Transcripts For CSPAN3 Federal Cybersecurity Policy Prioriti

Well bring our next panelists here. Thank you again for keeping your conversations a little bit more quiet on the outside by the booths so we can listen to our panelists. So this next panel is very interesting called new models of public, private cyber collaboration. The moderator is mr. Will ash. He is a senior director of Security Sales used Public Sector global Security Sales for cisco. Joining him on the panel is Major General ed wilson, United States air force retired, secretary of defense, assistant secretary of defense for cyber policy in the office of the undersecretary of defense. Also joining us is claire caroma from the Defense Digital Service. Also Lieutenant General stephen fogarty, commanding general, United States army Cyber Command. Also ms. Tonya ugoretz, a Deputy Assistant director cyber readiness, outreach and Intelligence Branch for the fbi. And last, miss Jennifer Walsmith, sector Vice President and general manager cyber and Intelligence Solutions division, Northrop Grumman mission systems. Over to you, will. Thank you, ed. Hello and good afternoon, everyone. Welcome back. Before we get rolling i thought it would be appropriate to give billington a round of applause for the great contest and guests weve had so far. So lets get that going. That served multiple purpose, got your body moving again and draw some of the exhibitors back into the hall. Welcome to what some would argue as the Signature Panel of the summit. As grant mentioned, we have the operators in the afternoon so indeed we have the operators here on stage. At least six would argue this is the Signature Panel. All kidding aside, if you look around the room and exhibit halls, there are public officials, private representatives and this is top of mind for all of us in the cybersecurity business and industry, public and private partnership. In this case new models of public and private collaboration. For the next 35 minutes or so, were going to explore some relevant topics in this area with this exciting panel. The format is going to be were going to have a quick introduction right now and have each of our panelists not only go a little deeper on what their role is beyond the title that ed mentioned, but we also wanted them to share a use case in this space, the Public Private collaboration. It means a lot of Different Things to a lot of different people. Its a very broad topic. So thats how the introduction will flow. Major general wilson, if you wouldnt mind starting us off. Thank you. Absolutely. Its good to be here with everyone today. Ed wilson. Our term for cyber policy at the pentagon and in that role were responsible for the strategy, different policies for the department as well as the authorities for all of our Cyber Operations across the department on a global stage. I thought what id do is just maybe share given the content of the panel, i dont want to steal any thunder from the Defense Digital Service or general fogarty from a component perspective but maybe something were partnering with industry on with an interagency context. And so last spring as we were crafting our cyber strategy, one of the key aspects was a realization that we had not defined and clarified the role of the department and defense of the homeland. I think we all understand that the homeland has a role in defending it. In air, land, sea and space. There were questions at times whether the department and what our role is for cyberspace. As we begin that journey, weve articulated that and worked with interagency partners. So really the use case that i want to put on the table just briefly is a thing we call path finders. In the defense of the homeland we have begun to partner with the department of Homeland Security and the requisite Critical Infrastructure segment owners. The first one we started on was the Financial Sector so we have a financial path finder. As part of that what we do is work with dhs, the different isacs as well as fs arc which is an industry representation of the key banking industry, the Financial Sector representatives. Weve begun an informationsharing process associated with u. S. Cyber command and some of the Intelligence Community representatives in being able to share indicators of compromise for Systemic Risk in the Financial Sector. It may have been highlighted earlier. We also have a path finder associated with the electric sector, the energy sector, really focused on the electrical space with the department of energy. Karen evans who was on stage earlier. As part of these path finders the reason we termed it path finder, this is New Territory for the department so were not trying to overarchitect or overthink the problem. Were trying to get started and begin the process, begin the collaboration with Industry Partners, with our interagency partners, understand roles and responsibilities, and the unique attributes scale scope perspectives the department of defense can bring in Critical Infrastructure. So its a unique use case. A lot of wind in that sail now, were making good progress. I would say that really it could be gamechanging in some ways. Not that were the prime player but the duty, the weight, the scale, the scope that we can bring to