I appreciate your time.
It is wonderful to be here.
If we haven't met, I'm Tony Sager.
I've been around this business a long, long time.
I'm really honored to be here.
My first visit to the Wild West Hackinfest.
So, let me tell you, this takes me back in time to the days when things were a little less corporate, a little less organized, a little more chaotic and fun.
So, it's really a pleasure to be here.
I'm towards the end of my career and I'm really honored.
I'm a bit of a change of pace speaker for you here.
I have no new insight into a brand new attack or technique or tool or anything like that.
I sat in a bunch of the talks.
They're amazing.
You know, this is my professional life and it's honored.
What I'm going to do today is talk to you a little bit about the history of cybersecurity as seen by one guy.
A little bit of insight into the operations of the National Security Agency, where I spent my first career, 35 years, and a little bit of thinking about national strategy.
And what are we going to do about this mess that we've created in cybersecurity?
And I hope to talk to you all a little bit about your role in this and what you can do about it.
So, that's what I got, right?
Never say anything, no such agency.
You've heard all that.
Now, here's how I wound up at the National Security Agency.
Let's see, mid-September 1977, I get a phone call from a recruiter and he's an older guy.
I'm a young punk, right?
And how does an old guy back then talk to you?
Son, son, if you could report in two weeks, you got a job.
I said, great, what is this job?
He said, we would like to offer you a position in our CommSec intern program, communication security.
I said, great, what is that?
Can't tell you.
Okay, help me out here, man.
He said, but you can go to the Encyclopedia Britannica, right?
These were the times.
Look up an article on cryptography and you had to spell it for me.
I had no idea.
He says, that'll give you an idea what you're in for.
But hey, I gotta, I gotta have an answer right away.
This job closes in two weeks.
You want it or not?
I said, I'll see you in two weeks.
I don't have another job.
And that was my auspicious beginning with the National Security Agency.
I had applied a year before.
I'd met a guy who was, remember the times, right?
The 70s.
You remember the quaint times when we all had one enemy?
Most of you aren't old enough to remember that.
One enemy, the Soviet Union, right?
It was them versus us, our way of life, nuclear weapons.
Anyone remember duck and cover drills in the hallways under your desks, right?
That was the times that I was growing up in.
But I met this guy in my tiny little liberal arts college, where no self-respecting government agency would ever recruit, majored in math, met this guy, perfect NSA recruit of that day, advanced degree in math, native Russian speaker, U.S.
citizen.
He was at the National Security Agency.
He said, you ever think about going there?
I don't know.
Who are they?
They gave me a phone number.
I'd call the phone number.
I'd take the hardest math test of my life.
I'd go do all the processing and stuff.
Anyone else ever take a polygraph test?
A shared suffering here, right?
My results were so amazing, they had me come back again.
It was like, oh, I didn't hear a thing for six months.
And then I got that phone call.
So I wind up at the National Security Agency in 1977.
My first assignment in the Computer Security Design Guidance Division.
Who knew there was such a thing in 1977?
I never heard of such a thing.
I took the only computer course my college offered.
Every person in this room had more background getting into this field than I did.
But I was hooked.
It was amazing.
Incredible people, the pioneers of computer security as we know it today.
Second assignment, anyone prior uniform out in the audience?
Thank you very much.
And when I say thank you for service, I'm not joking.
I grew up in an army enlisted family.
My dad served in three wars.
I lived on army bases growing up.
That's the life.
I appreciate your service to our country and our sacrifice.
But I wound up thinking about this business of, in my second assignment then, a signal officer basic course as a civilian.
So if you were an ROTC, came out of West Point, OCS, you're going to be a signal officer.
NSA sent me and a handful of other people in a pilot program to learn how to be a signal officer without the obligation to serve in uniform.
It couldn't have been any better for a kid like me that grew up army.
Third assignment was the one that hooked me forever.
Vulnerability analyst for defense.
I'd started in what was called comm sec, spent my entire career.
I'm probably the only NSA guy you're ever going to meet that spent his entire life in defense.
Because I love a hopeless challenge.
It never ends, right?
Defense never ends.
And that's what kept me in this forever.
But I wound up with a bunch of math wonks whose job it was to look at US algorithms, randomization, key management for a living.
And I love that business of finding flaws.
No responsible employer should ever pay me to write software.
I'm just telling you.
I've been there.
It's a disaster.
But pretty good knack for breaking things.
And that's how I decided to spend my life.
So if you kind of glance at this, I won't bore you.
These are the names of organizations I worked with.
Kind of came up the left side, comm sec became information security, became system security, became information assurance, etc, etc.
These were the names and the evolution of the networking world that we live in today, as well as the missions of that middle stripe.
Somewhere in the early of my career, I switched to operational kind of work.
