industry counterparts come sit side by side with our analysts and share that data and insights in real time.
But it's not just a physical facility. It's actually a virtual platform as well. Because, you know, as I said, we were started in October 2019, and we opened the doors here in the facility in December 2020, which if everyone remembers was SolarWinds. It was also during the pandemic. And so we had to be able to have a virtual platform. And so right now we are virtually collaborating with over 400 industry partners and 200 collaboration platforms worldwide. And what that means is we're able to directly share our insights with them and answer questions and just have a conversation. And so it is really significant for the National Security Agency that we have the Cybersecurity Collaboration Center, because it's really benefited us the last couple of years, not only being able to share our information directly with those who can action it, but also gaining insights and better understanding from them about the things that they're seeing against their networks.
Wow. So you jumped right in with between SolarWinds and the pandemic. And I mean, what were those early days like? I feel like that's quite the quite the mad dash. I mean, I guess there's always there's always something right in the cybersecurity world, whether it's... But but what was that like some of those early days getting things set up?
It was challenging trying to understand how do you build to this vision. Right? We knew exactly what we wanted to do. We knew that it was important to be able to have this type of direct engagement because we knew the only way to really counter a nation state actor is to get ahead of it in real time. So unique, actionable, relevant information directly in the hands of the net defenders. However, you know, you've got to build partners and capabilities and you've got to have, you know, authorities, and you got to be able to have a way to do this. And so it was a lot of learning as you're going. And so we had a lot of industry partners who were patient with us as we tried to figure this out, just how we wanted to operate day to day. And so it was really unique opportunity and experience. Luckily, everybody was kind of working their way through the pandemic. And so everybody kind of understood that we had to be patient with each other as we tried new ways of working.
So luckily we were able to kind of take that time to figure it out. But it has been fast and furious as all things are in cybersecurity, trying to make the most of people being willing to share information with us and vice versa.
That's right. Never a dull moment. That's why I especially appreciate you joining us on the program here. I know you have likely a very busy schedule indeed. I'd be curious if you could share a little bit, you mentioned this concept of the fence line, right? Which maybe people outside of Fort Meade, NSA don't really appreciate. What is CCC's relationship like with the rest of the agency? And, you know, you described it sort of distinct physically, but does that translate into into culture or mindset? Is it all part of the same mission? What can you share about that relationship?
Absolutely. So the CCC is part of the larger NSA construct and organization. Physically, we are located in a different building outside the fence line. If you've ever come up 295 and seen the seen the big NSA complex. Right? However, we really act as a bridge between the private sector and all of NSA. So, you know, we're managing the relationships, the conversations and the priorities with our private sector partners. But we are able to pull and leverage all of the technical expertise and insight across the agency, not just in Fort Meade, but worldwide, to better enrich those conversations with the private sector. So we really pride ourselves on being able to advocate for what the private sector is seeing and is concerned about so that the agency understands what those priorities are and what they're seeing against their networks. And then we're able to understand what the agency priorities are, both from the intelligence side of the house, as well as the combat support agency and ensure that our private sectors know what we care about, right?
Have you found... Are people on this tend to be on the same page? I mean, I wonder, is the vision sort of so dramatically different? I know, obviously, there's a lot of secret sauce that goes on. We won't get into any of that, of course. But like, you know, is private sector really missing a lot of key pieces of the puzzle here?
No. So, you know, what we find is that what we know is less sensitive than how we know it. Right? And so a lot of people for a lot of years have been specifically asking that they need they need context. They need to know why. They need to know prioritization. They don't want to just know a technical indicator, an IP address, a hash. They want to know why it's significant. And that's really where we feel NSA needed to step up and play its part, right? You may know all of these IP addresses are malicious, but if we know that they're tied to a specific nation state actor, it's good for us to be able to tell our private sector partners that, both either in a classified or unclassified environment so that they can prioritize resources against that activity and mitigate it as quickly as possible. We have found that our industry partners, the defense industrial base, they have playbooks specifically for how they counter specific advanced persistent threats or APTs.
