good afternoon and welcome to another
one of our cybersecurity seminars for
those of you who are in the room or who
are watching this in near real time this
is the first seminar of national
cybersecurity month october is been
designated as national cybersecurity
month in the US and there are various
kinds of events and recognitions
occurring around the country about that
and what we're doing here today is
having a talk by someone who has been
involved in cybersecurity longer than I
have and there aren't a lot of people
who have that distinction although there
are a number of distinguished
individuals including our speaker Tony
Sager has been involved in cybersecurity
for about four decades and and and has
been very productive in a number of
different pursuits there he will tell us
some about that and provide this very
long baseline view of the cybersecurity
arena some of his thoughts on it and
about whether or not it's maturing he is
currently a senior VP and strategist at
the Center for Internet at security a
nonprofit that he'll tell you a little
bit about and please join me in
welcoming Tony Sager thank you very much
staff and thank you all for joining this
afternoon yeah as a staff said well
we've been trying to schedule this for
at least a couple of years I retired
from the National Security Agency in
2012 and we go back quite a few years
and we talked about this several times
and we finally be able to pull off the
schedule so I'm glad it worked out and
thank you for joining us well said I and
I woke up one day and I realize I might
be one of the longest tenured longest
continuing continuously serving cyber
defenders in the entire business and
completely by accident I wish I could
tell you I had some great vision and
wisdom as to where the field was going
and what would be important someday and
I planned my career according
but of course that's not what happened i
just stumbled into this so in the
mid-70s I wound up by accident applying
for work at the National Security Agency
my real dream was to be an operations
research type mathematician at aberdeen
proving ground where my dad had been in
the army and i remember i wound up in
the math faculty area one day and a
recent alumnus had walked in and it
turned out if you can kind of picture
the world of the mid-70s this person who
had never met before but was a graduate
of the same program was the perfect NSA
employee of his day advanced degree in
math native Russian speaker that was
like instant job security in the 70s
right so he was a somehow he had wounded
up with the National Security Agency so
he said what are you gonna do after you
graduate I said I hadn't really thought
about it but here everyone thinking and
he said well what about NSA have you
ever considered that and I said NSA with
the rockets and stuff fight and he said
no no when I say he wound up but he had
a little brochure which I still have to
this day with a phone number in it
called the phone number wound up at
college park maryland taking the hardest
math test I've ever taken in my life and
got a call some ten months later we'd
like to have you join us if you can
report in two weeks so that was the
nature of bureaucracy back then so I
stumbled into the NSA working and spent
thirty four and a half years all of it
working in the defensive mission at NSA
so I'll give you a quick little bit of
history because I as I as my career
evolved I realized I was kind of
stumbling along as part of the evolution
of the field that we now call
cybersecurity right and again i wish i
could tell you i was really thinking big
thoughts and knew what was going to
happen but that's not what happened at
all so so my my career history wound up
interwoven with the world that were in
today and so i'm going to offer some
observations sort of a you know recap
some of the big themes that have emerged
over time you know I've had enough
experience learned a lot of lessons I
often joke that the business of
cybersecurity is the failure business
right now we learn more from mistakes so
there's this famous quote from will
you know we good judgment comes from
experience experience comes from bad
judgment ie making mistakes I've been in
the room for some of the most amazing
mistakes you could ever imagine and so
some of them I made myself as a matter
of fact but the idea was you learn a lot
in this business from failure right from
seeing how things break from incidents
being reported right from breeches and
all that kind of stuff and it's
unfortunate that we have to learn so
much negatively but that really seems to
be a you know an inherent part of the
business here so if you're old enough in
computer security you have some kind of
equation like this running through your
head and they're all they're all
slightly different but it doesn't really
matter but let me explain to your mind
that normally I'm talking to math phobe
audiences I don't think that's going to
be the case here so but so I normally
read them this equation in English so
I'm going to read it too but it's not
because you don't understand the math so
I often say we're not really in the
cyber business or whatever we're in the
risk business right where risk is a
function of three primary variables
vulnerability threat consequence and
there's a fourth variable the one we get
to manipulate directly right controls is
the all-purpose word for defensive
things I can do right actions i can take
technology i can buy training i can
deliver and normally i apply controls so
i can change the value of the other
three variables right so I'd like to
drive my vulnerability lower and I do
that by some technology some training
the way I develop software etc I'd like
to know more about threats so I can make
good decisions right so I can spend
money to learn about thread I can
subscribe to threat feeds I can get
reporting you know I can deploy my own
people like an x sensors all those kinds
of things allow me to learn more about
threat and then consequences is really a
function of the business model the the
agency's mission or whatever the real
desired outcome of the businesses right
I can do things to help me manage
consequence you know like the big buzz
over lost laptops and taxis that's a big
thing in the areas that I work and of
course you know you could encrypt the
data right so it's at rest on these
laptops well that's a technical control
but there why are you doing it what
you're doing it really to manage the
consequence right so if the laptop gets
lost it's a lost piece of technology
the data is inaccessible so the
consequence to the business as much as
well managed in the case like that if
you do it well anyway so there's these
these variables are always kind of
running in your head so my career it can
actually be summarized in this equation
right I was hired to be a vulnerability
analyst so on behalf of the fence hired
to pretend to attack us systems us
cryptography initially so that we would
understand what was wrong right so we
could understand our vulnerability and
do something about it now those are
historically the time seemed pretty
quaint compared to the day back then 10
to 15 years to build a new radio for the
US Army right long development programs
gigantic budgets relative relatively
speaking you know the other thing that
we had back then and believe me we were
working really hard again it doesn't
seem like it by today's standards but we
had the luxury of lots of time right the
