Transcripts For CSPAN2 Discussion On Infrastructure Security 20240712

Security department, i call myself one of its grandmothers and one of his grandfathers, im not sure is on this call with me and the rest of you children are the successors and its really wonderful today that we are having, i guess hes by phone, weve had a lot of zoom issues, phone conversation with the panel organized by the Wilson Center very own meg king who has our technology and Innovation Program and a number of the rest of you on this phone. The topic is what is critical, involving the security playbook for managing ten and everything in between, while its not as much fun to see you all in some of the online its not as much fun to see you in person and if anyone can make a conversation interesting, interscience technology and information program. Today as i said were joined by the nations chief risk officer, director of the department of Homeland Security cybersecurity and infrastructure, securing agency, leave it to congress to include security twice in your title, chris will talk about how the department has protected americas Critical Infrastructure in the past and what we need to do going forwa forward, chris has briefed me frequently as a member of the Homeland Security advisory committee, the Homeland Security experts group, it does not have security twice and even showed up last year at the hacking conference in las vegas. I was there to, i was a dinosaur in the room, this is the second tour of the department, he was Senior Advisor to the assistant secretary for Infrastructure Protection and he was part of Microsoft Government Affairs team after that, chris has an impressive command, i know this from talking to him about the threats that we face and has been at the forefront of tackling our Election Security challenges in securing our networks remain resilient during a Global Pandemic and when the workforce when all moved online from home and security is harder to verify et cetera. Chris will give remarks in their berkeley phd and Melissa Griffith will interview him, then a panel of geniuses would be able in his pickup truck, the Homeland Security and centurylinks catherine will follow to dive deeper into the challenges posed in securing Critical Infrastructure, digital and physical and just before turning this over to chris, how blessed i have been to have him in my life for a decade, she has taught me lots of stuff especially about all this, please welcome by phone the director. I dont know if youre seen me but i was able to do a couple of runarounds of the office, did the video come through okay . Yeah. We see you but your mouth is not moving so you may be frozen all right lets try this here. Okay, i think i got it now, sorry its giving us some challenges here. That is much better. That is much better. Okay, here is what were doing, ill give you a little bit of an overview, thank you congresswoman for the overview and will talk to you about the things that we are focused on right now and some of the developments in shifts that we have seen in the Critical Infrastructure Risk Management space and just for short ham purposes i dropped the security, we made the argument that the Second Security was an appropriate modifier so we did not need cybersecurity with congress at the time thought it was important to have cybersecurity and nonetheless, better name than we used to have which is a National Protection Program Director which if you can tell me what that means, i owe you 100 bucks, it was not a very descriptive name for an organization that is the nations risk advisor, primarily our authorities are voluntary, publicprivate and what that means more than anything i cannot make anyone do anything, we have to really understand where the risk is, is shifts the trends in the best practices across industry and government to fill them down into something that is usable, shareable, actionable and get them out to our stakeholders as we possibly can. It should not be much of a surprise but the United States Critical Infrastructure community is quite large and in fact being the american go big or go home approach, 16 Critical Infrastructure sectors, i say that to be able to contrast to our partners in europe and elsewhere that in some cases i only had five national an critil infrastructure, eight is probably the most ive seen in europe, we have a larger footprint for infrastructure but we also view it more expansively and thats important and ill touch on that a little bit later. But nonetheless, given the voluntary approach, we do see ourselves as the nations risk advisor, were not the nations risk manager but it would have more of a compulsory authority where i could tell people to do things and then they would do it. But instead we ask people to do things jointly who we give them useful guidance that provides the value and we find in that approach where you do try to understand what our partners see we can get them to do things. Really quickly, over the last several years, we have identified five key shifts in the way the Critical Infrastructure community is managing risks, the first aspect is that it is coming quite clear that risk is shared across all sectors, the second supply chain Risk Management is critically important, the third piece is management is also evolving becoming more effective and forth is what used to be a security practice and has evolved a resilient approach to Critical Infrastructure Risk Management and that is evolving further into antifragility approach where you get better with each event rather than surviving the event, lastly we are seen Organization Take a much more enterprise level of understanding of cybersecurity Risk Management and that begins with percolating across organization, the shared risk across all sectors, it is something that you probably heard me or others say that as you tackle risks in silos, you will miss the bigger picture. What youre seen in the last couple of years and particular, adversaries particularly russia and china and a few others dont necessarily come in, knock it on the front door, what they understand are some of the dependencies between organizations and will exploit some of those trusting relationships, there is one event where the russian campaigns have launched a couple of years ago where they came in through the Energy Sector and not directly into the Energy Sector, they came in a construction contractor, and about target breached through an hvac contractor, risks are shared across organizations and part of that is because the commonality of the systems that we use far outweigh any of the unique specific sectors, control systems is another example, those things that make Water Treatment facilities, their equipment move intake and click, that has put very similar to critical manufacturing, thinking about hard infrastructure in manufacturing or power generation, a lot of those controlled systems are consistent with unique applications on the edge across the controlled systems. The second piece as a mention supply change, three or four years ago we had supply chain Risk Management and it was not top of mind for most organizations, you get to