How the Public Sector Addresses Cybersecurity Hiring Hurdles

00:03 Good morning, and good afternoon all. Welcome to today's virtual session. Which will feature a discussion on overcoming cybersecurity hiring hurdles and security testing challenges in the public sector brought to you by Synack and featuring our guests from the US Department of Health and Human Services. My name is Luke Luckett. I'm on the product marketing team here at Synack, serving as moderator later today. We'll be taking questions at the end of the program and encourage you to send your questions and comments throughout the session using the Q&A feature located on the

00:33 right hand corner of your screen. Today, we're gonna cover the cyber talent gap, hiring, training and diversity, continuous security testing, zero trust, and, of course, your questions. So without further ado, it's my great pleasure to welcome our subject matter experts today. Matthew Shelby, Director of Security Design and Innovation at the US Department of Health and Human Services, and Scott Ormiston, Federal Solutions Architect at Synack. And with that, I'll hand it over to Matthew for the next slide.

01:05 Let me, tell you first a little bit about HHS before we get started. We are the largest civilian agency in the federal government, we have eleven operating divisions. Most folks are familiar with FDA, CDC, NIH, but we have a wide ranging set of missions and, of a large number of employees, eighty four thousand federal employees, not including contracting staff. Of those eighty four thousand staff,

01:36 only a little over twelve thousand are in designated cyber-related roles. Of those twelve thousand, only thirty two percent are in core cybersecurity roles. Sixty three percent have some cyber goals. Is those or, cybersecurity is a second job up. So we really struggle with federal government to maintain, that leadership. Sixty percent of our staff are in DC,

02:09 eleven percent are down in Atlanta. Both those, are markets have a lot of competing organizations, competing, companies within, the technology space and that we are all challenged with. And hiring from the same pool of people. The biggest challenges that we see in overcoming, this cyber talent shortage is, the way our budgets are created, and digital resources we have available. To bring to bear to hire and maintain people.

02:41 Our salaries are significantly lower than than the rest of the marketplace. Thank you, Matthew, for that introduction. Before we go back and dive into the talent gap discussion, I wanna give a little background on Synack. Synack, is a technology company that combines a technology platform with a global network of vetted researchers. These are some of the best researchers in the world, security researchers, and we use this talent pool combined

03:13 with our technology platform to be able to provide, cybersecurity, efforts like penetration testing and other, task at large scale. In the year twenty twenty one, we conducted over thirty seven thousand tests across over four hundred organizations. So as we start talking about security talent gap, you know, really one of the main drivers of the

03:44 gap is the zero percent unemployment rate within the cyber space. There's just not enough skilled people for the positions that are out there. So when you look at it, it really comes down to three categories. You have capacity, capability, and cost. So capacity, there's over two point seven million unfilled cybersecurity jobs. And, you know, so recruiting is a very challenging process. You know, as Matthew mentioned, you know, a lot of it comes down to how many people are competing for

04:16 the same person within the area, either within a technology area or within a physical location. The second piece is capability is that cybersecurity personnel, you know, it's a very broad field. There's a lot of different skill sets required. And what you find is that being able to build a team with the capabilities across the entire skill sets you need is very challenging. And then as Matthew mentioned, the cost, there is fierce salary competition?

04:48 And as Matthew said, you know, the federal employees on average lag behind the private sector by twenty two point four seven percent. This is across all fields. So if you take a look at a field like cybersecurity where people in the private sector are able to make, you know, hundreds of thousand dollars a year in a senior cyber role. You know, the federal government's pay scales are just not comparable. So the people that are doing this in the federal government are doing it for a lot of other reasons. They're definitely not doing it for the pay.

05:19 Turn it back over to you, Matthew, if you wanna cover a little bit of where you are in the current state? Yeah. Thank you, Scott. So as I as I mentioned, if we were to look at our workforce assessment, and think about what our challenges are, some quotes we've had as we've we've worked across the agency on the challenges are the cybersecurity budget in general as well below industry standards for the total percent of IT budget. The biggest barriers are budget and pay flexibility and

05:52 the ability to recruit and hire cybersecurity professionals, the right expertise and skills, the right level with competitive pay is the most significant challenge. Across the board, those are quotes that will, resurface over and over again. We are taking steps, to address this workforce and trainings. Always one of the biggest, priorities both in our strategy and in the operating divisions. Couple things we've been doing it. Doing specifically,

06:24 focusing on retention. I think diversity in the federal government has always been a strength long standing commitment diversity, both in terms of backgrounds, but also training, also quite a bit of mobility within the federal government. I think last year as we get an analysis of who was leaving our program. Majority of folks who are either moving within the department or moving within the federal government.