So I went from sort of looking at mathematics and how to break it to real life systems.
And that was considered grunt work.
Many a mathematician, senior person told me I had ruined my career by shifting from math to computer science in like 1981-82.
And why did I do that?
Because I figured out NSA would buy me an Apple 2 plus to have on my desk if I switched to computer science.
And this idea of computing going from a giant room, right, with gatekeepers and punch cards, some of you know that kind of stuff.
I see some gray beards out there.
To a computer you have on your desk.
Then you could literally, I could literally and did reverse engineer from scratch to understand.
It was like, oh my gosh, the world is going to be different.
And I was so excited to be a part of that.
So coming up through the operational ranks then, defensive testing, you know, the early roots of red teaming, blue teaming, all that stuff.
A lot of that work, I can say humbly, was pioneered at the National Security Agency.
So we went from this sort of math focus to this testing focus.
I spent a couple years in the lower right there in, anyone familiar with Sandia National Labs, a nuclear weapons engineering laboratory.
I spent a couple years on a loaner program working on the software of a nuclear use control system, they call them safety systems.
And think of it as the closest thing I ever came to working in a zero defect environment.
You don't make mistakes because the consequences are so off the charts.
So this all came together.
I used to joke about it stuck around a little bit longer than I say I would have been, you know, we all led up to this thing we call cyber security, this all purpose word that no one quite defines the same way.
But hey, cosmic security, ultra security, whatever it was, you know, this is the world that we live in.
It's all one big morass of both opportunity capability, but also chow.
That was part of the growth of security testing.
There was no linear path I can tell you in in security testing, right.
So again, from the lab, from the paper designs, from architectures to real life to, you know, the stand up of 24 seven worldwide, red team testing by the National Security Agency, all that kind of stuff was part of the life that I grew up with.
And it was really exciting.
But it was also kind of crazy.
Because everything we looking back on it, everything was the first step, we had no idea what we're doing, to be honest, we're making it up as we go doing our best trying to figure out how do we emulate adversaries?
How do we become smart in the way that they attack so that we can attack ourselves first, right and understand better our designs?
How do we head off prevent, defend ourselves against the capabilities of someone who's got lots of money, lots of time, lots of resources and lots of determination to undo the interests of the United States.
The common element in all of this was vulnerabilities.
I love this stuff, right?
We drowned in this sea of flaws, vulnerabilities.
That's the nature of the change in the world that we saw.
We went from the government driving technology to you driving technology to consumers, all my friends at the big IT companies, their tagline would be this, second to market is last to market.
We all got used to running flawed software.
That's our environment, right?
We accept that everything is a beta.
It doesn't matter how they label it, we're going to find flaws, they're going to patch it.
That's the trade off for the cool capabilities that we get.
And we just came to accept it as part of the environment here, which led us to this place where there's this chaos of what's good enough?
How do I defend myself?
Who's coming after me?
Everyone's coming after me.
I'm connected to everyone.
Everyone's a threat.
There's no boundary.
All these are the world that we live in this pile of vulnerabilities.
And so at some point in my career, if I could sort of divide my career up conceptually, I talk about in three parts.
First is the craft of finding flaws in systems.
And you guys know this, right?
This draws really interesting people, clever, technically smart, determined, willing to try lots of things, finding flaws.
And I spent, you know, I learned from the masters as NSA knew them and the great mathematicians and computer scientists before me.
The middle third, I moved into management.
And what that led me to was see failure at worldwide scale.
And I say this with great humility, and I'm assuming almost everyone in this room is a U.S.
taxpayer.
Thank you for the education.
You guys paid for my graduate school, for all the work that I did, my salary for all these years, my pension whenever I retire.
And the idea was this.
I could see now failure that was previously hidden.
The early days of red teaming, very double top secret, very compartmentalized, right?
All this stuff was so sensitive.
Oh my gosh, there are flaws in DOD systems.
We couldn't possibly tell anybody about that.
But I was getting to see them all.
At one point I was running, and again, I say this humbly, but I think it certainly was the largest attack engine for defense in the U.S.
government.
800 or so people, the NSA red teams, blue teams, all this kind of stuff.
And that let me see failure at scale.
But the real lesson for me was sitting inside the National Security Agency, one of the great worldwide attack engines, and seeing what we do to others, seeing what others do to each other.
It is a fascinating, messy business out there.
There is stuff happening every moment of every day, every way that you can think of.
It's so complex, so dynamic.
That's the national security environment that we live in today.
So learning the craft, seeing at scale what was going on, and the conceptual third, next third, it wasn't linear, but the conceptual third was figuring out what are we doing wrong?
Why do we keep finding the same problems over and over again?
Why does every penetration test essentially tell us the same results?
Why are we still seeing basic flaws in software, literally decades after they were originally identified, studied?
It's insane.