hear on the next panel from folks who think a lot about it including catherine which was my longterm partner in crime but some of the work that we of done on the supply Chain Technology sector is really sprung up over the last three years through some of the work weve been doing. We should absolutely focus on the folks on the panel. Next management, this is particular come into stark relief over the next six months, its been a heck of a year for vulnerability disclosure, what used to be ten or less years ago we used to have researchers or other organizations to find mobility to the public and release them to what happened in that situation and you actually give the adversary were many number of adversaries over the defender and will be rising out of industry with the Research Community with the development of a needed disclosure process and theres actually a brokering that has happened with the Security Researcher in the organization that i found this thing, lets Work Together to make sure we get past the updates and their broadly provided and i can get my credit in the community discovering the attributes. In vulnerability disclosure is something that we do and put a key role and we manage and fund a project on our universities that handle a lot of the best facilitation of the researchers and defenders and we played a broker role. Even in organizations more broadly we are seeing the researchers brought into the development process, were seen researchers brought in to operations and maintenance and there has been an absolute surge in the program like microsoft word i work that will offer money in some cases bigmoney, 100,000 for at least one time with them vulnerability to researchers that would conduct the research in an appropriate manner but if they found something that they can hide over to the company and the good side or the goods back to volvo this, the good guys can pass for the bad guys can exploit. The fourth piece is the security to resilience for fertility cream. You have to assume the bad guys will compromise your perimeter and, in this case, your networks, cybersecurity so how are you guarding or defending the crown jewels . There has been a significant amount of work and an emergence over the last year or so and to what is known as a zero trust concept where you assume the network fronts back and adversaries territory and you have to figure out how to basically how to have security medications in an untested environment. That resilience piece has the continuing involvement because effectively it turns into a whack a mole game. Really excited about the research happening and the adaptions and this was a big push prior secretary nielsen springing forward in an incident or in a response. How do you become anti fragile . Really all that is learning and realtime employing defenses that improve your posture, not just maintain your posture through an event. That is, i think, the next evolution of the security resilience shift. Fifth and final risk shift that we have seen over the last several years is this cybersecurity and enterprise level. Typically, historically security has been the domain of the Security Team, and thus the iso, but what i am keenly aware of is that the Security Team alone, without executive support in the funding and the push to become more innovative, will never achieve their objectives. We havent really expanded our outreach and efforts to not just the info sect team but the general counsel for lawyers and the boards of directors who really educate them that cybersecurity is in fact a business caressed, as much as financial risk and they need to treat it accordingly. This past fall or coming up a year now where did 2020 go . Last fall we issued a cyber essentials product that pocketed good security practices into three primary areas strategic, technical and tactical. The strategic bucket focused on two things, first, cyber queue security starts with leadership it will only have a Successful Program if your leadership buys into support and takes parts. The second piece of that is in the strategic side is you have to have a Security Culture throughout the organization. Anybody that touches the network or has the device on the network is part of the team and you need to make sure you are defending them properly but also they have the tools and resources to secure themselves. So, again, its not just about the Security Team but getting the executive buyin and that is important because once you have gotten awareness where you need awareness and principally im talking about Capital Expenditures and investments, what youve got that awareness and ability to set the Organization Budget then it will get the investments and through that investment that is where the real capability shifts and you close the gap on security where that really happens. I will wrap it up there before we shift to the fireside chats but five things we really have seen a significant shift in over the last several years is that risk is in fact shared across sectors. The second is supply chain Risk Management is as important as a discipline and cybersecurity in itself. Third, within cybersecurity Vulnerability Management is the place or one of the places you can make the most advances to secure the network. But relatedly it is about resilience and about zero trust approaches emerging and if the leadership is not bought in at the enterprise level then you will never get where you need to both on the investment side and capability development. If you saw that, looking forward to the fireside so i am not sure if it is going to the congresswoman or yeah, or melissa. Thank you, director. We have the first question and they have a burning question for you. I actually have a twopart question and it is an observation and i thank you are a breath of fresh air. You are brief and every time you give it a not we can see you and we were just going to hear you but not we can see you and i think you are a great, great credit to the administration and the departments. My question is first, the recent hack of all the fancy twitter accounts was principally done by a kid of age 17 with two accomplices. That bends the question, do you have the people you need to stay ahead of 17 yearold metaphorical 17 yearolds . The second part of the question is i recall back in the old days when you were putting the department and doing intelligence reform we kept talking about the need to change and a need to know culture and share culture and obviously sharing is good, however sharing also means you need more vulnerabilities so i guess do you have the people and is this need to share idea is still the tagline or is there some new one that i am missing . On the hiring piece, i had suspected it was probably not a nationstate but criminal. Particularly, and cyber, im not sure if it matters you are 45 or 17 which speaks to the ways we need to involve our hiring practices. To the standard general schedule approach that is based on a system from 1929 but almost a clerical hiring approach for supporting it really prioritizes experience College Postgraduate degree and certifications but that is just not how cyber works. I have