06:54 And that's fairly consistent across the board. So there's a lot of, there's a lot of retention. So people are very, devoted to the mission, the public mission. So that's that's good part of the story. But we still we still need some tools, to maintain and focus on building those people that we made. So there are two things we've really been a few things we've been doing is, following the NICE framework, and taking an inventory of where

07:24 our skills are strong and where they're weak. What that's come out is it's shown where we can improve our training and where we can improve our focus. So some of the roles that HHS is looking, at enhancing training and hiring are things like exploitation analyst, cyber defense forensics analyst, secure software assessor and evaluation specialist. We can see that those are very, focused roles and targeted at reducing risk,

07:58 and maintaining, our defensive technology. From a process perspective, a few things that we've been doing are working together with IT and HR. So we coordinate our, hiring practices. Typically, the first vetting goes through the HR process and they don't really understand the, the CVs are getting very formulaic. And so we end up having to redo,

08:31 hiring processes over and over again. So coming together allows HR to provide a much clearer, much much more focused set of candidates to us the first go, and so we have a we have assurances that, people with maybe not the right training, but the right history are still coming through. So primarily, it was a matter of telling HR and getting HR on board so they knew that it

09:02 wasn't just classes and certifications that we were looking for, but it was evidence of skill sets and specific languages and specific capabilities that think the key on, and that's been hugely helpful for us in terms of, building our first line, in book. The other thing we've done is we've allowed our job requisitions to be available within the entire department. So NIH puts one out, and it is cybersecurity related, posting Office of the Secretary or CDC can hire against that requisition after NIH has had

09:34 the first cut same thing. So sharing those requisitions has really improved, our hiring processes because the hiring process in the federal government it takes a long time. You can frustrate people who are coming from industry. So that helps improve our pipeline, immensely. And then once we get people in, like I said, following the NICE framework and, identifying where we are weak has helped us target our training for specific roles. So as we take a deeper look at this,

10:07 let's take a look at an area that's actually driving a lot of this for advanced cyber skills. And, you know, really one of the major drivers for that is digital transformation. And, what we see with digital transformation is we see a whole bunch of things coming together. We see that the sophistication of a actors that are looking at our systems has gone up significantly. As you see here, the number, seventy four percent of financial institutions

10:39 experienced ransomware. But the real scary part is over sixty percent were successful, and they paid a ransom. The financial institutions paid a ransom on over sixty percent of these. So cyber criminals are being very successful. Attackers are responding so much faster today than they were five even five years ago. You know, within the time that a vulnerability is released into the public. Within five minutes of that release, attackers are out scanning your systems. They're looking for vulnerabilities.

11:10 And, you know, vulnerabilities, the number of unpatched vulnerabilities. That's really, you know, just kind of been across since I've been in the industries, how do you keep patching up to date? You know, patching itself is a full time job for a whole crew of people with special skills. She take all of this and, you know, you really look at the fact that patch number of unpatched vulnerabilities year over year keeps growing. And part of that is due to the fact that software is continuously changing.

11:41 You know, continue software development, real time patch really, you know, updates that are being posted out. Patch Tuesdays are coming out from Microsoft. You know, software is changing constantly. And, you know, that's being driven not only by industry, but, you know, by cloud computing, by agile development techniques. And all these things that have come together, and they really create this need for continuous testing. You can't any longer do a test and then three years later come back and say, okay, I'm ready to test again.

12:12 Because in those three years, how much surface have you exposed to your adversaries to come out there. So if you don't have enough skilled personnel to run a continuous testing program and did continuously be looking at your assets How do you address that challenge? That's really, you know, kind of the question we're posing here. I think, Scott, the challenge in the federal government as well as we're still pulling away from the concept of compliance and that just adds to the to the struggle.

12:43 If we could focus on what's really really important and test those, we might have enough bodies, but, it's really a challenge between trying to patch vulnerabilities, also do your ATO process, also, check your HVAs, also or your regular scanning. It's just it's it never seems to get, smaller. The footprint never shrinks if it's always expanding. And there's never, you know, there's always a, abundance of reporting requirements too that I'm sure

13:14 you have to meet. So, you know, when we look at, you know, penetration testing, we talk about that. We this need for it, but when we talk about traditional penetration testing, we really run into kind of three main issues, slow and static, Again, not enough people to run penetration tests all the time on all the systems. You know, if you have a penetration testing team, you know, a good sized team, maybe a dozen people in a larger organization. There's still not enough people to go out and test you know,

13:45 hundreds or thousands of assets. And, you know, doing this requires, a lot of scheduling, a lot of work around that. You have to, you know, take time away from your normal activities when you're supporting these pen tests. And then it's, you know, using automation tools. I, you know, there's a lot today about automated pen testing and automating vulnerability scanning. One of the challenges though is that creates a lot of noise across systems. So you take these things and that just creates more of a

14:15 workload, really. You get all those noise out of these tools and now your security analysts are having to sift through it and go through it and try to identify what's important and what's not. You know, as you talk about this, it really creates even more of a challenge here for personnel. Yeah. I think that the that it's it's a huge issue. Again, HHS has, you know, in its in its federated model, we have, pen test teams

14:45 that are centrally located. We have pen test teams that are focused just on ATO. We have teams running Tenable. We have teams that are focused on auditing high value assets. The operating divisions have their own implementation. I'm sure this leads competition for the same, skill sets as well. But commonly, what we see in some of those assessments are, stay on the ATO side, wait for up to a year to get a penetration test for, or assessment as part of that process.