long development times we had a
relatively large amount of money to
invest to improve security but most
importantly we had control of the
environment hey we could decide you
participated you either have a security
clearance or you don't your trusted
company to the US government or you're
not right it was a kind of a binary
decision you're in you were out and
think of that as control of the
environment and in today's world of
course you have essentially none of
those right you don't have much time to
make security decisions you don't have
an infinite budget and you certainly
don't have control of the environment so
we go from a world where the government
sort of runs this activity is in control
of it to one where it doesn't I'll talk
a little bit about what all that means
so another way to look at my career I
tried to diagram all the jobs I had in
organizations I was a part of or I
managed during my time so look at the
lower left I was hired as a calm sec
analyst communication security right so
looking at the cryptography primarily of
us systems us randomization key
management and things like that and
playing the role of bad guy right now
why would you do that remember the prior
equation right function of vulnerability
and threat so remember in those days
historically at a national level we
thought of having one enemy right it
wasn't that this sort of wide open world
there was
sort of one nation that was a threat to
our existence and how much did we know
about this threat to our existence how
much threat intelligence did we have
well even as a person who had lots of
security clearances I can tell you we
didn't really know very much right there
was no market place of threat feeds
there wasn't this wide open reporting of
attackers and successes and their
failures so we we believed we were
vulnerable right we believe there was an
existential threat so what do you do if
you're a risk decision maker and you're
faced with this really heavy threat and
you don't understand it well you by
nature I the rational person then says
I'm going to think about all the bad
things that could happen I'm going to
plan for the worst designed for the
worst and build for the worst and one
way I do that is I hire a bunch of geeky
people to be in the back room to pretend
to be the bad guy right we call that
penetration testing red teaming black
hatting vulnerability analysis so that
was really the role that folks like me
played right we were there to help
understand the threat so that we could
make good design decisions now again you
do that because you have the luxury of
lots of time money and control of the
environment right none of which we have
in any great supply today so so lower
left CommSec and then all these other
threads and you know spath has a role
coming into computer security and all
these different things so there were
many organizations threads and you can
see okay so communication security was
aimed at what what question primarily in
security confidentiality right and if
you can narrow your security concern to
confidentiality you're actually in
pretty good shape at least by today's
standards right because what do you do
with confidentiality you equate the
difficulty of protecting communications
with a really hard well known to be hard
mathematical problem right that's why
mathematics was the primary discipline
of those days so you say if I can equate
the difficulty of reading my mail to a
known hard enough medical problem what
do I get for free centuries of research
and mathematics right like factoring and
problems like that so that's why you do
that that's why at the heart of it
cryptography is really a mathematicians
game
and so that was the way we thought of
the security problem to be solved
therefore the primary career field was
around CommSec mathematical crypt
analysis and so forth but of course you
know and those days are kind of quaint
by today's complex standards right so we
start tapped we have to worry about them
as information becomes more fluid it
moves more it's in more places lots more
people have to see it you have to worry
about the technology that handles it
moves it etc right so computer security
and they have to worry about the as
information takes more form the security
of the information itself becomes the
driver not the cryptography not the
computing device so you have information
security system security all these
things start to become the way you have
to think about this problem the
all-purpose term that emerged quite some
time ago still the name of the mission
at NSA's information assurance that was
actually kind of a breakthrough in
security right there was a bit of nuance
they're not everyone understood it but
information assurance was meant to imply
there is no golden state known as
security right there's no there's no
done there's no end state here assurance
is about confidence right measuring
confidence or making an assessment of
confidence which changes constantly
because you get constant new information
right so your world gets more complex
you learn more about bad guys the
business makes more demands upon
information technology so you have this
complex changing environment and so
assurance was meant to imply this you
know sort of never-ending struggle to
both learn what I should worry about and
then take action upon it so that's still
historically around eventually and you
can see as these names go on right they
they are broader and broader in scope
bigger in their thinking about the
problem and had sort of more generic or
more general and we today and there's
all these different pieces down there
that it turns out almost all these
correspond to organizations I was a part
of for eighty percent of them I never
actually changed desks right it wasn't
me following the evolving cyber mission
it was the organization the institution
evolving to deal with a growing
awareness of the problem and it's what
should we do about it so we we think
ourselves revamp army
rename ourselves and grows and grows
until you come to the all-purpose word
cyber and I don't know what you what
your culture is here but anyone who says
cyber with nothing after it my probably
doesn't know what they're talking about
right there are more cyber warriors
walking around the DoD right now who
couldn't spell IT if you get spotted in
the eye I mean it's because it's trendy
right it's the hot thing you can get
more money and authority and power so
that's the nature bureaucracy so another
parallel reason for these renaming Zyzz
because I call it the salute to fly or a
taller flag theory of organizational
design whatever it is you're working on
Jane is real that's really nice but I'm
working on something grander and the
flag is taller and we salute even more
so i'm going to rename myself to have a
grander name than yours you know so it's
a bit of a chase for authority and so
forth and i'm not a cynical bureaucrat
but that's been the way i've observed it
over these years so complex lots of
changes but i think of it as the you
know as our understanding of the problem
grows as the complexity of the problem
itself gross or all this you know this
world of we I never thought that I said
how did I miss the meeting where we
thought it would be a good idea to share
our network with the bad guys right you
know when you're old enough you think
well we had if it was sensitive we had
our own networks write our own leased
lines at parallel communications pass