And so if we can say, hey, that activity is this APT, they can then pull a playbook off the shelf and they can actually put defensive measures in place and they understand how to operate with it. So I think that the private sector has a lot of visibility worldwide on a lot of malicious activity. And when you combine that with the intelligence community's insights on who's behind it and what they're trying to accomplish, it's a really powerful position to be in. And so I think that's what we found by working directly with our industry partners over the last couple of years. Is just how much game they have and then just how much game we can have together when we join forces against a lot of these nation state actors.
We're all in this together. I remember even when covering some of the critical infrastructure industries, was like, yeah, okay. In my capacity as a reporter, I'm unbiased, but I got to admit, I have a bias for keeping the lights on, keeping The US functioning as a country. I'm not gonna deny that with some of these scary nation state threats that we can talk about. Speaking of playbooks, I understand that as we're recording this, the the Biden administration just released a national cybersecurity strategy, which is a really, really big deal. I mean, this... I I I got a chance to read through it. There's a lot of really meaty stuff in there. And I'm wondering if you can share any top takeaways or kinda how you see this strategy playing out for your work.
Yeah. I mean, first and foremost, kudos and fantastic work by the ONCD team to pull all of this together. A lot of rounds with the interagency and private sector partners to make sure it was not just a strategy, but it actually could be implemented, which is the key to most strategies. What I would offer in terms of when we look at the strategy is just the emphasis on how much lift it's going to take both not just from our private sector partners, but also from the US government. Right? We're asking a lot from the private sector, but that also means that we're willing to put a lot in the game from the US government side as well. Key focus on resiliency. What I would offer is that when you talk about nation state cyber threats, to be clear, if you have information that they want, they're going to keep coming to get it. And so, you know, it's hard to protect against those type of threats. And so what you really need
Yeah, they are. They are. And they're gonna come back. If you kick them out, they're gonna come back. And so, you know, you really have to have those sector wide resiliency efforts and regulatory efforts to better ensure that we're just raising all boats in terms of securing the technology and the networks we care the most about. I really appreciated, obviously, the portion that talks about private sector, public private partnerships, and operational collaboration. There is a lot of unique efforts that have really been set up in the last couple of years in addition to the CCC, right? You've got the Joint Cyber Defense Collaborative at CISA. You've got the new Energy Threat Analysis Center that's being set up with Department of Energy, which is the ETAC, which is named in the strategy as well. And all of these are just evolving operational models for how we plan to partner with the private sector who have unique insights in different types of networks and sectors together.
And so I think that that's a key aspect for us when we talk about the national strategy is just how we are all evolving together in the cybersecurity domain, how we are sharing information, how we are sharing insights, and how we are enacting broad mitigation guidance that benefits all of US critical infrastructure.
Yeah. For... I mean, from an outside perspective, it's really exciting stuff. I feel like we've heard for decades about this notion of public private partnerships. We need more public private partnerships. Then when the rubber hits the road, it's like, Okay, what does it actually looks like? Well, guess what? Sounds like you have an actual physical center that you can drive up to and go to where this stuff is happening. Do you feel like we've really moved the dial at all on some of those relationships? Mean, you just listed off a number of efforts from across various agencies and I guess what's happening next?
Yeah, absolutely. So first and foremost, I think we've made significant strides. To your point, I think it's been 30 now that we've used the terminology public private partnerships. I know that we've tried to morph that language more into operational collaboration. But again, what does that look like day to day? And really what it is, is a conversation, right? Bringing together the right people with the right expertise, with the right data and the right power to do something about it, that is operational collaboration when it comes to US government and the private sector. In terms of where are we going? It's really easy to do public private partnership or operational collaboration in a time of crisis. Right? When you come together, when you're talking about the Microsoft Exchange exploitation and Hafnium and you're talking about Log4j, everyone's experiencing the same pain.
They all want to come together. It's clear what the priority is. It's clear the outcome you're seeking. Right? Close the close the vulnerability, mitigate the threat, get into a better position. What's really difficult in this space is what does it look like when you don't have that? Right? What are you talking about day to day? What's the key nation state threats that everyone cares about? What's the common ground? That's where we really need to evolve to, is what are the key issues, the threats and the outcomes that we seek to accomplish in regular day to day cybersecurity? And I think that's what you're going to start to see evolve out of these operational centers is different priorities, different types of operational scenarios, and then just working day to day against nation state threats. And it's going to be a tit for tat. It is persistent engagement. As General Nakasone likes to refer to it, we're constantly, you know, defending and going after nation state threats to ensure that they're not putting our US critical infrastructure at risk.