15:17 And even and then when we do, you know, you'll get a big long spreadsheet of every single finding. And, automated scans are great and important, but I feel like they drive. They answer the question around how well we're doing a configuration management, really, it's not really about vulnerability management at that point. Useful and effective for making sure that programs are running well, but it's not the full story. And as you say, it's it's it's a lot of low quality noise

15:49 that often doesn't really need to be there and just is just work. And so really figuring out how to get past that and focus on what's what's really important is, is critical, I think. Yeah. I Yeah. I would say that, you know, in my operational experience, you know, being able to eliminate all that background noise is just as important, you know, having additional tools,

16:19 having additional capabilities is only useful if you can actually synthesize that into intelligence. And that's the difference to me between data and, you know, events and, you know, intelligence. You gotta be able to turn it into intelligence that you can then act against. You know, as we talk about this, you know, move forward. We're talking about one of those additional requirements coming in. You know, we talked about zero trust and, OMB memorandum M-22-09. Really coming out.

16:49 And I think really doing something that needed to be done in the federal government, which was coming up with a strategy where we're no longer willing to say that just because I am putting something behind the fence line, it's safe. I'm now saying that no matter where my data is, and where the where my application is, and no matter who is trying to access it, to it. I'm gonna verify all the time that the person, the entity, the activity has the need to the data and

17:21 accessing the data in a proper way and that data is secure even if it were picked up and moved, you know, say it was a bank vault and say, now I pick up this bank vault and I move it and I sit it out in the middle of the street instead of having it inside of a fortified facility. Is it still a secure bank vault? There's a lot of what Zero Trust talks about. So, I mean, I know from the standpoint yes, it's a great to have this architecture, but this also means additional stress on a cyber workforce that's under pressure.

17:53 Yeah. Yeah. I mean, if you, if you ask any cybersecurity professional to, describe zero trust, depending on their age, they will they will probably hem and haw and get a little frustrated. And, it's it is a hot topic. I do think, we've kind of gone over the hump there, thankfully, and it's it's not, it doesn't feel like, a marketing term. I mean, people are beginning to really understand, what it means and things

18:24 how to implement it in certain ways. I across the board, when I talk to other agencies top within the agency, although there are five pillars, the two that are really, seeing the most focus for us are the identity and the data side. And that makes sense. Right? I think, all of the other layers are all protecting sensitive data, and we all wanna serve our customers. So it makes sense that those two things,

18:57 are seeing the most focus. However, I think we're we're a lot of And at some level, I think that's a function of how the federal government is designed and funded, the administrative areas often are regular IT, cybersecurity typically sits in the admin areas. Right? So it's it's general ITs and network ITs that identity stores and things like that.

19:28 And they understand, or or it's the storage. So data and identity fit within the CISO paradigm very well. And so when you're talking just to the CISOs, those are the kind of kinds of areas that you're gonna focus on. But where we're gonna see a lot of, additional work and a lot of additional requirements are in that application workload area. The, you know, pen testing is a significant part of zero trust.

19:58 If you read into it, public disclosure is called out, the need for working with trusted third parties for testing your your software, reviewing your, supply chain, both hardware and software supply chain, having a software bill of materials. All of those things are part of, the zero trust life cycle, and secure software development practices and immutable

20:28 workloads, there's quite a bit in If not in the explicit requirements and actions in M-22-09, in the description areas, there's a lot of assumptions about organizations sharing their processes across the board, to achieve the concepts of zero trust in a large part, I think that's where most agencies are treating this. They're they're looking at what are we already doing?

20:59 How are we already modernizing? What do we need to adjust in those modernization efforts, to make sure we're we're achieving zero trust principles, because it's really, you know, there are those who argue. It's it's there's not a whole lot new here granted that's fair, but I do think, the scope and scale of technology now means the real vision for zero trust as possible and Google proved it.

21:30 And I think we are proving it, date For HHS, penetration testing has been an important part of, speeding our deployment processes. We'll we'll talk about that later, but, we could not have achieved some of the, things we've achieved under M-22-09, particularly in VDP without going outside of our own organization, using a crowdsourced model, to expedite the deployment and

22:02 expedite our compliance with some of these things. So, yeah, I think this is a good approach for us. It's gonna challenge us to, expedite a few of these areas, but there's a lot of work to do. And as of anything, not not the same. There's not enough resources to get all of this done to focusing on what makes the biggest impact for the mission is really critical for improving incrementally over time.

22:32 Yeah. I do like how you, you know, kinda honed in on identity and data, and I think it's interesting even in this diagram, that they're kind of at the end. They're kinda like, you know, the two ends of the spectrum because, you know, our federal government doesn't exist to collect and store data securely away from everyone's view. We especially in an organization like HHS, it's about collecting and putting together data and then sharing it so the world can benefit from it. I mean, if you look at the mission of NIH,

23:02 or you look at the mission of CMS with funding and taking care of, you know, you know, Medicare and Medicaid programs. It's about getting data out there and making it useful for the average citizen. So Right. Having that data available, but yet at the same time knowing who's having access to it and ensuring their access is appropriate. So, you know, it's a funny thing you focus on that because I, you know, particularly between NIH and FDA, they have really diametrically opposed missions. Right? NIH is a research organization.