We've come to accept this as the world that we're in.
And so part of that third phase was thinking about what are we going to do about it?
I reached a conclusion that the government was not going to solve this.
And I say this as a career-long, proud-to-be-the-son-of-an-army-sergeant, the only career path I ever wanted was to be in public service.
But it pains me to point out, we're not going to solve this by the government telling us what to do.
We have to behave differently than we did back then.
So just a couple of things, if you've followed us over the decades, and you have to be kind of crazy to follow NSA, but here's some of the things that started to appear in the public over the decades, as we started to open up what we were doing.
I was part of a stand-up of a group called the System and Network Attack Center.
It was an internal thing.
Yes, the boss looked at the... I was a midline manager at that point.
He looked around, he said, I like the acronym SNAC.
Somebody come up with the meaning of it.
Sure, okay.
So it became System and Network Attack Center.
And the big cultural change within NSA is it moved the focus of analysis from 90% mathematics, 10% that messy implementation, computery stuff, not that interesting, to essentially 50-50.
And it raised the profile of this, you know, this is probably 95-96.
And I remember the boss, the big, big... the boss's boss's boss calling me in.
Because I had a pretty elite group, a division, say 35 people or so, which was an amazing group.
And we were going to be part of this thing.
And the boss calls me in and he's talking about his philosophy.
And here's what he said.
I'm going to even read you the southern accent.
Tony, if we could just hire me 50 of them hacker kids, we could solve this problem.
I said, sir, with all respect, be careful what you wish for.
Yes, we need those skills, but we also need to create a new professional discipline here.
This is not about sort of random hacking at systems, right?
This is about understanding flaws so that we can manage the risk.
And I give him credit.
He caused a change that would not have happened otherwise.
But it was a painful start.
But it was this... and that put us out in the public more.
We started to create more work that would be shared, more partnerships, open partnerships with industry.
Don't laugh when the NSA guy says we had open partnerships with industry, please.
Many of you remember the term eligible receiver.
Ring a bell if you were in uniform at that time, you might remember.
This was a game changer across the defense department.
It was a gigantic exercise, a regular exercise, right?
We're talking ships and planes and tanks and troops and lots of movement and, you know, exercise.
I mean, the one thing the DOD really does is plan and exercise over and over and over again.
And so this was a giant one.
But this is the first one where a red team, an IT focused red team was really turned loose.
And it completely blew the doors off the thinking in the defense department across the board.
A fair amount of this has been declassified as in the public.
So if you look this up, you'll find all kinds of references.
The red team for that, it's no secret, was run out of NSA.
There was no NSA red team, by the way.
It was just cobbled together from parts.
Some of my folks and other people's and thrown together.
But what was a clear demonstration and a real wake up call for really senior executives was that when faced by an IT hacking nation state level threat coming after our IT systems, the US military could be brought to its knees.
That's a sobering thought.
If you have any sense of the number of human beings, the money, your taxpayer dollars, the risks involved, and the complexity of the worldwide situation, that's a wake up call.
And to the credit, lots of senior leaders in the DOD woke up to that problem and said, you know what, rather than hide this, we need to share this.
If it happens to us, it could happen to anyone.
So it really changed a lot of perspective on it.
Third bullet up there.
So I mentioned being part of the System and Network Attack Center, and this was nothing... this might be the thing that changed the trajectory of my time more than anything else.
And actually, it was one of the factors that brings me here to this stage today.
I led a campaign, we started to create blue teams, right, were one of my groups, I was out the sort of mid level of management, blue teams, technical analysts, looking at operating systems, looking at software, looking at architectures.
And we started to create a thing we call the NSA security guidance.
How should you configure a Windows desktop or a mail server or a web server for best security effect.
And we did this for the Defense Department, we did it to train our people, we did it to give handouts.
And it became kind of our, you know, North Star, right, the way we would share things out publicly.
And I led a campaign.
And then this time of the very late 1990s, 2000, 2001, there was an explosion of interest, right, the internet had really taken off, commercial things started to happen.
There was an explosion of interest in security configuration management.
How do I run a Windows desktop and deal with all these things that are happening out there.
So I led the campaign to release all the work we had done for the DoD intelligence community to the public, and went public in June of 2001.
NSA.gov, it was that.
Anyone know what SE Linux is?
Security Enhanced Linux?
That was released to the public in December of 2000, from the R&D group.
It has a niche audience, but it's not a mainstream thing.
This was the first sort of mainstream security stuff that came out from the National Security Agency.
And it blew up.
It went viral.
It was slash dotted.
And the way I convinced the boss's boss's boss to support it was this.
We're entered a new world, right?
The government's not going to solve this by itself.
The DoD does not operate without commercial transport, people that provide us uniforms, people that pay our people, the boundary is gone.