That's really interesting your focus on the day to day because, you know, I I remember all the breathless headlines. I think Wired Lily Hay Newman had a great, great one. The internet is on fire from Log4j. It just really stands out in memory as this almost scarring event for the cybersecurity industry. But these things don't just go away in interim between these really blockbuster vulnerabilities. So keeping that focus is just so important. I'd be curious, you mentioned the need to keep this conversation and have this ongoing conversation day to day. How do you get that conversation started? What do you say to organizations? Is there a lot of outreach? I guess we're talking about it here, which will which will go out to our listeners. But, you know, how do you get the word out and how do you get those conversations moving?
So part of the role that the CCC plays for NSA is a little bit of that transparency. Right? So the fact of the matter is is that the work that we have done, the work that we're trying to do to secure the defense industrial base and assist CISA with U. S. Critical infrastructure, we publicly talk about that a lot because we want people to know that we're out there. We are trying to form the right relationships. We are trying to help. And so that's one aspect of it. I think us being named, you know, all these different entities being named in the national strategy is to show that we have that external facing presence in terms of our collaboration. What I would offer as to how these relationships get started, little bit of it is a leap of faith. Right? A little bit of it is, look, as I mentioned before, Nation-State actors, if you have information they care about, if you're a network they want to be in, they're going to keep coming after you. They're persistent. That's why we call that advanced persistent threats.
But you don't have to go in that alone. Right? We can all do this together. And so if if you wanna work, right, we have specific technical expertise, threat insights. We're willing to partner with you to share that information to better protect yourself. What do you have to lose? Right? Take the information, protect your networks, protect your customers. There's a benefit there. And you it's not just one or the other. You can partner with all of us. You can partner and enroll in all of our free cybersecurity services. I know from an NSA perspective, we offer free cybersecurity services to small to medium sized DIB companies. That's our primary audience. You can enroll in those as well as CISAs, as well as DC3 services, if you're familiar with them as well. But, you know, we pride ourselves on trying to focus on the cybersecurity services that we know that threat actors are specifically targeting a specific vector.
And so we focus on the services that protect that vector, and then we feed our insights into that service so that protects all the customers at once. So again, it's one of those things that it is a little bit of a leap of faith, but, you know, we have a lot of cybersecurity expertise here at NSA. We've been doing it for close to, you know, a couple of decades now, And we wanna make sure we bring that outside of the fence line and share that with the right people so that we... It just can benefit all of US critical infrastructure and US customers.
Just throughout a number of different acronyms. Right? And I know people from outside DC might not be familiar with everything. But if I'm a private sector organization that maybe could be a good candidate, say like one of those small to medium sized defense industrial based members who could really benefit from collaboration with CCC, I suppose they all know the acronyms too. But like, how do you know where to go? Right? Is it... Do you find yourself often, like, ferrying somebody who knocks on CCC's door and you're like, actually, maybe you'd be best served by going over to energy or going over to some of these other things? Do you often... Do you do you ever play that role at CCC, or is it is it all trying to keep things in house?
No. We actually play that role often. We we work... I talk extensively with the Department of Energy and our DHS CISA counterparts to say, okay, who's partnering with who? I've got this entity that came to me. They do not have an active DOD contract, but it looks like they're part of the energy sector. Would you like to engage with them? And they'll forward their contact information over to our energy counterparts or vice versa. So we do a lot of that internal to the US government to better ensure, like, everyone's getting the right coverage and everyone's talking to the right people. So from our perspective at NSA and the CCC, if you have an active DOD contract and access to nonpublic information, you can partner with us. And we have a number of ways of doing that, and you can actually find all that information on our website.