the problems can be brought to bear in this particular use case. Excellent. Great use case. Thanks for sharing. Despite starting with ed, were going to keep you guessing, were not going to go down the line and also keep the panelists guessing, a bit of a game. With that well swing to jennifer. Jennifer, would you mind . Absolutely. Im Jennifer Walsmith Northrop Grumman. Cyber and Intelligence Mission solutions. Its by no mistake that we put intelligence and cyber in the same organization because i really see it as two sides of a coin. Im career government for the majority of my career spending the last ten years as nsas acquisition and procurement representative. I joined Northrop Grumman three years ago and have been having a grand time working Cyber Intelligence from a different vantage point. My use case is about creating a global ecosystem for the workforce of the future. It starts with what were partnering with the air force association and the Cyber Patriots. Long standing started in 2009, certainly long before i was involved with many of my predecessors and many partners across the country, but what started as a small effort in 2009, in 2019, ten years later, we had over 6,000 teams competing middle school and high school. Our Cyber Warriors of the future. We didnt stop there. This year we opened up our cyber centurion in the uk and cyber sypan in the australian cyber commonweal commonwealth. So its about creating that workforce of the future starting very early in middle school and high school and thats whats really exciting. If i take one example and then pulling that thread all the way through is really with the universities and creating not only the students but then the interns that are so excited to work on our customers hardest problems all the way through to research. And what excited me this summer was watching 30 young interns doing a codeathon against one small aspect of nsas hard problems and creating that environment as a partnership because they certainly had to create the environment that we could do that. But thats an example for me of Public Private partnership for the future workforce. Thank you for sharing, terrific. We will go a little deeper on the workforce topic later as well. Thanks for sharing. Why dont we come down the line. Tonya, would you mind going next. Sure. Im tonya ugoretz, the Deputy Assistant director in the fbi Cyber Division. Our Cyber Division is the investigative and operational arm of the fbi that works to deter and attribute cyber intrusion activity to hold actors accountable. So within that division we have two deputies, one who is responsible for operations and our National Joint task force and then i have the Everything Else branch. So that includes things like our intelligence workforce who focus on both National Security and criminal cyber threats, our elite Rapid Response team, our Cyber Action Team who responds on site to our most significant cyber threat activity. The people who make the place run in terms of workforce and logistics and finance and budget, and our policy team as well as what we term Mission Critical engagement. And thats where in my branch we have the nexus of the fbis Cyber Program to the private Public Partnership. So for the fbi, that sense of Public Private partnership is really core to everything we do, in every program we have, whether its crime or counterterrorism or cyber. And its manifested in our presence with 56 field offices around the country plus dozens of other offices as well as a global presence. Its really about how in each of our offices in our area of responsibility, we are out engaging with companies, individuals, communities ideally before something bad happens but also there with those relationships ideally already built to respond after, unfortunately, something does happen. So when we look at private Public Partnership, on the one hand we see it as not necessarily something new and unique. Its foundational to what we do. But in the Cyber Program, weve had to look at what aspects of it are unique when we look at cyber. And i think theres two key ways we look at that. One, its by virtue of the fact that apart perhaps from maybe federal networks, the majority of what we care about and the majority of what our adversaries are targeting are in private hands, whether thats individuals or municipalities or companies. And so we need to have those relationships there to both protect and respond across the federal government. But also, whats also in private hands are the companies who form the backbone of that Network Infrastructure as well as commercial Cybersecurity Companies who have unique information about malicious activity thats traversing or targeting u. S. Networks that the u. S. Government doesnt have and that u. S. Citizens dont want us to have because you dont want for some reason the fbi sitting on your network. So we have to have those good partnerships, and i think thats where it is unique in cyber. So weve been looking at this issue for quite a while and the case example i would point to is something we call the National Cyber Forensics Training Alliance or the ncfta. It was begun in 2003. Its actually a 501 c 3 located in pittsburgh, but its a physical location where representatives of government, academia and industry sit together and share information about primarily cyber criminal threats to u. S. Targets. And in one case example recently, we had a global botnet that was involved in malicious ad fraud. It was operating from 2015 to 2018 and it infected about 1. 