you know we controlled the environment
right and then this internet thing is
and you know it's a great thing that I
did but the complexity of the security
problem just exploded right we have our
economy our national treasure our
personal wealth everything about our
health is essentially floating around in
the public and so again it wasn't a
conscious choice to operate like this
but that's that's the natural natural
evolution of this so if i could i call
these the seismic shifts so that's kind
of big movements in the business so most
of them i've talked to you about already
this this focus the singular focus on
confidentiality cryptography right what
we called comp communications here your
comm sec back then much more broadly now
focused and if you think of cyber as the
all-purpose were then it encompasses all
of that right from confidentiality by
the integrity of information
availability the economic issues
underlying
the primary discipline goes from
mathematics mathematics is you know when
your mathematician math is the center of
the universe you know that's that's it
talk to you in the in your introductory
classes but there are all these other
fields that have dramatic impact on
security right from computer science
engineering networking operations so I
shifted my career early i started i
mentioned as a mathematician working on
cryptography of us systems my life was
changed forever around nineteen eighty
or so with the personal computer
revolution and I switched my career
field from math to scienter puter
science for one reason I figured out the
government would buy me an apple two
plus two have on my desk if I switched
my career field and I thought that was a
coolest thing ever right because I grew
up with mainframes punch cards anyone
old enough like punch cards you have to
be really nice to the guy behind the
counter so you can get more than one run
done during the day oh my gosh that's
like Stone Age I thought that was the
most tedious you know unpleasant way to
spend my analytic time so this idea of
having computing power on your desk
under your control that one human being
could understand it was really
extraordinary to me so why would the
government bhaiyya know a nice young
person like me an Apple 2 plus it was
because they wanted to support my
hobbies and my personal interests not at
all because we were moving to a world
where this commodity computing right
driven by what we used to call before
that the microprocessor revolution was
changing everything see I started in the
organization's i started in don't laugh
software was considered too unreliable
too flaky to do anything important in
security all cryptography was built in
custom hardware all nuclear weapons
control systems were in custom hardware
right because we could control it we
could design it we could test it we
could model it we could model what
happened conceptually at every gate and
transistor and pretend it failed and see
if that had an outcome we didn't like if
so i'm going to put an alarm on there or
I'm going to duplicate it right now
going to put some selectra circuitry
hardware was reliable hardware could be
trusted software way too flaky
right but economics always wins so these
little micro processors and personal
computers start to sneak in as the front
panel display for the hardware
cryptography the interface box the
communications controller right the
panel the display panels it was
inevitable you know very inexpensive
very cheap very easy to reuse integrated
circuitry allowed us to have these kinds
of functions at incredible cost right
incredibly low costs at the cost of the
loss of control right you're buying
things really off the marketplace so a
lot of designs came in about that time
to take advantage of this commodity
hardware but then to try the duplicate
triplicate workaround build alarms and
all kinds of workarounds to try to
actually make this this useful so you
move from Matthew move to all these
other disciplines when I switched though
from math to computer science people at
ennis I thought I just committed career
suicide right because the computer
science people at that time oh that's
I've heard this many times that's just
the implementation of security math is
where the action is and then that
software that you know that actually
controls whether the cryptography works
or not that's mere implementation
details okay I didn't mind because I was
having so much fun I thought was so
interesting so that we we then
shift other another big shift this focus
from the technology itself right the
math how good is the hardware to how
does it get used because we all know
this is one of the lessons of modern
life right no matter how good your
security in about how good your product
users are incredibly creative at undoing
security right that's just our nature
and so operations has started to
dominate the cyber business right the
attackers the game us versus them
incident management or instant response
all these things have taken over and you
move to this sort of quasi war fighting
you know heroic battling back and forth
and so these other disciplines start to
really come in as important in this and
we move from well we got this we got the
technology right and too bad they
couldn't use it well right two people in
the security business are active
participants right we're in the fight so
we cover the range now from the ideas
the research the basic technology
the mathematics up to and including the
operational use of things there's a talk
I used to give and the title is I'm a
reformed monopolist okay me that world
of the 70s I told you about right that
was a government monopoly yeah but it's
not a bad thing that's just where we
were if you cared about security you
were somehow associated with the US
government because we treated it
rightfully like a national security
problem we don't all build our own
armies here in town right we pay our
taxes the national government protects
us against enemies out there beyond our
borders in physical space we don't even
think differently about it and that's
kind of the nature of the way we thought
of this game in the 70s and 80s there
were enemies and their friends and we
could decide who they were we knew who
they were but now the world is much more
complicated right so we move from the
government will tell you when technology
is safe enough that was one of the jobs
i played right test something to make
sure it's acceptable to an open market
so we go from 10 years to develop a
radio and the government will tell you
when it's good enough to my gosh where's
my new iphone they haven't come out with
anything in a year you know and whatever
it is I need it now I didn't know I
needed a month ago but I need it now and
that puts a lot of pressure on the
security business right there's no 10
years to make a security decision there
is no room full of analysts at least in
the government sense that gets to study
this commercial technology before it
comes out right so it puts tons of
pressure on our ability to make good to
security decisions and then the last one
is really the driver and I'm going to
leave you with this and this sort of
seismic shifts I talked about the way we
thought of cyber as a national security
problem right and it is but that was the
entire focus of the 70s or so but today
what's driving the business i'll give
you some examples a bit it's really
about economic and social risk that's
what's really driving us today the most