found there are some candidates that we are getting to come out of college and graduate program and then when you are experienced and there are others that i am getting 17, 18, 18 yearolds that apply through practical operational effectively experience in Security Research and online white hackers because they can turn on a paper computer. We got to reconfigure the way and weve got to think about highs hiring and talent tools and maximize those approaches and that includes a diversification of a k12 Education System but also might, to your two year colleges. As a trade almost in institutes rather than going to law school or Something Like that. But also along the same lines i think ive taking in Stem Education and as long as we factored in the security has to be has to be a part of technology in education and i think we can get away from this overwhelming or ongoing narrative that there are cybersecurity jobs open if we can make more stuff secure by design and appointment that we will need all those we will have although cybersecurity openings but that is just to put more pressure on the Technology Jobs and second piece on info sharing i was hoping a 2015 when the cyber information sharing act of 2015 when that past we never talked about information sharing and i was wrong but it refuses to die but the way i look at it is it is not so much the wheatley to share information but it is that we need to operationalize our partnerships. We need to make sure that the things we are aware of and where we are able to do is reducing risk. One quick example of why i think the 15 year approach we have taken, at least in cyber, is off is that we talk in generalizations and share what youve got so we can stop the next attack. The way it is general and people cant say maybe that thing is important and i need to share that thing, you dont make the progress or get as many people involved. But when you figure out a specific objective and you decide we are going to defend the 2020 election from foreign hackers, okay, that is something i can scale my resources to address that issue. During need to work on that team . If we get state and local Election Assistance Commission and the director of national intelligence, nsa, cia, cyber command, fbi, lets get everyone together and then you can, in a much more practical with executable manner, share information with a purpose that has the right context around it. That is where we are seeing the most progress right now and to a certain extent this is a model that we develop from 2018 to the midterm elections that we then use earlier this year with covid under what is now known as operation work speed, that of element of a covid vaccine. Early march, march 15 i issued a paper to my team that said here are the things we will do to support the Covid Response. Its not just about vaccine and Therapeutic Development but about ppe manufacturers, hospitals, Group Purchasing organizations and i called it the time project and i was watching latenight tv as i worked during the initial quarantine but it was just like the liam neeson character in the movie, taken. We were going to send a message very clearly to your adversaries you dont mess with us and if you do they will come and find you. We had work to do on the defense side and it is the same model we use for elections. We are using it right now in 20. That is why we have this fairly confidence spring in her step that we may significant progress in protecting our elections. Here in the runoff to 2020 but just like those virus shifts i mentioned going from security to resilience there will be opportunities for bad guys to wreak havoc and we have to be ready for that and have analog or backup systems in place that will allow the election to go on under the constitution law of 45 and weve gotten good education over on that last week or so for that is what we are focused on now. Thank you. Wonderful, thank you. That was very helpful to talk through these sorts of five different areas risk and they have seen those shifting. I had a couple questions for you being mindful of your time and thinking through the moments that we are in now. Risk management or Risk Advisory given our present circumstances but the first relates to the election which you just briefly touched on in your answer to congresswoman harman. Question, could you talk about the ways in which our elections are now more secure in 2020 than they were in 2016 and 2018 . Not just the priority of security at the strategic level but, as you put it, operationalizing that in practice across various states across the u. S. Yes, three top items come to mind appeared first and foremost what we have right now is a vibrant election of Security Community of practice. We got state and local Election Officials alongside federal government partners across agencies working toward the same purpose in working in established mechanisms and clear understanding of the roles and responsibilities. In 2016 no slight to the Prior Administration but as a matter of how things transpired and evolves. My team is a Critical Infrastructure leave a friendly win no how elections work. We do not know there was election within the federal government that have primary liaison response abilities. We had to figure that out on the flight and then build things that are sustainable and enduring here. Again, this community of practice that is working and its one example. Weve got information sharing and in an Analysis Center dedicated exclusively to election infrastructure. That spun off over the bridge from 1718 and i had 50 states and 7000 jurisdictions get benefits out of that, that partnership. Second piece is there is absolutely a night and day difference between the Security Awareness posture of state and local election networks. In the resilience measures that have been built in. We have intrusion protections that have been deployed across all 50 states and in state election directors and secretary of state networks. In fact, in some states we got them on all counties. Florida because of the election is always florida but weve got our intrusion detection system on all 50 counties down there. We can take signatures that we derive from a number of different sources, including formerly classified signatures from the Intelligence Community. We can put them on those centers and they alert and we can investigate and respond. Weve also, as i mentioned in that third shift, really worked on vulnerability transforming the vulnerability of management prophecies of our Election Partnership last week. We released guidance on how to set up Vulnerability Disclosure Program and have been working on that for about one year now. We are seeing behaviors improve we seen the patched times and the rate at which you are patching and the timeliness of it is cut in half. In this case being cut in half is a good thing. From 60 days30 days. We need to get that but absolutely. Last thing is weve done a lot of work on actually, two more things. Weve done a lot of work on really isolating where the risk is. The things that get slowdown to proportion are the Voting Machines that dont have paper records and direct reporting