We cannot pay, we cannot build a moat, and we cannot pay to secure them all.
No one gets better till everybody gets better.
And that's just where the world that we're in, starting in like 2000.
So we got the go-ahead to release it to the public.
It became the door opener.
And I said, we will get more positive impact on the world by giving stuff away than we will by trying to be in charge.
And nobody wants NSA in charge.
We don't want NSA in charge.
So that was the notion, right?
We're going to send a message to the industry.
And that really opened things up.
That's when I, you do not, but just let me tell you, in those days, you did not go to the National Security Agency because you thought you would be out speaking in the public.
That was not what the purpose of public affairs at NSA in those days was to keep us out of the public.
But once we released this, I did the earliest interviews with the Post, Washington Post, all kinds of, it became a thing.
And next thing I know, I'm out here talking to audiences like you to bring this message of here's our, you know, we're part of the community and we don't just show up empty-handed.
We're not the government here to organize you.
We're bringing our content to the table.
You think there's a backdoor in it?
You can have everything we do was going to be transparent.
That was my goal.
And that really changed the way that we operated in those times and then changed the way that I managed the groups.
That is, how do we interact with the public?
To this day, you can go to NSA.gov or I think what they call it now.
And I'm proud to say a lot of the kids that I left behind are some of the best, free, high quality, amazing security guidance in this industry is coming out of the National Security Agency.
And groups, many of them led by kids I left behind when I retired from there in 2012.
And I can't tell you as an old man, how proud I feel about that.
And the partnerships with FBI, CISA, et cetera.
So it really changed all that.
Cyber defense exercise, anyone ever hear of the contest among the service academies?
That started about 2001.
Also, I was the first management sponsor of that.
It was not my idea.
The security guidance was not my product, by the way.
By this time, I'm signing memorandums and writing checks and running organizations.
But I mean, great people were working on these.
The cyber defense exercise was the first contest.
And think of it as an NSA red team.
It wasn't actually the NSA red team.
It was a red team formed at NSA mock attack the service academies.
And it became a big deal, like major sports trophy big deal across the service academies.
I got the honor of presenting the trophy at West Point one year, and also to the Merchant Marine Academy when they won another year.
And originally, it started as a, that's a good thing to do.
My tech director comes up and says, we're thinking of sponsoring this contest.
The original, if you know the Colonel Ragsdale was the guy up at West Point who really ran the activity.
And but my guy said, we're forming the red team here.
Do we have any money in the budget, we need some VPN so we can set up secure tunnels to the academy so no one can watch what's going on.
I said, tell me what's going on.
And he explains this thing to me.
That was pretty cool.
I'll take care of it.
We funded it.
The next winter, I'm at Windows Blackhead giving the talk.
I see all these scruffy kids out there at the registration.
I see some kids that are not so scruffy, hanging around.
They're in t shirts and jeans, but they got their haircut.
They're not fooling me.
I go up and see their badges.
West Point, the whole West Point team, the winning West Point team was there at Windows Blackhead.
I introduced myself, the Colonel comes up, and I'm surrounded, surrounded by these bright, energetic, committed future leaders of our military.
That moment, it went from bureaucratic, sign the check, Tony.
I came back and told my tech director, whatever you need from now on, you have.
This is a big deal.
This is changing the way leadership will think someday.
That kind of stuff.
And then the last thing I'll mention in history here, this is peeks from the public of what we were doing at NSA.
I had the chance to form my dream job in about 2000, I think it was five or six.
I got to bring together everybody who worked in vulnerability analysis at the National Security Agency for Defense into this vulnerability analysis and operations group.
I brought together all the operational testers, the math wonks who worked about crypto, my entire career wrapped up in one big organization.
I cannot tell you what an honor it was to lead that.
And also to bring it out in the public, we got lots of recognition, I won't bore you with that.
But what I was changing at that time was this notion of what's the role of the government?
How does it collaborate?
It doesn't have to be in charge, it has to create enough content to be a player with communities like yours.
And what it really changed for me when I talked about those three faces of my career was this thinking here.
Sometime in the late 80s, early 90s, I started to, I became dissatisfied with this whole model of finding flaws and they never get fixed.
And that breaks my heart, by the way, because I love that stuff.
That's how I grew up.
Let's find flaws.
And we'll tell the people, give them PowerPoint and PDF.
And they will be so inspired by our cleverness, or so scared by what we found that surely they will fix these problems.
That never happened at any scale at any time in my career.
It's not good enough to try and scare people into long term action to solve this problem.
That was a hard lesson for me in the middle of my career.
It's not good enough to just inspire them with your cleverness.
That won't trigger long term action.
The business of fixing problems is full of issues around incentives and business risk, and what the judges and lawyers think and insurance companies.
So the world has changed.
This business started to become mainstream around this time.