and i do a lot of public speaking the
most frequent requests i'm getting for
the last year or so are not from
technologists not from security people i
know if you're tired of hearing for me
or not but you who asked to understand
about this problem insurance companies
auditors law firms
there's not a law firm certainly in the
DC area that doesn't have a
cybersecurity Institute now with a
certification right every insurance
company is in this business every
auditing firm has a some sort of a cyber
auditing you know division associated
with them they're all coming now it's
technologists you know that makes us
uncomfortable oh my gosh the lawyers
will ruin this well you know but this is
the way social creatures we organize
ourselves right this is what happens
it's not about technology it's about how
human beings citizens institutions make
decisions which are driven by things
like economics and social ideas right
perceptions of risk so there's a term
i'm using i'll try it on please don't
take it personally we might have hit
peak geek here in cyber security right
this idea of this is driven by geeks and
you know don't be worried there's plenty
of great work out there for all of us
that's not the issue but when we think
of it as a wizard and geek driven
business then we take one perspective in
terms of its impact on society but
rightfully in terms of how decisions get
made at grand scale and the role of
citizens and companies it's really
driven by the last line up here so so
think about that event I think the way
some other examples here's all the sort
of a lessons learn now those were the
big big themes from my perspective but
lessons learned so anyone remember the
movie Independence Day not the not the
recent remake know the real independence
a movie right so often say cybersecurity
is not like Independence Day what do I
mean Independence Day the movie the
aliens are coming right big mothership
and all that kind of stuff we know who
the enemy is there their heroic
brilliant people on our side take the
alien technology turn it around against
them come up with a clever virus they
fly up to the mothership deliver the
virus boom battle is done we all get to
cheer it's over we win that's not
cybersecurity if you work in
cybersecurity as a practitioner it's
much more like the movie Groundhog Day
it's the same thing over and over it and
you can get it right 50 days in a row
guess how many parades there are for
cyber security practitioners and
defenders not that many rights back not
many parade
for us who are slogging through it's a
great day when nothing happens and very
few people are wise enough to thank you
for it but you certainly get their
attention when something bad happens
right CISOs are hired to be fired and so
there's you know it's a it can be a
thankless business and yet it's
incredibly satisfying I mean I chose to
spend my 35 years doing this stuff
because I think the challenge of defense
is so much more interesting and
satisfying and my friends who work off
and say oh you got to do is find one
thing and exploited big deal right well
they're a lot better than that but still
you know their challenges are really
different but at least they get victory
every once in a while right at least
they get to take care of a bad guy steal
the information inform the US government
whatever it happens to be they get more
victories they get more parades get used
to it that's the nature of the business
right it's okay defense is amazing in
its own right another lesson for me so I
mentioned that that equation right my
life was in vulnerability so one of the
reasons I spend time putting these ideas
together and talk to you people by
nature of the work that I've done I
think I've seen as many things break as
may be anybody in the business so I
spent the first third of my life
professional life learning the craft of
finding vulnerabilities right initially
in mathematics right and it says an
amazing institution with a in-house body
of knowledge and a great system to bring
people up in that in that technical
discipline switch to computer security
spent my lot of my technical time is
what was called a software vulnerability
analyst think of it as finding zero days
and i called it reading other people's
software for the 411 and then scaling
that up to look at systems networks and
up to operational testing so red teams
in sa red team was one of my groups blue
team and when nations fight against
nations right this is not a packet to
packet fight this is a thick of it as a
full dimensional fight everything from
the software to the hardware to the bugs
and the walls and implants and you know
signal theory and signal stealing and
you know all cameras in hidden in a
little bit all that stuff you've seen
the movies it's not quite that good
it's pretty close okay so that's how
nations compete so at the peak job I had
we're at 750 people whose sole purpose
was to find flaws so I got to see a lot
of these both directly is created by my
groups but also in my work with the rest
of the Defense Department the
intelligence community huge hunks of the
industry I've worked a lot with on these
so got to observe over and over again
problems right try to understand root
cause see how what red team's find see
problems found in the sort of core
mathematics in the way a product is
built in the way it gets applied it's
emergent security properties in a system
context and then in real life how bad
things can be can be made to happen and
it was startling right so I worked as a
technical person primarily worked as a
manager for a third and then spent the
last third of my career both as a
manager but also looking at all this in
the one what in the world is going on
here why are we seeing the same things
over and over again that's what kept
striking me so and we did the good
things right the red team we found a
problem we told them we gave them power
point we told them exactly what we
exploited we gave them the Microsoft
patch number to fix those problems
almost never got fixed and you could
draw a quick conclusion right and some
military senior people I doubt what did
o our defenders are lazy they don't care
for untrained and I my response was you
know any Enterprise of any size like the
Defense Department that puts their fate
into the hands of 20 year old tech
school graduates is guilty of bad
strategy right so you know I've been
meetings for the general wants to fire
the private who failed to put in the
patch that was exploited blah blah blah
I said that's the same by the way
general that's the same private that
suppose you'd ask you for two hours of
downtime so he could update the mail
server I can't do that that's mission
essential we must have the menu so we're
taking our lowest paid youngest least
loves right most under-equipped part of
the workforce giving them conflicting
requirements and expecting them to save
us running incredibly complex incredibly
fragile technology that was never
designed for the kind of things that we
put it through that's bad strategy and
you know it's not the way to really
think about this problem so knowing
about the flaws themselves is not enough
to get them fixed right and yet most of
our business is geared to this this sort
of breathless drama of revealing the red
team result of exposing the zero day
right of this sort of publicity
generating you know heroic cleverness to
find flaws and yet history tells us that
doesn't get them fixed by itself and why