equipment. They have tribal leaders in general and how it connected they are susceptible to hacking. While true they are vulnerabilities in their system and they are for that is typically not an attack on the scale and certainly not a undetected manner. That said there are other machines that are centralized and highly networked like Voter Registration database and reporting they could have a scalable impact, still very confident that we would be able to detect any sort of manipulation to scale which is important thing to point out that even in 2016 answer to date no intelligence whatsoever that suggests a bad guy was in a position to effect change a single vote or be in a position to do so. Last thing on this front, and 201682 of the paper ballot backup and right now for 20 we are on track we were on track but we will exceed that and it would be over 92, 95 with the increase of the absentee ballot voting that is happening across the country so for us anytime you get paper into the system that is an opportunity to audit and auditing is a good thing. Last piece that has changed so much and i think again i talked about it but we had that inner Agency Template that playbook for how to Work Together seamlessly between the Intelligence Community and the ic is over there willing to detect bad guys who want to do bad things. Department of defense is over there where if you disrupt that bad guys will do bad things the fbi is here looking to disrupt and prosecute and then we are helping protect. That is the name of the game right now and again i think we made dramatic improvements and probably the game that will be played by our adversaries will be more hack and leak or does infospace. Wonderful. Thank you. In addition to elections there is an area that has been of great concern to people watching the news and our country in general. Theres another risk that was heightened in 2020 and it has to do with the pandemic and virtual systems. As you know here at the Wilson Center and everywhere in the United States there was a sudden rapid shift to virtual work and we rely on Virtual Infrastructure and a new pathway for cyber vulnerabilities and cyber attacks. Could you talk about what they have been doing in the space around Digital Networks and digital vulnerabilities because its an area where unlike elections you didnt have several years to get your hands around the problem but it can hit quite rapidly in 2020 and on a very large scale. Could you talk about your advances in that space. Yes, three things happened. We were focused on three things is a better way to put it at first and foremost was really understanding the way and the Risk Landscape had shifted due to the relative importance or criticality of the number of different performers or organizations. Typically when you think about the risk formula is some kind of combination of threat times consequence times vulnerability with a dash of likelihood on top. What we saw more than anything was an increase in threat or at least focused on Covid Response but a dramatic shift in the consequence variable. What i mean is a year from now if you lost a company like or even better if you lost a hospital in new york city this time last year would not be the end of the world. What i mean is you could shift patients or transfer them to other medical care facilities. In the deepest, darkest point of new york citys response, if you lost the hospital due to a ransom where attack or Something Like that, no joke, people would die. We spent a significant amount of time understanding the impact to how what really is our most Critical Infrastructure list and understanding that and focus the assets against that. We also spent time and i thank you will have daniel cruise talk about it in the next panel but thinking about supply chain lines again, that second risk shift, how did supply chain impact chains the way the critical functions were performing here in the u. S. , whether disrupted with it coming in from somewhere in china but due to shutdown of exports you lost and so you couldnt move forward. Understanding the risk shift in the developing programs and protocols around improving the resilience, but to my second piece of what i already talked about with project work speed is supporting the National Effort to develop vaccine and therapeutics and bringing on them in our efforts and providing them services, including vulnerability scanning, remote penetration testing, Incident Response and partnering with the Intelligence Community but not just as organizations because for the most part these are Large Organizations with wellcapitalized defensive teams but also their supply chains and their supply chains grow in nature so that provides school work and in europe and asia to make sure that when we look at a supply chain from left to right to stem the stern that whether we were doing it or partners in the uk or the netherlands they understood what we were worried about and they can put their resources to protect in that part of the supply chain while at the same time they shared their stuff with us and we would protect their stuff here so really this is turning into a global effort to protect supply chains and for me another validation of liberal democracies coming together to protect what is necessary for just, you know, a good way to say it with humans in general which then further underpins our Election Security efforts. Last thing, that Digital Transformation shift as every organization out there in front of some kind of remote work or telework and in doing so theyve invited a whole bunch of risk and that is why you go to that third risk shift and Vulnerability Management. If you use a vpn to make you are patching it. If you are using a remote tool like this, make sure you got it securely configured and using it in an appropriate way. We set up a few things including a Digital Transformation and telework resource hub on cisco. Guv that gives nonprofit and private sector big and tips on how to use this and these are the things you need to think through. We should continue that Digital Transformation but i suspect any organization like google says they anticipate being in the posture till next summer. Some folks might come out the other end of covid and say maybe i dont need all that real estate and those big shiny Office Buildings and people can work from home. I think there would be a lot of people like that so this is a service for us and we are not going anywhere anytime soon. The last question we have is moving away from this Digital Space into a more physical space you mention supply Chain Management and supply chain risk. We also know working at the pandemic there are many failures in the supply chain and many concerns whether it was what you needed to make a respirator or vitals for hospitals and many limitations with security secure there. We know we can produce everything we use domestically within our own market, across every ecosystems, could you give us a sense about what you are doing to understand supply chain and specifically how do you differentiate between something that is prickle and something that is not because many of these things