So I looked around for models.
How do we deal with risk every day?
Every day you take risks.
You know it, you fly on commercial planes, you drive across a public bridge, you go to a public health practitioner, a doctor.
How do we manage that?
We build most of the risk into the infrastructure.
We don't ask everybody to become experts in public health or the building standards for a bridge, or the qualifications of a commercial airline pilot.
We have to build more risk into the infrastructure.
And I realized this quote, I pulled it from a journal of epidemiology.
We were collecting lots of data, but with no connection to how it was going to fix.
We thought we would scare people to fix it.
And here's my view of this industry.
Many of you are in this vulnerability finding business.
Great work.
Congratulations.
It's wonderful work.
But it's not enough to just tell people.
We have to do more than that.
And we as technologists who really know the guts of this stuff, we have a responsibility to tell people, not in our language, so they're not going to become wizards and wonks like you.
It's in their language, the language of business decisions and risk.
That's where the industry is shifting.
So the idea here was I wanted to change our perspective.
So I use this as a model with my workforce, and all the folks that we worked with.
Because when you actually think about right, finding flaws and how bad is something, this is a, you know, people use these words interchangeably in industry, right?
Threats, vulnerabilities, exploits, attacks, but they're really different.
And to say we had at least some amount of discipline about this, this is one of the ways we thought about it.
Weakness was technically defined as something that makes a smart person oogie about the whole situation, right?
There's something not right there.
It might be a flaw in requirements or in coding or technique, or not an understanding of the system requirements.
Can it lead me to a vulnerability?
That was the job that I was there to really find.
But a vulnerability by itself is interesting.
But is anybody going to exploit it?
What does it take to exploit it?
What are the conditions?
What's tooling?
What kind of reconnaissance?
What kind of other information will it take to make that thing exploitable?
And how do I actually turn it into an attack?
I can tell you, we spent extraordinary amounts of your taxpayer money for red teams to go from vulnerability to a mock attack.
In many cases, it's non-trivial.
And so you don't panic when you see vulnerability, you analyze when you see it, and you try to understand the context, that you can help people make decisions.
And how much should you care as a function of the environment that you're working in, right?
All the different things, whether the devices, what are the protocols that are running?
What is the architecture of the system under inspection?
What is the infrastructure around it?
And what is it actually doing?
What is, you know, if any of you work in GRC, right?
How hard is it to drag criticality out of business owners?
What are the critical systems?
What's the critical data?
You know how hard that is?
That takes trained professionals.
Most people don't think that way.
And so you have to work to help them understand how dependent they are on technology, even to understand what is critical.
What would cost your business, ruin your reputation, or scare your customer base away?
You have to understand that before you can make sense of risk.
So the National Security Agency, this is where I had the luxury of going up.
I called it for a lifelong defender.
And again, my career won't happen again because NSA really started to change the way it thought about this, as opposed to two separate things, it became a thing.
So never say anything.
By the way, that's the name of my first classic rock cover band.
We played the local areas out there and everybody knew what the joke was.
But the traditional mission of signals intelligence, and today they describe the other mission, which we called ComSec when I started as cybersecurity, right?
And think of it as comes from the roots of ComSec, all these other things sprinkled with a heavy dose of understanding of intelligence.
Because that's what NSA can bring uniquely to this defensive game, is an understanding of other bad people, their intentions, their capabilities, who are their friends, who are their enemies.
And when you pull all this together, what do you get?
Offense plus defense.
I used to describe working at NSA as going to grad school as a defender every day.
They need to watch, again, a nation state machine every day, seeing what they do , seeing what they care about.
They're really good.
Take my word for it.
But they don't do magic.
And the better understanding you have, the better you are able to defend yourself.
Right?
This offense informs defense.
And people say lots of these kinds...
it's the real deal.
It means something.
But you need to have a deeper understanding than just about vulnerability.
So NSA, just for cultural purposes here, right?
And this is why it was so weird to stay in information assurance, we called it back then.
Think it was 90% of the people, the money, management time, etc., etc.
And then there's the lonely old defenders.
That's where I started.
I never left because I told you, I love a helpless cause.
You can't stay in defense, by the way, for decades, like I have, unless you're one of two personality types.
You can decide which one you are.
If you're a hopeless cynic, this is a great business.
There's always something negative to say, right?
Always some disaster.
Oh, well, they didn't listen.
They didn't tell me.
A lot of those guys from the 60s and 70s that I learned from, they're still out there saying the thing.
We solved the password problem in 1970 with the Binford 9000 confabulator A1 level evaluated.
Thank you very much for that insight, and I'll stay off your lawn, I promise.
Or the second personality type, you have to be a hopeless optimist like me.
We can do this.
We can make a difference.
Look at the talent in this room.
Where are we going to get better talent in this industry than the kind that's represented in this room?