is that what's because that's not why
people make those decisions right
sometimes you can embarrass people into
fixing things but if you want to get to
the real root cause then you have to
think more strategically about these
problems so people would say hey the red
team told them what to do they're good
people they even told them the Microsoft
patch number to put in place to stop
them right but anyone who thought about
this and I know you all have fixing that
patch what happens the next time the red
team comes they just come somewhere else
or someone undoes that patch because
they couldn't install some application
right so the notion was the thing that
got exploited doesn't get fixed at its
root right fundamentally except at a
different place in a different point in
the life cycle that is if you can't
manage configuration changes at scale
across a complex enterprise then it
doesn't matter if you fix the one patch
the one hole the one configuration
change because it'll get undone or lost
in the noise of all these other changes
and yet and here's a fact of all the red
teamers that work for us in NSA that
group is 150 people by the way right not
a one of them that I ever met had ever
run a network bigger than would fit in a
couple of desks right that's not why we
hired them that's not why we train them
they didn't speak the language of system
administration so they didn't know how
to convey what they learned right what
they pointed out what they discovered
they didn't know how to translated into
the language of better system
administration it's not their fault and
yet we treated that information so
closely that people that did understand
it weren't authorized to hear the story
now the blue team work for me right and
the red team would find these problems
team would be tasked to go fix them
working for me but they weren't
authorized to hear what the red team had
found is that sound ridiculous yeah
that's right it was true and I said one
day they're both going to work for me
and I'm gonna fix that problem I me put
the same manager in charge of them and
will hold them accountable to see the
problems get fixed because pointing them
out is just part of the life cycle right
at the end of day we need to fix things
but that was one of the great lessons
for me that information cyber defense is
really an information management game
it's not a technology game it's about
buying the best box it's about moving
information from where it's created to
where it's needed and in a form in which
it's needed so that example I gave you
of the red team finds it right it
creates information that finds an
exploitation the challenge was to move
it to the place where it's needed ie the
system administrators in the form and a
language in which it's needed the
language of configuration control and
management across the complex
distributed enterprise and what I did I
did a quick study fifty percent of what
the red team's would find could not be
fixed by the system owner to ask them to
come in fifty percent why well because
they would you and say well we we walked
right through your perimeter mr. system
owner and they go thank you your guys
are really clever it was it was wide
open why because we would work on this
DoD network but the premise router is
the big routers at the edge we're not
actually run by them I was run by DISA
right so it's a the equivalent of their
internet service provider and guess what
this is criteria was I want to cut the
number of human beings i have to pay so
the routers are all wide open okay
that's very cheap to run it's not very
good security though so you can tell
this or you can tell the system owner
this is your problem but they can't do
anything about it in fact if they're
really clever and most of them were they
had already told this at please don't
run my premise routers wide open right
you're leaving the exposed all right so
so you couldn't fix it a number of
problems that they found we're really a
function of DoD policy they had to do it
that way because of the policy so if you
didn't tell the policy Baker they had
made a mistake right you couldn't tell
the system owner you had until somebody
else and then a quarter of the problems
were only fixable really by the vendor
if you didn't tell the vendor you could
never solve
problem at the root cause level so this
information management then is really
the nature of successful cyber defense
not technology and it's not about
information sharing right the only thing
that legislators can agree upon in
Washington a is threat sharing right
we're the press legislation to encourage
threat sharing and protect a profession
you know why they agree to that because
it's viewed as harmless right it's like
motherhood and apple pie right sharing
is good therefore we should share more
threats you know when I talk to public
audiences ninety-nine point nine percent
of what you need to know to defend
yourself you already have in the public
you don't need any other threat feeds
frankly you don't need any double top
secret information from the US
government believe me I live in that
stuff it's in the public already right
the challenge is not getting more stuff
into your inbox the verb to remember is
translate how do you translate millions
of data points into a small number of
positive constructive things you can do
that's the real fundamental challenge of
cybersecurity rights an information
management problem a translation problem
so whenever people say threat sharing I
always say no translation is the problem
not the sharing itself yeah sharing is
good we all salute it's lovely we want
to share we want to learn but for the
vast majority of consumers adopters
enterprises translation is the problem
and here's an observation most federal
agencies can't do that most enterprises
can't do that take smart people access
to information a lot of scale a lot of
time translation into action so we'll
talk about what we're doing about that
next thing remember is the bad guy
doesn't perform magic all right a lot
there's still a sort of a romance to
this business you know this is about
wizards and the scruffy looking person
in the room I won't name any names here
must be the smartest person so we have
to hire them and if you treat this as
wizardry what's your only defense hire
young Wizards right you have no choice
bad guys are good at what they do
believe me like I'm one of the few
defenders that lived in an offense
organization for 35 years right so
defender who gets to live and breathe
and tranq cross train people and move
them back and forth across the biggest
attack machine you know really in the
world and so
you learn a lot from that you learned
that they are good but they don't do
magic they have a boss they have a
budget right they don't like to take
risks they like to be pretty certain
that what they do is going to work so
they can be very cautious so let me
offer you a little free content here if
you have a good next time you go to
youtube look at look for these search
terms a guy named Rob Joyce our OB Jo
yce with this acronym t a o de tailored
access operations Rob Joyce ta oh
there's a 40 minute video on there was
of the Rob delivered that's Rob's a
friend of mine still at NSA it's 40
minute video given it the Enigma
conference I think a year or so ago it's
the most underappreciated video in the
business right now I think Rob is the
director of tailored access operations