23:32 They're in the job of giving away information and letting people figure out creative solutions for, medical information. But an FDA maintains, you know, corporately sensitive data that cannot get released until a certain time frame. So embargoed information about new drugs and new equipment is sort of really diametrically opposed, missions at some level, but they still are performing essentially the same functions from cybersecurity the same

24:05 tasks that have to be performed. Whether you wanna make sure that the right data gets out or no data gets out, it's it's really a lot of the same function. And as we said, penetration testing, to test your assumptions about how well you're doing is a is a critical assessment, auditor critical of any kind. So as we talk about, you know, just one of the things you mentioned as we're talking about zero trust is about, you know,

24:35 moving from a compliance based to a more of a risk based model. So as we look at that, let's kinda look at, you know, what are what are some of the ways or and some of the things that you guys been doing around operationalizing your penetration testing specifically. You know, I know we've done a lot of work with you in the last, two and a half years, I guess, on the vulnerability disclosure program as we come up on the, deadline, this September for having you know,

25:05 VDP established across all your public web spaces? Yeah. So, I mean, HHS was sort of ahead of the game. We've had a relationship now for almost five years. So, we've been using this crowdsource penetration testing model, for a long even before VDP, was a thing from from, CISA. And we found a lot of the value in it. You know, really was augmenting our staff.

25:36 Again, we have a long time frames for, getting scheduling penetration tests. We had, the long spreadsheets that we're passing around of Tenable findings to secure systems. None of it really, worked the way we wanted it to, and it wasn't wasn't effective. It certainly didn't work for, the newer most software development, and because the federal government is so federated, this development teams are funded by programs,

26:08 they're they're a little deeper in the environment. The security teams are typically centralized, and that sets up a dichotomy often that is that is really, just not very functional. And certainly when we get into the VDP program where we have what most people consider just compliance exercise, we have to accept, reports from the public of things they find in our systems. You know, I think a lot of HHS's approach was we're we're gonna treat

26:38 this as a risk reduction exercise. So we have this relationship. We have capability, to really rigorously test everything. HHS has, you know, done it's We have the most top level with over a hundred second level domains, just in .gov. And we have second level domains in dot com, .io and others. But Just in .gov, we have the most second level domains of

27:08 any organization we have close to seven thousand, third level domains that we have to manage and test. We have an enormous footprint on the internet We also have some of the most recognizable with CDC and NIH, at sets on the internet. And certainly HealthCare.gov now as well. So, across the board, HHS is both vast and well known and So a good target for,

27:40 troublemakers and hackers. So we wanted to approach the VDP as a risk reduction exercise, which meant we wanted to make sure that, we utilize the crowd from Synack to close vulnerabilities before we turned anything over to the public. We wanted to make sure that we've used the processes and the systems, in place so that the security teams that were centralized and

28:12 the development teams who were sort of on the edges actually knew who they were and could practice communicating, practice the processes that we developed and ensure that when we got a public response, we could respond in timely manner. Typically, the federal government is a little slower on repairing findings. We have this plan process where we put things in a on a plan to fix, not necessarily fixed. When you get a public disclosure, you don't want that hanging out there for a long time.

28:42 You really wanna be able to respond quickly So we used two years, to practice those processes, build those relationships, and reduce our risk overall. We did, a hundred and ninety six assessments. We had an average of about a hundred and fifty hours per assessment thirty researchers or so on every assessment. I mean, overall, we did forty five thousand hours over forty five thousand hours of testing. On our just on our perimeter services

29:15 as part of the VDP program. We still have a little bit to go, but we're we're so very close, and I'm happy where we're at because we didn't just we could have easily just published the domains and accepted we had, but we really used it to improve, the relationships and our function inside. My hope my goal of that program was that we would then, again, touch base with more of the programs, more of the development programs,

29:45 and get them interested in the service, some of the things we found with having a central portal where all of the findings, are held. And a portal that allows us, to interact with the researchers, those teams that were using agile methods to develop really liked the process. They were they were afraid of penetration test typically because they have to test, they have to stop developing,

30:17 they have to wait for results, then they have to fix things. And then they're it was just a really slow linear process and having this crowd and the portal with Synack allowed us to, so parallelize it. You do everything in parallel. Excuse me. I won't create a new word. Do everything in parallel and schedule quickly. We really couldn't have done the VDP the way we did without using a crowdsourced model and out a centralized, platform like someone had.

30:50 You know, the case we heard often was the human insight was key. Several we have tools across the board. We do, web application scanning. We do database scanning. And because because there are more developers and more programs out there than there are cybersecurity specialists, we obviously are using automated tools, to try to drive down our risk. And they're great. Absolutely necessary tools. But when you put a bunch of humans on a target,

31:21 even if it's been scanned and edited or scanned and pen tested by a automated tool, you will find new problems and new issues in India over and over again. We would follow automated assessments, and the system owners would come back and say, wow, we have never seen anything like this, or my favorite examples are when, the researcher not the researcher, but the system when it comes, it says I got it fixed.