But 90-10, what does that mean?
Who's got the resources?
Who's got the money?
Who's got the culture?
What does the management pay attention to?
Who gets the rewards?
Where does the leadership time go?
That's where I spent my career.
And this is not a criticism, it's an observation about cultural and organizations in gigantic bureaucracies.
Okay, it's football season, right?
We all know the deal.
Defense wins the championship, doesn't it?
But offense wins the budget every time.
Even fake offense.
How many times have you seen a penetration test conducted where the primary result was the obvious?
I've watched a hundred of those, thousands of those.
Why would I spend a fortune to learn what I frankly should already know ?
Offense wins management attention and budgets.
That fix-up stuff, oh man, that's so mundane and so boring and not so interesting.
But that's what allows us to operate businesses, conduct our agency missions.
And so you get this risk of being eaten alive by the Pac-Man.
But what I got out of defense, what my organizations got, and as things shifted, sort of that 2000, post-9-11, et cetera, world.
And I was making a decision at that point in my career, because I love defense.
I love the hopeless challenge.
And I thought about it, I said, maybe I shouldn't be in this 90-10 situation.
Maybe I should go to NIST or VISA, if you know them, Defense Information Systems Agency, or some other place, right, that's more purely focused on defense.
Maybe that would be the best thing I did.
But what I became convinced of, and with no knock on any of those friends, lots of friends across government and retired, I was convinced that the nation would not pay what it takes to build a first-class defensive organization.
That by being part of the offensive machine of NSA was the best place to be a defender, despite the occasional frustration, mostly about culture.
But you know, as we all grew up after 9-11, we started to think differently about this.
And so we started to cross-train everybody.
Anybody who was any good, we could quickly move from offense to defense, because it was important to the future of the agency.
It's a very strong institutional culture of mission.
We're all in this together.
We're in the fight.
We are here to support the nation's interest.
And so people could get over their territorialism in a lot of ways.
So this cross-training was so incredible.
The opportunities, I helped stand up some of the elite training programs at NSA, SNP, if you know that acronym, and things like that.
When we saw the world was changing, how are we going to find the best of the best, give them the best experiences to learn?
The resources, the money.
Oh my gosh.
Defenders are like scraping for nickels on the street.
You guys know this.
Offense wins budgets.
But the spinoff, the technology, the tooling, the access to these incredible think tanks and partners that NSA had.
What incredible resources for defense that no one else seemed to have access to.
That's what I really benefited from.
The links to the larger ecosystem of the industry.
The policy makers who want to pay attention because they love the splashy stuff of what the other guys are thinking before they do it.
And the academic institutions that were... the access to the insight, what was happening were at war 24-7.
And being part of that, seeing it, seeing what's going on from the intelligence perspective is incredibly valuable.
And then embedded in this infrastructure of tools, technology, amazing thinkers about the ways to pull information out of PCAP data or out of NetFlow data.
Oh my God.
The brain power that NSA could bring is just off the charts.
So in total, it was just an amazing place to be.
And as we all learned to operate as a team, it was astounding.
But here's the sobering lesson for today.
Never again will the circumstances exist for a single agency to have so much control, so much creation control of the environment, insight in one place.
That's not the world you're a part of.
We'll never see this again.
NSA is still doing great stuff.
Don't let me kid you.
But the way we're going to deal with this is a much more modern distributed fashion.
Communities like yours, right?
This is a naturally self-organizing committee.
I mean, super kudos to John Strand and his nerd herder team here to bring this group together where ideas are shared, tools are shared.
This is really the environment that I wanted our groups to be in as I was opening things up back in the 2000s.
This is what we're going to do, but I need you to take a perspective of how big this problem is.
And that for most of us, let's do a good job, but it's not enough to do a good job.
Let me share with you a story.
So in, I think it was 99 or 2000, and the blue team was one of my groups.
And the deputy chief of the blue team comes over.
He's a Navy commander, top-notch guy, good thinker, wonderful person, still friends to this day.
And he says to me, Tony, that's something we want to run by you.
We have a new slogan for the NSA blue team.
We're going to put it on the coffee mugs, the t-shirts, just want to run it by you before we do it.
Here, Bill, hit me.
What do you got?
Ready for this?
Securing the DoD, one network at a time.
I said, Bill, that's lovely.
But that's not what we're doing here.
Guess what?
Securing the DoD, one network at a time, is like throwing rocks in the ocean because you want to change the water level.
That problem is too big.
It's too dynamic.
Yes, we are going to help the customer that asked us to be there.
We're going to fix what we can fix, et cetera, et cetera.
But the ultimate value of what we do is not fixing that one.
It's what we learn.
Because if it's true there, it's true in a thousand other places in the DoD.
What is the lesson?
What is the root cause?