think of them I offer no official
verification of anything as the
organization outer outed by Edward
Snowden this is the attack machine of
the US government right at NSA and
basically the theme of his talk is how
to stop his teams and you will not hear
magic you won't hear you know this is he
didn't hold much back Franklin what you
will hear is professionalism patients
willingness to build infrastructure
willingness to wait for and a person on
the network to make a mistake
willingness to look for your weak points
or your week connections right no magic
skill professionalism patients yes no
magic if you could do what he recommends
that you do you're protected against the
vast majority of attacks today without
question okay and the things that Rob or
telling you they're exactly what my
nonprofit is telling you and I'll show
you in a minute it's exactly the
positive unclassified guidance coming
out of NSA it's exactly the positive
guidance coming out of the Australian
ASD and lots of other places right
there's no mystery to that we and by the
way we all talk we all talk to each
other raw friends swapping notes
thinking about how to solve this problem
so we don't do magic from the bad guy
side we don't have to do it from the
good guy side and then the last of the
Pareto principle 8020 rule it really
does apply in this space that is most of
the you can get most of your value from
a relatively small number of things
not to solve the problem but to make
most of your progress so the rule is
basically eighty percent of your value
comes from twenty percent of your inputs
or your variables or whatever and so the
key is though can you figure out what
that that twenty percent is that's what
you need to think about so the term I
use for this so here's the irony of the
business right i started in those
monopoly days no market plays monopoly
provider from the US government at this
moment we have more tools training right
technology things to help us as
defenders than we've ever had in our
history and yet we seem to be getting
worse not better actually technically
we're getting better but not nearly as
fast as bad guys are getting better so
what's going on here so we go from this
monopoly situation that we talked about
an i was trying to come up with some way
to convey the complexity and the term i
came up with was the fog of more okay
what paralyzes people today or confuses
them or miss directs them is too many
choices right too many advice givers too
many magical marketing claims from
vendors too many conflicting overseers
regulators you know people that want to
know what you're doing expect you to
prove that you've done the right thing
in security it's overwhelming to figure
out what to do that's what's paralyzing
people today right it's a confusing time
you don't know how to trust there's too
many options too many vendors too many
claims there's no way to sort this out
on your own for the vast majority of
enterprises so it's the difference here
and the fog of more is actually a pun on
the book the fog of war if any of you
remember that we were all required to
read that at one point in my NSA career
it was talking about the impact on
high-risk decision-making especially
that's specifically war fighting right
with the emergence of the information
age so you're making decisions with
amazingly dire consequences life and
death consequences and you're doing it
with rapidly changing information of
uncertain that quality and confidence
and you but you still have to make a
decision right so how do you manage that
really complex environment so
term the author came up with the fog of
war and I used more as a as a way to
capture this this is the topic of my RSA
talk in 2014 but for a lot of people
helps capture for them why they are
confused right they just don't quite get
this so how do we get through all this I
call this the the defenders dilemma the
three-part challenge in front of you you
have to figure out the right thing to do
right I talked about that and how much
to do because you don't have infinite
resources everything in cyber security
defense is about prioritization it
doesn't matter how much money you have
or how little it's all about
prioritization of your actions of your
funding and then you have to actually do
it and by that I mean convince the boss
get a budget pick the right to a lot of
the marketplace implement it
operationalize it do all that but the
most insidious most challenging of all
is number three you have to prove to
others that you've done the right thing
and you're going to have to do this over
and over and over again I mentioned
auditors insurance companies right
regulators folks like that they think of
them as enforcers right their job is to
verify or validate what you have done
but this is more pervasive than that we
are all every institution is now part of
a complex supply chain right from a
Walmart to an automotive manufacturer
they have thousands of supply chain
partners integrated into their supply
chain their development cycle their
production line etc to make that work
you have to have IT that integrates all
this together ie you have to share data
and control paths right in a really
complex way oh and by the way if you're
a supplier to walmart for example and
you know the notion is you have access
to certain data because no one wants to
store stuff in a warehouse too expensive
wasteful so therefore the agreement is
on the walmart stores when the the
inventory gets below a certain level
just ship it directly from the
manufacturer don't stick we're not
sticking on a warehouse and moving it we
want to come directly from the
manufacturer so the contract is so that
you know on your own when the inventory
gets too low that triggers a message
right which triggers then action to
bring information highly efficient very
cost effective but now you're sharing IT
at some level so you have to have some
measure of trust right I have to develop
trust around that purpose I have to I
don't know what I have to identify what
data is needed what control pads and
then how do I make that work in a way
that doesn't undo my business model
right think of some of the big hacks
that have happened like target by H you
know you've got your bringing suppliers
where you don't know much about their
security or the way they protect
information or the way they deal with
their credentials into your environment
so a subcontractor should have might
need access to certain parts of your
environment does that mean they need
access to your point-of-sale terminals
not likely or to your back room
accounting not likely right so you have
to as an IT person figure out how to
make this work and then protect against
it so that how do I demonstrate to
others I've done the right thing so this
is going to happen over and over and
over again at every scale so this is
what really drives the business now in
the future and I call this trust is gone
from a binary condition remember where I
grew up right cleared or not trusted by
the US government or you're not you're
my Ally or you're not to this world
where trust is dynamically renegotiated
over and over again around very specific
purposes okay for in the business
context i can actually came up with this
in war fighting I call the tonys three
rules of war as you'll forget me then
you'll you'll immediately know why I was
I should never have been in uniform Tony
three rolls of war number one we never
go to war without our friends okay