31:53 They go in and they say it's fixed. They ask for a retest, and, researcher comes back says, well, almost, but I've done x y and z and I got by it again. And, I the system owner says, wow, that was really cool. I thought, let me try it again. Right? The back and forth interaction I think has been a big selling point for improving the trust, improving the interest in this crowdsourced model for

32:25 And like I said, we could not have done any of this without offloading it onto the crowd. We just we just had too much to do. Yeah. And I think it comes also to the fact of, you know, you can talk about scale of number of tests, but I also think about it at scale of human, you know, take the scale of human insight. If I have five of the best pen testers in the world and I have them go test something, I'm gonna get five viewpoints on what's vulnerable. If I have a hundred or thirty or twenty

33:00 five or whatever that number is, if I can multiply the number of different viewpoints. I'm applying to it a problem. That's just something that is very difficult to do. And today's, you know, federal government hiring area even even getting people to work across organizations, I've seen tried. And even when you do that, get it past your bureaucracy, it's just creates is really it really creates a challenge. So, you know, the more human eyesight we can have look at something, the more likely we are to find majority of the vulnerabilities

33:30 is kinda how I look at it. And on the same side, we, you know, the platform allows is very detailed in the findings and the repair steps So, you get these highly skilled pen testers on targets. And the skill level of the developers may not be up to par But the platform allows that kind of interaction and honestly knowledge transfer, to improve over time. So, you know, there's a lot to be said about how

34:00 documentation flows, the way the crowd works, the way the platform works, forces well documented findings, and it forces, you know, high value findings out of it. So very few of our findings to be said. We're just not gonna fix it. It's it's, it's not it's not important. Most often, what'll happen is there's a nuance in the way the federal government works. We often share information in a way that makes researchers anxious,

34:33 and they will they will flag data disclosures on us that we said, you know what? That's part of our mission. We give that data away. It's okay. And that's probably the most common thing we, will flag is not fixed, but that the valued small targeted findings as pose a huge list is hugely critical in all process. Yeah. So just moving forward a little bit, you know, as we talk about this, we talk about zero trust. We talk about, you know, closing that talent gap.

35:03 We talk about digital transformation. Really, I think the goal for all of us is to move along a maturity model of one sort or another. I picked the C2M2 because this is one that HHS actually posted for, you know, health care organizations out in the commercial world. It's kind of the guidance they were providing them, and this is how you can improve yourself And so, you know, the real key to this is that by using, innovative approaches of combining together technology,

35:35 people, partners, you know, Synack for it, combining together with HHS. I think we've seen, you know, over the last couple of years, your ability to kind of move up the scale and moving towards, you know, a more proactive, optimized approach. You know, we may never get to the perfect world. But you know what, we should always aspire to it. It's kinda how I think of this slide. Yeah. I think, you know, we've we've we've let we let you manage the part of it that you're good at, and we respond to it, and it's allowed us to,

36:10 go up the scale toward manage and review. I don't know the word optimizing yet, but certainly having, having a portal and practicing these assessments over and over and over again. I mean, for us, a hundred and ninety six assessments is quite a bit. And a number of the operating divisions under HHS were performing these assessments time and time again. So we were able to integrate the findings into our other processes

36:43 and expedite those processes in integrating them into, you know, our SIEM and reporting in that way. Drive them up to executives and turn them into, risk discussions on how to change other processes, I've had discussions on the ATO process. I've had discussions on the HVA assessment process. All all focused on standardizing how we behave in these areas and focusing on what's really important.

37:15 I think, the VDP process let us see that you may not have to if you have a good process that is repeatable, and then you are in this managed, or even in the defined, but moving it to managed. And certainly, if you're not optimizing, if you have a process that is repeatable and successful and quick, you don't necessarily have to spend

37:45 a month assessing everything the way that people have typically been doing on the cybersecurity framework or or in the ATO process. You can target your tests, respond, and repair, and do it over and over again in a way that, gives you the assurance that the process you think are placed, you think you think are in place are actually in place. So I think this is,

38:15 you know, these are act aspirational and always trying to figure out how to assess where you're at in these layers is hard, but, I think with the this focus effort, the crowdsourced penetration test and the platform, form and getting the teams together. We at least be getting we've begun to have the discussions around how can we model some of activities in other areas as well and increase our, review, I think.

38:47 It's been it's been fair it's been really simple for us to, show where our risk is. Show where our risk is improving. And show how the specific system owners who are engaging with us over and over again and are improving their capabilities over time, as we test and retest and retest. And that's that's sort of you ever had sort of moved into here. Some of the folks have been really specific in this area for us,

39:19 historically, some pretty significant, missions when we did, the COVID nineteen portal when we did telehealth, various other number of systems during COVID nineteen. We were deploying them very quickly. We had a lot of assistance from industry and they were challenging us because they were used to functioning in that agile method and deploying quickly. And we had to develop a process that gave us assurance

39:49 is that the right controls were in place, that we understood the functioning of the system, how the data was flowing, who was accessing it, and we use the crowdsource penetration testing model, to validate our assumptions every time before we deployed a new system within that effort. Likewise, when Medicare was developed in, a new API, they called Blue Button.

40:20 I think the week before was ready to go live. The US Digital Service team, a crack team, usually skilled, who's trusted, but we still needed to have that third party validation. So we pen tested their API, and it really exemplified how the portal could be used and should be used and organizations could change their processes. So typically, our assessments run ten days.

40:50 In a normal assessment, it may run it may run that long, but you have to wait another ten days to get the finding, and then they'd have to fix. So On the Blue Button assessment, for example, we have the assessors on the platform. We have the developers on the platform. And at the end of the ten days, the assess the all the findings that the assessor found had been fixed. So while they were testing, the developers were fixing and going back and forth, back and forth, and not everything got fixed the first time around.