That's that... That's great. And I imagine that's very helpful for some of our listeners who may be feeling a little overwhelmed about, you know, hey, I wanna partner with government, but where do I go? Who do I go to? And and I think that's a perennial question. Now I know we recently marked... Not to switch gears here a little bit, but we recently marked the one year anniversary of Russia's just reckless invasion of Ukraine. And, you know, I would be curious, is is is CCC focused exclusively on sort of US centric things? I mean, I know there are some threats that emerged out of the Ukraine conflict. I wonder if you could share, is it... Has there been any intelligence sharing related to that conflict, or how has that factored into your work? Yeah. If at all.
Yeah. So I can't talk... As you know, can't talk about specific intelligence sharing, but what I will offer is that when we Fair. Yeah. When we share information with our private sector counterparts, and when I say private sector counterparts, we're talking about traditional defense industrial based partners, but also Internet service providers, cloud providers, content delivery network device. So the big ecosystem, We share that information directly with them, and we say you can use this information to protect your networks and all of your customers worldwide. We do not say that you can just protect the DIB or just protect U. Critical infrastructure. We say worldwide. And so that is part of our operating model is to get information into the hands of people who can protect the things we care about globally. Because the Department of Defense, the U. S. Government, we are global. And so we want to make sure that we're supporting that as much as possible.
I will tell you that when it came from a Russia Ukraine perspective, the best insights that we got happening in Ukraine on their networks were right from our private sector partners who were there helping them. And it gave us great insights into potentially what mitigations we needed to offer up to U. S. Critical infrastructure. And so it was a it was a real pivot for us to not only be able to partner with our private sector partners and, you know, just what's the best mitigation to protect against the things that were happening on Ukrainian networks. But we were able to release a lot of cybersecurity advisories specifically on the Russian cyber threat and the tactics and techniques and procedures that they were using and put that out to The US general public and to the net defenders so that they could protect and kind of preposition and ensure that we were not suffering some of those same type of attacks.
It's really been interesting. Just the volume of information that's come out around the Ukraine conflict specifically has been really fascinating for me to see. Definitely seems like a a sea change in some of the way that this information is getting out to people who can actually act on it. Whereas before it would have been like, don't even talk about something that sensitive that's happening in that part of the world. And now it's like, okay, how do we how do we actually fix things and make sure we're not falling prey to some of the same vulnerabilities? Now I did... I understand you're you're speaking at at RSA. I did want to give you a chance to give listeners maybe a sneak peek at what's coming up there. So, yeah, tell me about what your RSA talk is going to be.
Yeah. So really excited about RSA, in particular, the panel that I'm on, because it's a really great opportunity for not only NSA, but for our DHS CISA, Department of Energy, Department of Treasury, and FBI colleagues. So all the operational center leads to stand on stage and talk about our evolution of public private partnerships and what it means to us today and what it looks like in the future. So a little bit of what we talked about earlier and the fact that what is the evolution of operational collaboration? What does it look like day to day for each one of these operational centers? Who are they partnering with? What are the types of things that they prioritize and care about? And what type of relationships make the most sense with them? Right. You know, I think at the end of the day, as former national cyber director would say, Inglis, right, when you come to one of us, you come to all of us.
And so I think one of the key points that we want to emphasize is that if you're talking to FBI or Treasury or energy, we're all talking on the back end to ensure that we're sharing information appropriately, that we're all benefiting from that engagement, and we're helping as much as we can. And so I think that's one of the key aspects of the panel. And, you know, I get to talk a little bit about NSA and the CCC and what we're doing in this space, which is new. A lot of people don't, you know, aren't used to seeing a National Security Agency employee talking extensively about the work that they do day to day on stage. And so I really look forward to that opportunity.
That'll be great. And congratulations, by the way, Chris Inglis on his retirement. If he's listening, that was a I know I know that he had a big role to play in the crafting of the White House National Cyber Strategy and has just obviously been a tremendous influence on a number of US cyber policies over the years. So it'll be interesting to see where he goes next. I will say so intergovernmental collaboration is an interesting issue. Know, you know, obviously, we have a very close relationship with The UK's National Cybersecurity Centre. What is that like? You know, how how did the CCC come to team up with The UK's NCSC? And I guess, where do you see inter government cooperation going as as these, you know, state actors continue to just become more prevalent?