7 million users. It would use hidden browsers to download fabricated web pages and then load ads onto those web pages. These generated fabricated ad clicks and what happened was that businesses ended up paying about 29 million for ads that no human user ever actually clicked on. So working with Industry Partners as we identified this activity, we were able to sequence a number of actions to eliminate it. It started with an arrest of one of the perpetrators and that arrest was enabled by our attribution, which is the cyber fancy term for identifying whos responsible for activity. And then sequencing events with foreign partners to take down servers and infrastructure as well as industry to reroute the malicious traffic or sinkhole it. And what happened is that in a matter of hours, we were able to take down that Global Infrastructure in such a way that the malicious activity stopped. Lest you think that Law Enforcement action never leads to consequences against actors located overseas, we were able to arrest two of the three persons responsible overseas, have them extradited and theyre currently pending action in u. S. Courts. The third one is in russia, so im not so optimistic about that. But thats just an example of how working with industry side by side, we can achieve consequences and were looking to expand that to activity against nation state actors as well. Thank you, tonya. Youre not going to see it coming. Were going to go to Lieutenant General fogarty next, please. Thank you. Good afternoon. Im Steve Fogarty and i represent almost 16,000 soldiers, civilians and contractors that represent army Cyber Command, a force thats dispersed globally. We have three principal missions for the army. Full spectrum cyberspace operations, so thats operate, defend and attack. The second big mission we have is Electronic Warfare and the third is information operations. And as we pull all of those together and integrate those effects, we think that really spells Information Warfare for us. So thats the direction that weve headed. If you look at two things that were required to do on behalf of two generals is enable partners and then act. We very rarely act without a consortium of partners. So it might be academia, it could be commercial industry, it could be interagency, it could be foreign partners, but the bottom line is i cant think of a single operation that weve conducted since ive been in command that actually didnt include multiple partners. So for us that is the key to success. We exercise it in a variety of ways, so it might be a simple contract, it could be a memorandum of understanding, it could be a very specific document for a very precise purpose. But what we generally find is that the young people who work for us reach out to their peers, they have built their own networks, and what we find is theyre generally very, very successful at building these ad hoc relationships, ad hoc organizations, and they get after the mission. Thank you, sir. And, claire. Will you bring us home on this one please, thank you. My name is claire, i work for the Defense Digital Service which is a startup in the department of defense. We sit in the office of the secretary of defense. And my team is comprised of a s. W. A. T. Team of nerds that have been asked to come in to do a tour of duty for a minimum of six months, maximum of two years, to lend our talents to help the Department Force technological change that have a magnitude and order of impact on the department. We are comprised of a fairly set group of folks that work on our team. We have bureaucracy hackers, which is my role, so those are folks who have a really good understanding of government procurement, acquisition, policy, best practices and have some way in their past life a Technology Focus on their background. I started out as a developer and coder and then moved into management, acquisition and procurement and budget. We also have product owners on our team and those are the folks who know how to take a product, build it, start it from scratch and get it to mvp status and take it to a scaleable model. We have designers on our team, so User Research designers and visual designers. And last but not least we have engineers of all sorts and flavors, back end and front end engineers. The way that our team works is we partner with the secretary of defense and the different services. We have strong portfolios with army and air force. And we take a look at problems that they present to us and we go out and investigate if those problem sets fit squarely with the talent pool that we have in our organization. One major requirement for the problem sets that we take on is that we can have quick wins so we dont take on projects that take two, three or four years. There are many, many other great partnerships in the department that have those types of problem sets. Because our team members are asked to do short tours of duty, we want to make sure that we can do quick, fast and efficient wins