41:20 But that team absolutely works well in the platform. It's a perfect example of how you can expedite the system assessment and repair all at the same time. If you've got the right team to engage platform. We have some of that. I think our Office of the Assistant Secretary for Health, has a number of platforms they develop to support, the Public Health Service Commissioned Corps,

41:50 the fifth uniform branch and the federal government, and deploy for emergencies of all kinds, whether they're nature related, floods, hurricanes, fires, or whether, you know, the medical emergencies. They deploy all across, the country all across the world. So quite a bit of content development and system development. We were able to engage with them, on as part of their release cycle. Not quite as fast and vibrant as the Digital Service team,

42:21 but still better than waiting for the assessment and the findings and doing an iterative approach. And we've seen over time how their, the number of findings, the kinds of findings have slowly reduced as they've, not only you know, seeing what's what they're doing wrong with taking new account and change their development process on the inside. So I think this is where that, you know, betting these kinds of tests in a way

42:53 that your development teams can engage with and work into their processes. I mean, these are, you know, using Git and these iterative approaches they don't wanna wait for anybody. They really want just be able to give me a test, show what I need to fix, and let me take care of it. And so that's that's been a critical enabler. And something I have to really push, and continue to push out the HHS. So we can walk up that maturity model,

43:23 in more places than than just these. Yeah. And I think it's very important that, you know, having technology for the technology really doesn't help any of us. It's it's about having it's about having technology and people and then bringing them together in a way that works within everyone's system. So it's about the integrations. It's about the ability to share information. You know, having a pen tester go and test in a bubble and then deliver a report, paper report two weeks later or two months later,

43:53 depending on what agency you're at, I've worked with both. Isn't near as useful as having a pen tester who's posting, you know, you're getting the reports live, and then you're able to take a look at it and ask questions and interact in a in a very open and collaborative environment. It becomes much more of a, you know, I like the idea of kind of purple team. You're not you're not here to I'm not here as the red team. I'm not the enemy. I'm here as part of your team to develop a better product and get it fielded as fast as we can.

44:24 Right. I think for us, it's it's been the combination of, the trust that's been built between the technical level, right, the developers and the researchers tend to speak similar languages and can interact, and the findings are high quality. And so there's been a level of trust and comfort that's certainly brought over time with the model, which is a little unusual in the federal government. Really unusual, I'd say.

44:54 But we've also been able to extract good information and good high level risk information, the system as well and can compare organizations, so that the executives can feel like, okay. We understand what's happening. That's one of the reasons, we utilized tool during COVID nineteen, because the executives understood what was happening,

45:24 the developers were comfortable with the process. And when we ran through an assessment and we said everything was fixed, everybody felt, okay, we've got as much confidence as we can have that given the architecture, we're good enough to deploy. And so that it was really important, just that trust across the board was really important as part of that process. And the nice thing is that just because you ran the test, with the scalability doesn't mean you have to wait another

45:54 year or three years or whatever it is to test again. You can put it on the calendar if a high value asset. You can come back in three months and hit it again. You know, that's kind of the goal of where where you wanna get to. And you know, as we work through this, I think we kinda get to that. You know, when you talk about continuous pen testing, and that's why next slide is really talking about it is continuous pen testing realistic? And really the simple answer to this is yes, because your adversaries are doing it every day. They're continuously pen testing your environment.

46:24 So we have to work together to figure out how to do that on our side to keep the bad guys out. Right. I think it's as we said, I mean, if we run Tenable scans or whatever, I mean, not the best Tenable scans, if we use them, they're hugely important to what we do every day. But you know, there's lots of things to fix. And what we really want is to know what's the attacker gonna go after first. Right? What do we need to prioritize? And I think that's been, very important for us,

46:55 in terms of either having a continuing continuous assessment or having multiple, assessments on the same targets or the or or the same footprint, I think, I love being able to sort of toss the schedule over the fence and say, hey, Synack. We need four more. What are we gonna do? And have it happen. I love having knowing that we are going to get a solid number of assessors on a test,

47:26 and I love having some confidence that if a target is interesting, we will get a requisite level of activity. So, even the stats around how many, researchers would get on a target and how many hours are put on target, it tells us information about, the quality of that target and the scope of that target. So

47:56 you know, it's been it's been hugely important to help us know where to put sources know how to talk about our risk in a new way. And I think, now that we've gone through this process, the discussion will be is much easier for us to just schedule and reschedule and reschedule the assessor, the system owners know what they're gonna get. They know that they know they're not gonna get taken down.

48:29 And they know they're gonna get quality findings that mean something to them in terms of, fixing I think the challenge for us will be to, convert some of our new customers into what our older customers are doing, which is doing, authenticated assessments and giving accounts and going into that deeper process to understand, not only what an external attacker would see, but also assuming that they've captured a credential or which

49:01 is not a big assumption, but assuming they've captured a credential, knowing how well the system itself is protecting itself from different roles and responsibilities within the system. And that's that's been a, that's been a significant value for us as well. I mentioned OASH before. They've been huge customers of that part of the process. And, I think that's where you really it's really critical to do that kind of process over

49:32 and over again because sometimes it's, it's not just coding errors or coding practices. It really is structural within the application that you get the challenge developers to fix. So it's really important to continue both kinds of assessments. We do, high value asset testing within the government that requires us to tunnel activities inside, and for those, we typically test them over and over and over again.