We all know that cybersecurity does not operate within countries and boundaries very well. Those nation state actors target globally. So it's really critical for us to be able to partner across the globe with all the key cybersecurity elements that have insights into these activities and how do we counter it together. A coalition is always going to be stronger in terms of how do we counter and have a more global impact. What I'll tell you from an NCSC perspective, right, fantastic organization, one of the originals when it comes to how do you do public private partnership in real time. They have a lot of partners that are the same partners as The US. And so we wanna make sure that if we're talking to these partners about the same threats, how do we team up? How do we have the most enriched conversation? Right? In the specific example, you know, in 2022, NSA partnered with NCSC through the CCC to disclose a really critical vulnerability in Microsoft Windows.
This was the first time that we jointly came out and just the discovery and disclosure and accepted attribution together. I think we'll be doing that more in the future just because obviously we want to ensure people see that we are. This is a critical vulnerability that they need to care about, so we wanna draw attention to that patching. A lot of people get patch fatigue these days, so we wanna make sure they understand and prioritize the right things that they need to patch. But really, I would just say it's a marked change for us that accepting attribution for discovery and disclosure of a critical vulnerability from an NSA perspective, and that's something that we've been doing extensively over the last couple years. When it comes to intergovernment coalitions and working together, we have just seen huge benefit in partnering with our government entities and POCs across the globe in terms of just how we're countering these threats together.
I hope you can get special business cards printed that spell center c e n t r e for The UK visits. Is that something diplomatically that you've worked on?
I don't know. That might take a little bit of effort for people to really wrap their heads around from a culture change perspective. We'll try to We stick
can stick with center. I guess The US spelling, we don't need to go down the rabbit hole of too many variants. So I see you're a big fan of women in cybersecurity. What can you tell me about that organization? Just more broadly, what are some of the challenges for women in the cybersecurity industry now?
Yeah. I very much appreciate and have invested a lot of time ensuring that we promote getting more women into the cybersecurity field. And the Women's in Cybersecurity Conference and various organizations like that are one of the ones we obviously spend a lot of time just from a recruitment perspective. But there's a lot of great organizations out there that are doing this type of work and something that we want to support from a national security agency. What I will tell you is that in terms of barriers and recommendations to people, here's what I would offer for women that want to get into this field. First and foremost, right, get a good mentor, get a good pack, people that you can rely on to ask questions that have been through specific challenges before barriers, ask how they worked their way through it. I think that's really critically important as you go into this field or any field in general. But I would say in cybersecurity, in particular, is finding those key mentors and advocates, people that want to give you those opportunities to really succeed.
Secondly, cybersecurity education. There's a lot of classes and courses out there. Some of them are free, some of them cost, some of those are scholarships and grants. Take advantage of them. Take advantage of the time to really just build your background. I don't have a cybersecurity degree, but I've spent almost fifteen years in the cybersecurity field, and I benefited from being able to take those courses. So I would just really recommend that people spend time seeing what's out there and take advantage of it while they can. And then lastly, get ready to get uncomfortable. It's Okay to be in a field and be surrounded by people that have a lot of technical expertise that you don't quite necessarily have the background in. But if you ask questions and you're curious, what I have found is that cybersecurity professionals and people in this field, they want to help. They want to explain it to you. They want to build the foundation of people who are interested in what's happening in this space.
And so I have always found that the cybersecurity cadre of experts across the globe and in different places, they are just they want people to be involved and interested in what they do on day to day, and they want to talk about it. So just ask the right questions and, you know, get ready to learn.
Those are all fantastic recommendations. So you mentioned your background was not in cybersecurity. And in fact, I see that you got your bachelor's degree in peace, war and defense, which I haven't actually heard of before. I mean, I've heard of peace and war and defense, but just not necessarily that as a bachelor's degree. Guess, have you always wanted to work for government and what got you onto this path?