What are the conditions ?
And it turns out, and having studied red team results, blue team results for a long period of time, it turns out that most of the results of a red team are not best fixed by the system owner that invited you there.
I have a tagline I use, the optimal place to solve a security problem is never where you found it.
For the DoD, why does a DoD system look that way?
It has to do with policy, procurement, training, the role of the integrators in taking technology and fixing it up and configuring it for us.
There were flaws everywhere, and there were a few at the actual system under test.
But the learning about the population and the model I came up with for my teams was security sampling.
Every time we touch a piece of DoD network, we are sampling the environment.
And you learn this in probably seventh grade science.
Why do you sample a population?
Because you want to draw conclusions about that underlying population.
And if you're clever, what you want is a framework where everybody who collects a sample does so with some consistency, provides the results in a standard format, shares it with people that might have a chance of fixing it, getting it to the policymakers,
the acquisition people, and so forth.
That became the mental model that we use for our missions back in those days.
But this idea of many of you are in businesses like penetration testing, red teaming, blue teaming, wonderful work by all respect to you.
But also think about what is it you can do to pull the lessons from what you have seen and share them with someone that could do something at a greater scale.
That's the two level thinking that we need in order to do better at this and not put all of our eggs in the hands of one government agency.
No matter how clever they happen to be.
So let me do a quick wrap up of a lifetime worth of lessons for me.
And you've heard most of these during this.
This was the one that hurt my feelings, remember, right?
Knowing about flaws doesn't get them fixed.
We're more likely to spend money to rediscover what we know than spend it to fix it.
And therefore, it had to change what do we do with what we find needs a different model.
That's where that led me.
The bad guy doesn't do magic.
The more we understand and emulating a true bad guy here in this business is harder than it sounds, right?
Because bad guys, they have their own risk model.
They operate differently.
They have their own tooling.
So you have to be careful what lesson you draw from the bad guy.
Defense is always about prioritization, no matter what.
No one defends their network overnight.
No one changes everything, their technology overnight.
It's always about priority, order.
What am I going to do first?
What am I going to do next?
And here's the one, I call this the talk that gets me fired in the DC Beltway.
The title of this talk I used to give is, information sharing is overrated.
Threat sharing is overrated.
The verb that matters is not share, it's translate.
How could I translate millions of data points of badness into a small number of positive constructive things that most people can do about it?
Because most people will never understand your threat reports.
They cannot subscribe to a commercial threat feed.
They have no ability to make sense of all the beautiful information that's created by the high-end threat intelligence companies.
Most of our economy is small, medium businesses that don't have a prayer of understandings, and we shouldn't ask them to.
It's unrational as a nation to think we're going to build a nation of security wizards, an economy that understands all this.
So translate is what really matters.
And people don't make cybersecurity decisions, right?
No matter how much you educate or scare or inspire them, they make business decisions, economic decisions, personal decisions about their health, and so forth.
And so you need to make that clear, right?
It's not enough to meet people halfway.
I've talked to several people about this.
We are technologists.
We understand this stuff from bits up.
We have a responsibility to shift our language, to translate what we know into other languages for people who just don't have the time or the expertise to learn what we do.
We don't ask people to learn about the medicine and immunology.
We ask them to change their behavior.
And that's where we need to get.
And finally, cybersecurity is more like... I love cheesy science fiction movies.
Remember Independence Day, Will Smith, right?
The aliens are coming.
The mothership is out there.
Brilliant people reverse engineer their scout craft, brilliantly create the virus, heroically deliver it.
Boom goes the enemy.
He escaped just in time.
Come back, celebrate cigar, have a parade for the good guys.
I have been in cyber defense for 47 years.
There's never been a parade for me.
No parade for any of you folks.
Cyber security defense will never end.
You know what it's like.
The other movie, Groundhog Day, right?
It's a machine.
It runs over and over again.
You are part of the information that feeds a bigger machine.
Remember Bill Murray, right?
Relives every day, finally figures out he's inside a machine, starts to change his behavior.
Some things get better, some things get worse, but eventually he learns to manage the machine.
You are creating information that other people will need to take action.
And so when you design a machine, you want efficiency, you want standard inputs, right?
My metaphor of the 2000s was security plumbing.
Plumbing gives us civilization.
It lets us move stuff, whether it's water or not, from where it's created to where it needs to go.
And I don't have to worry about the transport, right?
We need standard ways to talk about these things.
So last couple of thoughts here, and I'll have a couple of minutes for questions.
And I'll be around for the rest of the event.
I can't give up a moment of the time here with you folks at Wild West Hacking Fest.
Remember, the lesson I'm trying to tell you, this is a chart I used internally, but we're always playing defense at two levels.
Most of us live on the left side, right?
The tactical side.