would be considered critical prior to march and are now have seen is much more critical spirit and this goes to again the second shift that four years ago, look, supply chain Risk Management is nothing new but i think the amount of focus we are putting on it right now for a couple reasons one and it is becoming blatantly painfully with our train trade partners and dependencies dont have our interests or dont have share similar values and good at the drop of a hat use that tension against us. I made it a top priority here when i came over to put security or supply chain Risk Management on top of our security list. With five securitys here and they dont speak ill of our other things we do but you should aspire to be contributing at least five. First is federal networks, second is election saturday, third is [inaudible] and fourth is control a System Security and fifth is china supply chain and 5g which that proxy for that conversation. In general, we set up in about two years ago now, yeah, the national Risk Management center is the hub of the activity for supply Chain Security and they are two years old effective saturday so happy birthday to the national Risk Management now set up in new york city but that is the home for our supply chain Risk Management task force. Catherine is a big contributor they are. The at least, in part, was there were iterations out there that do a very good job of supply chain Risk Management. The problem is theres a high barrier and treated it successfully elsewhere and so what we want to do to a certain extent was democratized supply chain Risk Management and bring everybody so that you can do it well so how and why do you do it well and lets distill those best practices from across the number of organizations and pull it together and share that out along with implantation guidance as far as we can. In part, that helps these organizations do it well by sending it down their supply chain in a meaningful way but also says identifies those areas where we dont do this part well and we have challenges and this is a challenge so how do we overcome that and additional legislative authority for the organization. You know, that has been brought into really again acute awareness over the last several months with covid and as i talked about some of the issues that we have seen whether it is this widget or that widget or even just a lack of workforce but what we are undertaking right now within the task force is okay, right now with covid we understand a few things that have with a lack of diversity for certain components and justintime delivery doesnt work when the Global Logistics chain is being disrupted. One of those really Critical Infrastructures that need to overcome that and need to overcome the Security Threat and again fourth shift become a more resilient, anti fragile organization and how do we overcome that . Part of it could be through restoring and part of it could be going to our other strategic allies and help them but ultimately we really, truly need a more diverse global marketplace for dependable components, trusted componentry and 5g is the absolute best example. On the china front if 5g is the greatest Technological Development for Critical Infrastructure over the next decade why on earth would we put the control plane for that infrastructure in the hands of an adversary that time and time again remind us of who they are and what they think of liberal democracies. To me, it is a nonstarter. One of the best ways to overcome that is helped lead and innovate on trusted alternative for us and our partners across the globe. Hopefully that gives you a bit of a sense of where we sit across the Risk Management spectrum and its been as i sit here a good conversation and good way to work through some of these things. Thank you so much. Please join me in thanking director krebs for giving us, not only an update on the evolution of how they thought about risk across five different categories, but also an update on the current Risk Management or risk advisories challenges that cisa faces in terms of the pandemic and the election. We will go ahead and pick it to the Panel Section so thank you for joining us. Doctor krebs, thank you for overcoming our own digital system problems at the beginning of the call. Its been great. Goodbye now. We are going to pivot to our panel. We are joined by three experts with very different portions of the u. S. Ecosystem can talk about Risk Management and Critical Infrastructure and different vantages that will make for a productive conversation. Before i introduce them i do want to put a call out to the audience who is listening in from various parts of the u. S. If you have questions that you would like to ask our panelists we will be fielding some of those questions at the end. Please, go ahead and email them to our email address spip Wilson Center. Org. Please email questions and then we will field some of those at the end. These panelists have been introduced by congresswoman harmon but i will briefly remind you on who they are. We are joined by the assistant director of national Risk Management of the management center. Thad allen is a Senior Executive advisor at hudson analytics. And kathleen senior director of National Security and emergency preparedness. Thank you for joining us. To kick off the conversation today one of the focuses behalf for this conversation is not just where we have been but what has been the evolution of Critical Infrastructure protection to date but where are we going and what is the future of Critical Infrastructure protection so i would ask all three of you reflect from your vantage or you sit in the ecosystem on an area where you think u. S. Has made the most progress to date and Critical Infrastructure protection and an area where you think the Biggest Challenges still remain. We will go ahead and program orders so we will start with you, bob. Sure. Thank you for having me, melissa. Good to be here. We worked together closely from time to time. Its good to see them. I have to speak after my bob boss and hes more eloquent than i but i will reference his remarks. I think in terms of progress and it is manifest by the fact that we are in a partnership in the structure and the trust that has been built in terms of our ability for industry and government and across government to Work Together and challenging risk issues is in the consistency of the framework and authorities and how we know we Work Together and express what has been put in place and using them consistently over the time has built a lot of stresses on the system. We lived through a lot of highpriority issues whether it is incident like the food pandemic in dealing with hurricane annette had to deal with that and people that we have to deal with and the emergent challenges. We have a group of people who know how to get together, think about risk and share information and come up with solutions and go after the problem. I would like to go after the problems before they become the front page before they become an incident but things that will make us more secure but sometimes it isnt until the incident happens that we get an opportunity