So, yeah, peace, war and defense degree at UNC Chapel Hill. It's one that I absolutely loved, but it's not one I commonly come across anyone else has that bachelor's degree, completely understand. So I will tell you that I grew up from a very young age playing sports. And so I've always been in team sports. I've always recognized the importance of, you know, being part of something that's bigger than yourself. I was in high school around the time of 9/11. I'm not going to say the specific grade to age myself, but what I will tell you is in high school during 9/11. And what happened was is that I I just didn't understand what was happening. I didn't understand who was behind it. I didn't understand why it occurred. But I... What I did know is I didn't want it to happen again. And so I became very interested in national security and pursuing, you know, a deeper understanding of who are these actors, what are they behind, how do they operate, and how do we dismantle and disrupt their operations.
So went into I got my bachelor's degree in peace, war and defense, my master's in strategic intelligence. And I think one of the main things I became fascinated with was not just how do you connect the dots, but how do you see around the corners. So what is the threat that's coming in the future? And that's really where cybersecurity came in. And I've been in that field forever. That is why I got so interested into working in the US government and the National Security Agency. One of the reasons that I stay, though, I will tell you, is that a lot of people know that the two missions of NSA is signals intelligence, but also cybersecurity, but we are a combat support agency. And so we secure the communications of the warfighters overseas. A couple of years ago, I was able to go over to Afghanistan to thank a lot of the deployed personnel for what they were doing on a day to day basis to keep our nation safe. Unfortunately, not all of those personnel made it home. And so really understanding the significance that we play and trying to ensure they have that indication and warning that we secure the comms that may allow them to move safely through theater.
Just wanted to make sure more and more of those people made it home every single day. And so that's one of the reasons I continue to pursue national security, and I'm passionate about what we do here at the National Security Agency.
I think our listeners could all agree this is a dramatically important mission, and and thank you for sharing that. And as I understand it, the NSA is also hiring. I saw that Rob Joyce tweeted something about recently. I know that's been a bit of a bumpy market for some tech and cyber companies, but there's been some I guess there's there's hiring going on there. So something to stay tuned for.
It's our biggest hiring year yet. So please do. We're looking for all the type of qualified people, backgrounds of all types of varieties. So if you're interested, intelligencecareers.gov, please come see us.
I will say, speaking of Rob Joyce, I hear he assembles quite the epic array of Christmas lights. Have you ever had the chance to swing by and see those in person? They sound like something. Really something. Yeah.
They are. I have seen them in person. It is quite daunting. I would recommend not necessarily going there with, say, your spouse or family who now realizes that they may have to put on the same type of Christmas light display for your kids because your kids' expectations are very high. But it attracts a ton of talent, a ton of people to come see him. It is something that he invests a lot of time in. We're very proud of him. We try to challenge him every year to make him bigger and better. But he's still got to climb up on that roof every year to put those lights on. We need our cybersecurity So we tell him to be safe.
Please be safe. I would 100% either fall or elect to myself trying to assemble something like that. But you know that's that's why I don't don't string up too many Christmas lights every year. So thank you again for joining us. This is... We we have one final question we ask all of our guests here which is what's something that we wouldn't know about you just by looking at your LinkedIn profile?
So I have two happy places. First and foremost, the beach. I just love being at the beach as much as humanly possible. Is just... It is in my blood. Secondly, I am born and raised in Baltimore. And so one of my other passions is really helping a lot of nonprofits around Baltimore. Just I think there's something about volunteering that's really great. You know, I have a problem saying no to things. I like to be involved in a lot of activities, but there is just something that makes my heart extremely happy in terms of volunteering around Baltimore for a lot of the work that they're doing there.
That's great. That's great. And I guess we didn't touch on which team sport you played. It sounded like you had a good sense of offense and defense. Back in high school, what your sport of choice?
So I played soccer and lacrosse in high school, but I played lacrosse at UNC. So I was able to play at the collegiate division one level. And so that gets you training and moving sixteen hours a day. So I'm used to running constantly, which I guess got me prepared for cyber.
Oh, absolutely. Yeah, I went to Northwestern, huge lacrosse school, so definitely not that I played, but that's all great and certainly can relate to sometimes needing get away from all the APTs and relax on the beach. So hopefully, maybe after your RSA talk, you get a chance to do that soon. And thanks again so much, Morgan, for joining us. Really appreciate your insights and wish you luck at the CCC.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack testing platform to their own customers. This approach helps optimize Synack partners technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