50:02 So we get an annual assessment of how they look from year to year. Generally, those tools are fairly well focused, fairly well funded, and so our number of findings are a little lower in that space, but that's important. That's an important metric for us to continue to maintain and see over time. Well, in those cases, the risk for a single finding is a lot higher, you know, to the organization.

50:32 On your asset. So, you know, there's a trade off there. I yeah. I would definitely say that what you're talking about here is you know, you have these clients and you wanna see more and more of these customers within HHS move up that maturity scale and move into a more zero trust compatible approach to where they're treating things, you know, let's assume a breach Let's assume that someone's in the network and able to now move laterally and access the system.

51:02 Can the system survive on its own and defend its because I think that's really where we have to get from a cybersecurity standpoint. Matt, I would really like to thank you for your, you know, input today. I think it's really valuable and really talks to, you know, how HHS is, you know, in this one area, I've been able to combine, you know, with us at Synack and address some of that talent gap by bringing in our researchers and their diverse viewpoints and their diverse talents.

51:32 And, just kinda wrap up real quick. You know, we talk about a better penetration testing experience. I won't spend a lot of time here. You know, people can read the slide, but really what the idea is we wanna be able to get it tested up and running very quickly. I think that's key. We're gonna be able to run tests on a continuous basis with a large number of diverse skill sets addressing the each surface area. And then being able to provide, you talked about a lot, being able to have that single dashboard and bring it together.

52:04 Being able to give a consistent view across the organization. So when people are looking at data, they understand the data because they're all looking and it's the same, you know, truth of the data. And then, you know, being able to measure results, you know, at, Synack, we have something called Attack Resistance Score. Kinda measures how an organization is doing over time. And, you know, you should just, you know, as you guys added more and more assets, you saw that score get worse and worse and worse. But then as your behavior started to mature in the way that you guys develop software and the way that you

52:36 guys were able to secure software or quickly remediate issues that were identified, you see that score start to improve that shows that maturity as you move up And then, you know, having the real-time insight, you talked a lot several times you mentioned, you know, having data being able to report up being able to look at things from a risk perspective. So, I think just hit on just hit on that reporting bit. Sorry, Scott. I think it's that's been one of the key abilities for us to

53:06 operationalize the concept of penetration testing and standardizing it across the department. You know, probably our biggest way of sharing data across HHS is through our integrating, integrating down into that, that helps us provide context to the risk. But without Well, we often get in our own way. So without a without a third party cloud based solution that lets us, share in real time,

53:38 That kind of data would really just get lost. We would we would lose we would lose connectivity inside, networking issues, data issues, human issues would would simply make it, almost impossible to consistently report that data across all of HHS and have people respond to it. So we rely often on cloud based solutions. Particularly when, as I said before,

54:08 the cyber look at the cyber services are centralized and the development services are decentralized. Right? Having an external solution lets us, reach out both internally to different operating divisions as well as to the contracted development shops that are outside HHS all at the same time. And be sure that everybody can access the information. So it's it's it's important in this space to, for us to have that cloud based solution.

54:38 Not, you know, that's not not hugely a while, but it is been a critical piece for us. Yeah. Yeah. And, you know, so, you know, really talking about that again, wraps me around to the beginning where it really comes to combining talent with technology. And that's, you know, our technology with your technology is not just It's Synack. It's Synack's technology with your technology and your SIEM tools or your other tools you're using your software

55:10 development tool. It's combining the talent. It's bringing the developer together with the researchers, providing researchers with diverse skill sets. You know, we have people who are specialists in web application, we have people who are specialized in hardware device and being able to bring that in, put them all together in a room per se, virtual room that we many, you know, we talk about the metaverse, not a big fan of that, but we do really live in a world where we're able to bring those skill sets together to do things at scale.

55:43 You know, the other piece you talked about having, you know, a software provider. One of the key things that, you know, I wanna close on is that having that trusted relationships were recruitable, and that extends beyond just the rest the relationship with the research that also extends to the platform. You do ensure we're safe. And that's why, you know, Synack is really invested with HHS as our sponsor. On our FedRAMP, you know, moderate in process that we're where we're at today.

56:13 And we really, you know, appreciate you working with us to support that. We think FedRAMP is a very critical program in the federal government because it ensures that trust level can be established so that your system owners aren't worried that the data is gonna get leaked and become public that we're a trusted partner and we're in the fight with them. So with that, Matthew, that's all I had. I think we'll turn it over to Luke. I think he has some questions for us.

56:43 Yes. Scott and Matthew, thank you so much. Folks, we are still taking the last couple questions. So if you haven't submitted them yet, please submit them into the Q&A feature on the right hand corner of your screen. I'm gonna go ahead and ask the first one here So, this one is for Scott. Okay. Got. How do you and the Synack team go about hiring your red team members?