to address that. When i think about progress i think people are proud of is the trust that has been broken in the collaboration and then using that trust to make the country more secure around that. I start with that is something that i always highlight and there are times in 2016 election we didnt have those structures but we used the same playbook to build the structures to work with secretary of state and private vendors and having the opportunity to build a Critical Infrastructure sector on the fly felt very similar to how Communication Companies and Energy Companies and banks et cetera. The area where i think we need to continue to make more progress is, you know, actually continuing to blend those capabilities together to more quickly solve problems. More quickly field capabilities, i guess. Weve got to have identification problem solution but can we come together more quickly to field things that will make the country more secure and blended authorities to stimulate innovation, to allow industry into the conversation and to we can put these resources toward making infrastructure more resilient if we can share information and come up with solutions but Field Solutions but i like to talk more about that Going Forward. Wonderful. Thad, would you like to take it away . Yes, thank you. I apologize. Im on the hinterlands of pennsylvania here. I would like to expand on what bob said because he is on the right line of effort that we need to be dealing with look at what has happened in the world today we are dealing with greater levels of complexity whether it is the scale of scope or the novel virus that we have not dealt with before. Increasing scale and complexity and the complexity becomes a risk aggregator and its important to understand is becoming more wellknown to everybody. When i talk about complexity and talking about complexity that starts to break down Legal Frameworks and standard operating procedures, training, tactics, procedures and any structure that has been created to model how we will respond to these things and refining that they dont scale very well and were dealing with a large event. That is been exacerbated by the fact that technology has accelerated faster than we can keep up with and just the inability to keep up with the International Legal frameworks of cybersecurity and so forth and there are a testament to that. This notion that you have to dress complexities as a risk aggregator and other ways we can do something that in my view, the expectations of the american people, they have to be coproduced and the only way you coproduce an outcome is you introduce an effort that what bob was describing is a transformative unity of making a unity of relationships. If you have a model in a way to think about it and then you have a previous encounters of planning or exercises or table talks or just working a problem set will allow you to address it. I think whenever you talk about challenges to have a structure in the country, you have to think of coproducing outcomes and how to organize those outcomes and that is through unity of effort. I would agree with bob we are making a lot of progress there. One area i would like to throw out for discussion later on, it connects back to what chris krebs was talking about, we live in a Digital World we are all digital citizens and i am not sure what the level of maturity is for our government or citizens to operate in this environment but one thing that connects all critical info structure together is the electoral magnetic spectrum through which wifi signals and everything passes. It is a new domain that touches everything we will have to manage it as a domain. Right now we handle spectrum on a basis through the federal Communications Commission and we have auctions to deal with spectrum like it is a property right but its an enabling domain that connects all Critical Infrastructure together. I think we will have to get our arms around that to solve these problems because that is the connective tissue that ties everything together. Thanks. Thank you. Catherine. One, again, thank you for inviting me. I absolutely agree with bob and thad. Let me give a slightly different dimension. We talked about process and being able to collaborate and i am at the point where the thing that i find where i believe the week the u. S. Had done the most progress is taking it down a level from the analytical thoughts. I think people should have a rough sense that things are critical in that we do rely on things but i have to get [inaudible] fraction is focusing on functions or Services Rather than things. Post 911 made of put the garden gates around the building and that is important, and i am not saying it is not but it in my mind is an academic reach and an intellectual reach that we are now focusing again on the functions and the services because decoupling, if you will, whether it is not been able to decouple this is make us think differently about what is it we rely on and whether or not we rely on it or not, i think also makes the plans and makes the arrangements so that you know what you do need to focus on. Now, i think that even in those environments where we have operated of like on the guns and garden gates and lets take care of that thing and that building and that manufacturing and even in those domains the interconnectedness of those capabilities is that manufacturing thing will rely on lots and lots of other things and if we do focus on what is important in that factory does need 5g spectrum which is in connected to the wireline which is then supported the power which came from distant regime and this generation and you then start to unpacked what it is that needs to be assured. I think Going Forward the fact that we are moving in this direction is both the most progress and also the most challenging. I think there is a kneejerk reliance and we need gas for my car and if you will evacuate a hurricane but where does the gas come from and how did you get to the station and what powers the station and you know, to unpack all of that is, in many respec respects, i think, intuitively obvious but only once you stop to think about it. I think the average person doesnt and they dont necessarily have to do so but during covid right now i think people are thinking about their supply chains a lot differently because it has become very personal. The effort to focus on what are the most important function services and what supports that plus having been able to unpack that and to do the deeper analysis that you can focus efforts on the resiliency of the anti fragility of those things. The most progress and the most challenge and its all in the same breath. Thank you. I want to take a step back and talk about something all three of you reference which is this question is what is critical. We have an entire panel in two hours dedicated to Critical Infrastructure, critical function, Critical Services and i dont thank you necessarily take the time to think about what is critical and what is it for the Energy Sector and main providers and is at the downstream or upstream dependency of those providers so they include things like crowd