that's that's us doctrine right think of
coalition we're fighting in the Middle
East not kind of stuff I'm never going
to war without reference number two we
don't know who our friends are until the
day before we go to war right if you
ever watch those politically you know
politics watcher this is not the happy
kumbaya Coalition of the Willing moving
forward right this there's a mix of
arm-twisting and bribery and cajoling
and convincing to get all this to come
together at the last minute often and
that was literally happened in some of
the conflicts the Middle East so you
never know who you're young you don't go
to war without your friends you don't
know who they are until the day before
and the third is after your friend
can't stand each other and they
certainly don't trust you okay so these
are complex coalition's brought together
to do some of the most dangerous work on
earth right fight wars which means you
can think of the IT challenge now how do
you do that successfully well if all
these nations can't tell who the good
guys are from the bad guys you got
problems okay because your bomb in the
wrong people and so you're trying to
combine these forces in a logical way
that you achieve an objective and yet
keep everybody safe that's the war
fighting equivalent of the business
challenge right so we trust each other
but only for that purpose only for a
given amount of time only for the data
and control that we have agreed upon in
order for us to execute that purpose
that's the nature of this business now
is how do we establish that kind of
environment where that can be done
quickly efficiently cheaply so I'm
working with the number of vendors like
Walmart and others who are trying to
figure out how do I assess the security
of several thousand sub suppliers right
as cheaply and as quickly as possible
and if one of them can't meet my cost I
kick them out and I bring the next one
in and so I could do the same for them
very dynamic and very challenging so uh
in the interest of time I'm going to
skip over a couple of things so you'll
but I will say this you can't survive as
long as I have in this business without
being one of two personality types
complete cynic hopeless optimist right
and the cynic has something to pick on
every day in this business right some
bad thing had happened it's great if you
like because I know people in SA have
made their entire careers around being
cynical you've met many of them about
nothing no names and that's good we need
people who you know sort of
truth-tellers and you know coyote people
if you know that lower and all that kind
of stuff but if we're gonna make real
progress we need lots of hopeless
optimist to belief that we can change
things so things are changing i
mentioned most of this already right I
mean number of us grew up in the days
where we had to actually G only we care
about security how come no one else
cares about it well now everybody cares
about right it's popular magazine fodder
it's headlines so you can't help
but at least be aware at some level
institutions are motivated i remember
you know i mentioned to you the who
wants to hear from me now is all these
really social institutions all these
things are starting to go into motion
resources there's talent there's great
centers like this i mean it's when the
pioneering educational centers and there
is better technology I don't want to
tell you there's a rosy future ahead but
there is now there's some reasons for
optimism here so here's what I'm doing
about it enough I'll finish up here so
all these observations over all this
time you know I've retired four years
ago on a lark frankly it one afternoon
the most frequent question I was getting
in the mid-2000s was what do i do first
okay that's one of the fog questions
there's a thousand things out there the
security guidance said by the way NSA
started releasing security guidance to
the public in 2001 and I was the manager
who did led that campaign right I didn't
do it because we're just nice people
that we are nice people at NSA we did it
because we recognize we're all in this
together right there's no boundary for
the DoD anymore no one gets moved or
paid or uniformed without commercial
friends so we have to get help everyone
get better but in 2008 the question was
what do i do first and I would say oh
there's the NSA security guidance and
the NIST has some good stuff and you can
go ahead no no no got it that's
thousands and thousands of pages and all
this technical gobbledygook what do i do
first what do i convince my boss up
first where's my first dollar best spent
whether we focus on for the first
quarter and I just said gosh I never
thought of it that's starkly before but
that's that's reality for a lot of
decision-makers right or a lot of
security professionals trying to
convince decision-makers you can't sell
them on a 10 year program without some
results you've got to bring focus and
you can only keep so much of the bosses
attention so what do i do first I
gathered five friends in a room and
these are not ordinary friends these are
extraordinary friends representing the
full range of knowledge at an NSA I said
no one leaves the room till a small till
we agree on a small number of things all
of our friends should do not to solve
world hunger not to create peace in our
time because if you get enough security
pros in the room what happens you will
get an infinite to-do list right in
incident list of problems and
list of things to do that's not very
helpful that's the best of fog problem
ice it's a small means five to seven all
of our friends should do these not to
solve the problem but to get started to
sort of lay the foundation for the rest
of and you know you know this business
nothing personal guys draws really
bright to really opinionated people
don't you don't have to look at anybody
in this room they wouldn't leave the
room until we agreed to 10 I couldn't
bring them to five to seven so a list of
10 on the two pieces on two pieces of
paper went down to the Pentagon and a
few friends that was it if you don't
know where to begin start here just
after noon lark never dreamed of it any
bigger got a call several months later
from the SANS Institute hey we have your
list it's pretty good we'd like to build
a project around it so they take it from
five friends to five thousand friends on
the mailing lists right most of whom
don't know each other and they partner
up with a nonprofit called the think
tank called this Center for Strategic
and International Studies and they
create something originally named as the
consensus audit guidelines better known
as the sands top pointy and the idea was
a this list of 20 most important things
you could do based upon what bad guys
are doing right not speculative but
based on specific knowledge what bad
guys are doing today how should I
prioritize my actions one of the most
importance of the things to do 2012 i
wind up retiring from NSA go to the SANS
Institute to run some special projects
eventually took this back over spun it
out into a non-profit company with some
sponsorship from sands and some of the
other companies in the business and it
lives today in the center for internet
security so this so I've chosen to spend
the second act of my career focused on
this what i would call operational
practice you might think of it as what's
the best we can do with what we've got
available to us today right i'm glad you
know spass shared some of the research