57:14 Know, what's the vetting process and how do you assign workloads? Yeah. So, first of all, just so folks understand, the Synack Red Team is the label or the name we have for our researchers. We've created kind of this community. Feel that's very important that they feel like they're a group and that they're working together as well as competing at the same time. It's kind of a gamified environment But what we do is we actually have a very,

57:44 it's a multistep highly vetted process when we have people who wanna come in as a re a researcher. They first have to go through an evaluation of their resume they then if they make it past that, we do a video interview with them, behavioral interview. We then can move into the next step of actually doing testing where they have to do skills-based tests to show that they actually have the skills they claim to have on their interview. We don't just trust people to say that they're good at

58:16 breaking into systems. We actually make them prove that they can do it. And that kinda comes into tying into, you know, how do you assign workload? But we use those skills assessments and we use different technology on the back end in our system to track folks with tags of what skill set they have, and we map them together whether it be, with, you know, the federal government. We do a lot of US only testers. So we have cohorts that are US only or maybe only certain nationalities are acceptable to be act us to especially

58:48 internal system test on the public side. We often get more freedom, but we build cohorts and then we rotate those cohorts through assigned workloads. We don't want testers to get bored with something. Because if they get bored, they stop looking at it. So we always wanna bring in new people to take a look at it. Awesome. Thank you And I've got one more from Matthew. So Matthew, you've talked about this concept of continuous

59:19 penetration testing. I'm curious, how do you make the results actionable across such a large government agency? Well, I talked about it before, obviously, we often get in our own way. So in sharing in a federated environment can be difficult. Especially if you're talking about sensitive information. We've made a lot of headway there, but, I think the pieces that are really critical are, having external platform that lets us, provide access in a controlled manner

59:53 outside of our own environment, particularly for penetration testing. We have established. So that certainly is easy for our perimeter, easy for our contractors. To leverage your environment, for that information we're sharing. We've leveraged a number of physical, VPN's point to point VPN's, into specific environments to try to bring bringing your crowd closer to our development areas closer to our,

1:00:24 HVA assessments, a HVA assist and allow that level of access, and we continue to push on security programs and the, system programs to, begin to run these tests Tingling. So we're gonna take the success from the VDP program and turn them into, who will raise their deeper assessment and better

1:00:55 relationship with the system development shop mentioned previously as well. The integration with our SIEM, we all of this information to this and provide additional context, additional business context to those environments and really manage that business context between the two organizations. We have a number of assessments that run across, different organizations, So we have some processes that allow us to share findings and share the view in a way that we typically wouldn't.

1:01:27 We would try to extract and only show certain things, but show findings specific for the development teams we've built up enough trust with our customers today that some of our assessments, we let them merge together and let the system owners sort of self edit and self sort what we're finding. That's that's been very, very beneficial. I'd say those are the big spaces.

1:01:57 One of the new features we'll see how it comes on is system owners being allowed to schedule their own assessments. We've got a couple, organizations begin to take that on. I think that's gonna be a really interesting, feature for us, certainly for some of the larger organizations if we can get the those folks who are, sort of self starters to, schedule tests and then just go one click. I need another assessment. Like, that'll help expedite our,

1:02:29 regular processes, and we spend a lot of human time, pushing on right now. Alright. Actually, we have one more, that I'm dying to ask. So this is for both Scott and for Matthew. If you each had a magic wand, what's the one thing you would change overnight to make cybersecurity hiring and training better? So that one's easy for me. The one thing I'd like to see changed is I'd like to see hiring managers,

1:03:00 stop and think about what they really need to do the job. I see way too many times when job requirements posted with unrealistic experience, certification, education requirements that just aren't realistic. And this goes back to the diversity of Matthew talked was talking about a little bit earlier, is if you have an entry level position, don't ask for five years of experience. That's not an entry level position. If you're looking for a junior researcher,

1:03:31 do not expect him to have his CISSP. you need to help build and grow the next generation of cyber experts. You know, we have our kids, I've got a teenage daughter, She is technology illiterate for her age group. She still knows more than I ever will know about technology. And let's take advantage of those young people and the skills that they have that they learn just by growing up in this day and age and not put so much weight on certifications

1:04:01 and things like that. Yeah. I think, I think our job descriptions, are outdated primarily. I think And we've made a good progress in narrowing our job descriptions to what actually happening too often we get this, what looks like, you know, someone's performance work statement as opposed to, hey, we need you to do x y and z. We need you to do this. And so we often we get people who are looking at the grade

1:04:31 and, you know, looking at the broad title and saying, I can do that. And so we need to do is we need to attract folks, very specifically, and then then to Scott's point, we need to be able to get to that point where we can actually have the interviews, and look at the, the, the capabilities and talk to the folks and understand their attitude and understand the background and what they'll bring, from a personal side and a skill side, not just,

1:05:04 you know, what their CV says. So I think we could attract those people if we, made our job descriptions more specific, and a little more interesting, frankly. And if you take I love that. Alright, guys. Well, that is all we have time for today. If we missed you, your question, comments what have you for Scott or for Matthew,

1:05:35 feel free to drop me an email. That's [email protected], and I'll sync with the fellows and get back to you with a response. And with that, we wish you all great success in your cybersecurity hiring practices. Bye bye.

No lines match that search.