computing, open Source Software. We want to hear from each of y you, in your mind when someone says critical, critical function, critical info structure, Critical Services what are the types of things that come to your minds . Have they evolved and what pieces are you still missing . Whoever would like to take it first. Let me just tack on what catherine said and give you more background to answer your question, melissa. What we did last year working with industry and government was to define the 55 critical functions. Those are the functions that are so critical to National Security, National Economic security, national competitiveness, Community Wellbeing that if they break we are in trouble. The functions, t5 is a long list but if you look at any one of the 55 [inaudible] there will be, i can guarantee you. That is publicly available and has things like generate electricity and extract reserves and run Identity Management services, communicate wirelessly, conduct elections and those functions are critical and what we are trying to assess constantly is how those functions are produced. Are there geographic components . Some of them exist virtually because theres not geographic components and some are where you can point to and they get delivered through a data complex system tear or the houston shipping channel and some of them, every area has a known watch. You can look at how they are produced and how they grow and what areas are the independent and what Software Helps produce those and you see at the functional level how they are together and then within that uvalue that and then you say is the scenario hopping and will the area essentially fail or degrade it at the National Level and then you can prioritize which companies contribute to the function, which software, which hardware across, obviously things like control system are important to function and you mentioned outsourced software and computing and so what we are trying to build out is based on our understanding and functions that matter the architecture of how they are created and then whether there is a scenario by which some are in the architecture they can break and then test data across the functions and you get to systemic failure at this point. That is how we are thinking about it. I make the comment that 55 seems more than 16 but it has mere the things that really matter to us because there are only a few geographic components of superstructure around the country that have a function to fail but there only certain Hardware Components that are so ubiquitous that you can cause a functional failure and we looked at covid and there arent a lot of things that have caused National Infrastructure to be a sniffing interest because of covid, only really the Health Infrastructure but other things have withstood resiliency. That is how we are thinking about it and allows us to propagate that down to where you can manage risk. This is bad. I would like to add onto what bob said. When youre talking to the American Public that a hard time understanding the interdependencies and all this comes together because its so very complex and if you add together the elect traumatic spectrum as he talked about earlier, gets very, very calm located. When i think of Critical Infrastructure may be a better way to think about is what is the supply chain that produces an outcome that is critical to a national wellbeing. We are finding out its not a set of sectors as bob said but a chain of production that produces an outcome that benefits the general welfare and we want to have supply chain assurance for those outcomes and in particular, it could be held or Something Else but i think that is a better way to talk about it because what you are looking at is what enables human beings to walk around and function normally and not only in the United States but globally. I would say when i think about critical functions i think about those functions that are critical wellbeing to citizens and how you produce them and that goes back to my original comments about complexity and when Legal Framework starts breaking down or technology exceeds policies and laws and stuff like that, how do you pull that supply chain back and make it work to produce the outcomes expected of the american people. Or an example, bob is familiar with this. He probably knows where i am going already. Theres something we take for granted in this country all the time and that is included in the functions of the bob talked about. That is the provision of time and how we sink a nice time and how do we tie financial attractions and how do we synchronize cell phone tower operations and how do we phase electoral production, Power Production and the fact of the matter is the gps system for the United States provides three things position, where you are, navigation and time. What time is it. Time now is being parsed down to the nano seconds for the purpose of timing Financial Transactions and everything else. You would be amazed to understand what has to be sink and eyes in terms of time to make things work right in this country. It brings us to the vulnerability of gps that what would happen if we did not have a shared position navigation and timing that provides. Public Service Announcements and i chaired a spacebased timing Advisory Board to the executive command management across government but just an example, a type of function not generally recognized by the public but that affects everything theyve got, gps chips are ubiquitous in almost any type of personal items we have right now to Industrial Control Systems and so forth but that would be an example of a service or a function that is critical and affects everything in the country and affects all these outcomes and affects the general welfare. Catherine, would you like to weigh in . I think the original question was, you know, [inaudible] and im all over the pnc. You know my company and that sector is all over this. Your point is wellmade that that does the average person realized that to be able to, i dont know, do transactions at the Grocery Store that there is a timing element of that debit card going into the contactless and i think that is fair but i do think the partnership that has evolved certainly the Critical Infrastructure sector and dhs and other departments and agencies is, sort of, creating an environment with a thornier questions can start to be addressed. I think one of the things that we get is what is essential and what is critical is in the eye of the beholder . I think that point is well understood that the average consumer is trying to get away from hurricanes and he wants gas in his car to get out of danger. On a simple level that is the service that allows them to thrive. Certainly, you have higher needs and, to have shelter and water and all those things got mashed into the critical functions. I think though what we shouldnt start to overstate it. I think one of your original questions was is it Core Software things that are now critical . Is a cloud Critical Infrastructure . These are all amazing capabilities that help enable resiliency and Good Services in the national way but i think once again it came