Bad guys, ransomware, attacks, identity theft, and all that kind of stuff.
Attackers and defenders.
But remember, and you're seeing some of this now in what's happening in the water, in our critical infrastructure, right?
These alerts that are going out from CISA.
Bad guys are playing the long game.
They're building infrastructure.
It is so easy to pin down the defense with noise today.
We are drowning.
We're just learning to survive for the next day.
But the real nation state adversary, what separates the pros from the amateurs, is infrastructure, is patience, is multi-dimensional attacks.
It's not just packets, it's signals through the air, it's physical stuff.
Nation states are good at this stuff.
They've been doing it a long time.
My wife is a non-technologist.
She asked me, help me understand this spying stuff and intelligence, counterintelligence.
I said, the only thing you need to know about nation versus nation stuff is this.
In the name of information advantage, when nations compete, everybody cheats.
Everybody cheats.
They lie, and steal.
They bribe people.
They set up front companies.
They don't respect your laws.
They don't respect your privacy rights.
They know all of them because they want to know how to work around them.
It's a messy business out there.
And again, you are part of the machine.
So remember, there's always a second level of fight that's happening out there.
Last little bit of history I'll share with you.
This is the startup of the hunting mission.
Now hunting is like trendy.
I'm here to work in hunting.
The first hunting mission was part of my team at NSA.
It built upon that lower left quadrant.
Those were the missions that worked for me at the time.
Anyone remember ComSec monitoring if you were in uniform?
Technical security to hunt for big bugs and implants in the walls and signal theory and all that kind of stuff.
Red teaming, blue teaming, product analysis, crypto analysis, all that stuff combined with... and look at that left column there.
We went from how do I find vulnerabilities in technology and sort of paper designs, observing them in real life, emulating the adversary.
This is the evolution that happened.
This is all done after the fact.
I sort of conceptually built this model later to the actual hunt for real adversaries.
How do we use... back then we used the term a lot home court advantage.
How do we use our advantage?
Why is it that they know our topology better than we know our topology?
Why do they know who talks to who better than we do?
We have thrown away our technical... our home court advantage.
Then combine that with understanding and motivation, capability.
That's what... all those elements came together at some point, sort of in the last several years of my career around the rise of what we called then the hunting mission.
And what you now know in the industry has become sort of a thing.
So, a couple last thoughts.
I mentioned I did retire in 2012.
Couldn't stay away though.
There's so much more to be done.
And I'm blessed every day to have a second career that's just as satisfying as my first career.
Part of the Center for Internet Security.
Many of you know us.
Many of the things that we're doing at NSA, we continue on here as a non-profit.
We're about to hit our 25th year.
We're the world's largest producer of independent security configuration benchmarks.
If you're not starting with our stuff, what the heck are you thinking?
It's free, right?
We do it with volunteers.
We give the content away for free.
We support the non-profit through a membership model and services, but you do not... and the licensing to big tech companies.
But you can have all of our content for free.
And if you want to bring your knowledge to what we're doing, be a part of our community.
Volunteer.
If you don't like us, go volunteer for Cloud Security Alliance or OWASP.
One of the things I did a couple of years ago was start in a confederacy of non-profits.
First, OWASP, some of the heavyweights, some of the tiny ones.
I believe, again, all respect to my government friends.
I had a wonderful career.
My dad was a government guy.
Proud to call some of the best people I know government employees.
But we need other models.
That's why I'm working as a non-profit and I'm a flag-carrying cheerleader for the role of non-profits across cybersecurity.
That's one way that you can bring what you have learned, those lessons, those root cause issues, to people that are trying to solve the problem.
So with that, I'm going to wrap up.
It's been an amazing ride.
I can't tell you how honored I am to be a part of this community.
And that is no joke.
Every day I go, I can't believe this.
I've had a career to do work that's technically amazing, socially relevant.
I can make a good living at it.
I'm in a company of amazing people.
This industry is full of great people.
Great talent, great determination, and a sense of community service.
Many of you are involved in volunteer things, standards bodies, working groups, donating your time.
This industry could not exist the way it does, could not survive without volunteerism.
So whatever talent you can bring, find a place to do it.
Whether it's dealing with individuals, helping them bring them into this industry, or sort of big ideas like how do we generate root causes, how do we solve some of these problems.
You can still make a great living at it, but every day I'm really proud to be one of the old guys in this industry and to share some lessons with you.
So with that, thank you to John Strand, I don't see, or Velda here is really amazing.
Again, you didn't learn any great new techniques about hacking and any great new tooling and so forth.
I wanted to share with you a little bit of perspective of the life, the history, and the richness of the community that has built up and how wonderful it is to be a part of it.
So if you have questions, I have maybe a minute or two, but I'll also be glad to stick around for as long as anyone's interested to talk about Cessna.
So thank you very much.