summaries here there are people that
need to solve some of these foundational
harder problems absolutely but I've
chose to focus on what can we do with
what we have available to us today right
what's on the shelf in the marketplace
we know about because I think that's the
8020 part of this the stuff where we can
get a lot of return for a relatively
modest amount of work and I'm not saying
it's trivial right doesn't make it easy
but for example the number of the
official
from the US cert right the US computer
emergency response team is eighty-five
percent of the incidents that they
manage right scarce high-priced labor
for the US government eighty-five
percent of what they manage both by
numbers of my time come down to
basically hygiene problems failure to
patch bad configurations terrible lack
of zero network segmentation and no no
separation of anything pretty normal
basic good IT operational stuff that's
their number everybody else who's ever
studied this from the Gartner group
semantics etc comes up with a number
between eighty and ninety three percent
of the problems that they track that
they manage that they say come down to
basically washing your hands getting
your shots right not coughing on your
name or kind of stuff pretty
straightforward things so that's
something where we can make a lot of
progress that's where I've been spending
my time I'll give you a reference as to
how to find these things this is not a
commercial you can tell I should my life
in government right we this is all done
with volunteer labor I'm the chief cat
herder organizer community activist for
this and then much to the surprise of
many of my business friends we give it
away for free so because it's created
really through community labor alright
that's the way I like to think of this
we monetize it through some membership
models and other things and you know
other services and so forth but you know
when you're operating in this model
we're not trying to build a big company
right we're trying to build a big
community to pull all these things
together when the other lessons for me
is that if you want a good list of
things to do you can go walk on any
street corner in cyber security right
you can find lots of magazine articles
and go to NIST it again remember the
knowing about a flaw doesn't get to fick
doesn't get it fixed having a good list
of things to do doesn't make them happen
right there are great lists out there
there's great information what's been
missing i think is community building is
identification of barriers we have in
common of a non-profit to kind of go
negotiate with the vendors right to help
help them align their products along
with the most important things to do so
we're putting all that together now from
the center for internet security and
here's some of the things i'll mention
briefly uh you know this has taken on a
life of its own in the last
couple three years so the big recent
event for us was the California Attorney
General data breach report came out in
the last winter basically summarized and
categorized all the data breaches in
california since 2012 and recommendation
number one was if you want to deal with
this problem use the Center for net
security critical controls much to my
surprise I never met these people before
they recommended it that caused more
phone calls to come in to me asking me
to explain it and me sheepishly saying I
have no idea I think I better go
introduce myself to the Attorney General
California so last week I spend in
California giving workshops there the
concern of the Attorney General and it's
a legit one in California is how can we
help really small up to medium
businesses deal with this problem
because they can't deal with it they
don't have budgets for this they don't
have security staff for this there's no
way they're going to do it on their own
so we're retuning a lot of our content
really to aim for these small businesses
right rewrite them in plain English lots
of pointers to free software lots of
sort of community building to ban people
together that are similarly situated so
that they can learn from each other
create use cases that kind of stuff so
that's the stuff that we're doing we're
in the NIST cybersecurity framework if
you look at the tail end or the
recommendations and the one of the
things I spend a lot of time my time
doing is talking to the big threat
intelligence companies what are you guys
seem right I don't get all their data I
get summaries of their data and we map
them into our control set to make sure
that we're picking a good set so you can
look in the recommendation section of
the semantic document the verizon
document HP solution airy Palo Alto a
bunch of those that's just me and
volunteers working with the authors of
their reports to make sure their
specialty is characterizing the problem
our specialty is the translation right
that problem I can I translate from
summaries of bad things into a
relatively small number of positive
constructive things to do but
importantly the other 3 i'll just point
out a lot of these these are references
or recommendations or folks that use our
work now the rest of these are really
not cyber geek institutions right the
National Governors Association
association of policing Zurich Insurance
you know other things CPI is a is a
security one that from the UK but most
of these again we're seeing the
emergence of these social institutions
trying to figure out what to do and of
course they don't have security staffs
right there you know the Red Cross
people like that that's this is not
where they live so the good news is they
look around for something to latch on to
write and whether it's us or NIST or
whatever that's all fine but that you're
this is more evidence of the emergence
of these social forces in motion that
they're trying to make sense of this
problem and do something about it so you
know I'm part of the multi-state I sack
you know our center is actually a about
a hundred people my part of it is
actually very tiny either there's a tiny
team that runs the critical controls
project there's a bigger team that runs
what's called the CIS security
benchmarks which are the detailed
configuration guides for like a Windows
desktop and the patchy server exchange
server that kind of stuff and so we have
a wider range of things but I'm going to
leave you with the contact information
where you can get a dress for me
directly or reach me through spam so so
let me just summarize real quick and
then after the recordings are where we
glad to stick around for some time and
take questions if you have any you know
this has been the really the story of my
career which has really been riding the
wave that we now call cyber right so
seeing it kind of initially as a
technology project seeing at the
national security level watching its
emergence into all these other different
fields the different sort of us the ways
that we view the security problem and
then to see it become a basic factor in
our economic and social health as
citizens of the country so this is
really an amazing journey from my
perspective I feel really richly blessed
to have been have the opportunity to be
in the room for lots of the big
decisions a big incidents that happen
the big changes that occurred and that
chance to share it back with folks like
you so with that I'm going to wrap up
and so thank you very much for your time
and patience here late this afternoon
thank
you