down to, and we saw this in covid, did i need logistics so that stuff could be [inaudible] and yes, i did need that critical function. Did they use open Source Software . Did they use cloud structure . Undoubtedly. Does that mean all open source kregel infrastructure is critical . Not necessarily but does mean all mediations are but i think the critical [inaudible] but i think that for dhl, fedex, u. S. Postal service, amazon they would say their use of their cloud and their open Source Software that was critical not the whole thing as a category. Once again, as you start to unpacked and on appeal what is critical is essential and what really do have to protect and i think it comes down to what is it that you are trying to do that is important and on you to unpack your own architecture. You can follow the stream to better assure it. I think that goes back to a point that was made earlier both fight director crabs and all three of you in slightly different language, this whole of society, unity of effort, once we have identified what is critical, whether its a function, and for structure is is question of how do you protect it and ensure its resiliency and one of the more challenging things about dhs is its size and the fair diversity of players that you are dealing with. Another challenge is that a lot of this is voluntary where in other countries that may be less the case where there is a much more robust, Legal Framework that requires certain things of industry across the board. Could you talk about, from your vantage, the maturity of our whole of society or unity of effort in a particular sector, maturity of that model and what the lessons that you can pull from other areas to expand across that country and more broadly . Are we sticking to the same order . [laughter] in the voluntary requirement statement that you just made is the idea that somehow were placing requirements and more will happen better. I want to push back a little on dad. Departments only make requirements if they are smart and enable innovation and dont get locked into a supplied culture. I was hoping catherine would go first because the communication sector, as much as anyone in here, has a history of grappling with the balance between voluntary and what needs to happen in a Regulatory Environment that would stifle innovation and innovation that needs some rules to come behind it to make sure that innovation does not create to musk risk. Theres a good dynamic tension there and what we are learning that again, i look at what we just lived through or what we are living through in the pandemic and the communication has withstood the challenges of the pandemic and i think the way we shift the weight we are communicating that we are all being decisive and we want certain precision and all that so i think there are lessons there around it and i dont want to suggest is that what we need more National Security requirements on top of industry to do more than they would do but then there are areas where for whatever reason additional requirements might make sense because it drives additional investment and it allows risk outside of the control of the firm to be managed around that. What we are trying to do is identify where risk is not being managed up to a level of National Security interest and try to that gap in partnership with industry and across the sectors but not the way you do that is to put a bunch of different rules and demands on you that dont make sense but the healthy tension of learning but the reason i returned to the beginning is i think we can come up with sort of the source and then talk through what is the best way to close those gaps rather than assuming, what is right government introduction to help close those gaps and its not necessarily rules but getting out of the ways to clearing rules or stimulating investment or things like that. Yet, bob, i appreciate that. Im currently working with the Business Executive Financial Security on some changes to be recommended in the term before the next phase of covid and one of the interesting things with the former fema director is this tension between in the supply chain the more efficient you get the less resilient you are and so there will be this tradeoff between how resilient you want to be and theres a cost associated with that and part of the community of effort and unity of purpose and moving forward so one of the boundaries related to the tradeoffs between efficiency and resiliency or however you call that moving forward and just like its been bob knows as well but everybody has spoken today knows very well that its been a long hard slog to get them to understand their role in managing cybersecurity so i think unity of effort will be based on a public, private conversation of a tradeoff between efficient supply chain and resiliency and how you allocate those costs. In some cases if it is critical enough there will be a mandate by government and then it will have to be passed on to the consumers for their cause. The 1990 mandated response equipment and certain things could be done there were federal issued regulations that sprung up with that response industry that was passed on of price of goods to the consumer. Youve got to get in and talk about that spectrum and find out what the most efficient allocation of capital will be moving forward. Thanks. Hello. Communication sector here. [laughter] i think it is fair to say we do have a fairly longstanding relationship with government dealing with Security Risk resilient issues. It was understood decades, decades ago that you cant weather a storm if you cant communicate or whether a storm if you dont have help. Our has a deep relationship. I think over the course of time weve ended up having sort of, i will call it three paths to progress. We have a path to progress that says government comes to us and says we think we have a big problem and maybe that is pnt issues. That is a big problem with is not something that [inaudible] can fix alone. You take the problem, Risk Assessment and then you sort of figure out is there a way to mitigate the risk or something that we all have to do and then hopefully over the course of time you end up the risk mitigation. About a fiveyear pspan. It takes that long to sort of assess the problem, measure the problem, come up with a solution, create a plan, test it, make sure it actually works. Thats not irrational. But i think the two points that have been made are really [inaudible]. There are certain things that you can do as an Owner Operator that makes sense, generally things with security, resiliency or continuity of your service are generally noncompetitive so theres not like a huge, you know, bridge there. But there are certain requirements that are so far beyond what you can deliver as a business, that then you do have to have the discussion with your government partner, you know, we would love to do this for you, but then all of a sudden, you know, Internet Service is going to jump by a factor of 12, and the average citizen cant afford to pay that. Were happy to do it, but are you going to pay for that . This is not just comp. It is all the sectors. There will b