hi
i'm paul de souza and i'm the founder
and president
for the cyber security forum initiative
also known as csfi
today we're going to have an amazing
panel with experts
on ics scada iot
iiot cti and even industry
4.0 we're so we're here to chat about
information sharing
from a critical infrastructure point of
view
i would like to take the opportunity to
obviously
thank def con the ics village
the brazilian cyber command the republic
of brazil
of course jeff moss priest
my good friend the undertaker
excellent goon you know for many years
supporting our csi mission so
thank you so much for everything that
you guys do um
and and let's just get this show on the
road so
i will be the moderator for this panel
our panelists
will actually introduce themselves uh
which is really great
they have an amazing uh professional
background and
and i know that you guys are gonna truly
enjoy this this panel
uh at the end of the panel a discussion
we're going to have a q a session
which will be the opportunity for folks
to ask questions but before we get
started
let me just do something i guess
make a healthy move and replace my
coca-cola
with water let's go
so welcome max uh it's really a pleasure
to have you here
thank you so much uh could you introduce
yourself
and describe your cyber security efforts
in brazil hi paul and other friends of
the
panel first i would like to emphasize
that my participation here
reflect the view of an expert it doesn't
represent represent
the institutional position of the board
in which i work
also because the command operating cyber
defense
area with the institutional security
offices
of the presidents of the republic being
responsible
for actions aiming at protecting rich
infrastructure
however the commander realized earlier
on that in times of peace
it needs to promote actions of
integration collaboration
with joining actions second i would like
to congratulate
that def con coordinator for the great
event
as always and highlighting my great
satisfaction
in being able to be here participating
in this panel talk about
two subjects of great research in the
area of cyber security and defense
which is integration and collaboration
i already had the opportunity to
participate in addition of the event in
2020
but i never thought that one day i would
be inside the event thanks so much
guys and then i currently work in the
sub defense command in brazil
in the statistical management department
of the command
and i'm head of knowledge management
section
and i'm young of the cyber guardian
exercise coordinator
as far as i know of the only joint
exercise held in south american foxes
focus on the area of cyber security and
defense
and involving national strategic boards
in important sectors of critical
infrastructure in the country
such as nuclear and electrical sectors
financial telecommunication
transportation
among others thank you max for your
introduction
much appreciated i'm really glad that
you talked about the you know cyber
guardian
the cyber guardian exercise in brazil
taking place
in brasilia i've been lucky enough to be
an observer
to attend the event it was outstanding
it's just so critical for the national
security of brazil
in the security of its allies including
us here in the u.s a special thank you
uh to general amin for uh
supporting um csf5 to make this possible
so i could be there as an
observer so right now let's just shift
this to elio
uh elio so would you please introduce
yourself
and share a little bit of your
experience
in the field of cyber security
hi paul and other friends from the panel
i'm alice antenna
uh as max i i i'm glad to participate
with you of this initiative and
hereby i'm only expressing my point of
view as result of
my experience obtaining it on the last
20 years in the it
industry working with with many clients
like government and private clients in
cyber security
it's a pleasure for me participating on
this great event
that gathers many renowned specialists
and researcher
and for me it's like actually a dream a
dream coming true
i worked in the institutional cabinet as
an advisor and
working in in the development of many
instruments like the national
information security policy
and the national cyber security strategy
which were both challenging efforts to
increase
the maturity and improving the workforce
on cyber security here in brazil
currently i'm holding the director of
the information technology
title at the presidency of the republic
dealing with many security aspects such
as safeguarding
communications and critical networks
around the presidential
and ministerial communications
we are implementing for the next month
our own third
which is being called cert planato and
it's a mission that congregates
what i did in the past years helping
many companies
and government agencies to accomplish
and now i'm doing
by myself in the heart of the presidency
of brazil
among many challenges on this accompli
accomplishment i can say that
establishing trust
and mechanic information sharing
mechanisms
are the key ones to obtain a successful
result in many aspects
so you know thank you elio uh for your
comments
much appreciated i i really truly
agree with you know with your statement
about
uh you know trust i mean trust is
everything when
sharing information between countries
and and organizations
so shifting to john felker
at this point uh john would you please
introduce yourself
uh and then i would like to ask a
question as well
so information sharing is an important
part
of collective defense so
what are some of the effective
ways in your opinion that information is
or should be exchanged i'm john felker
i'm a 30-year coast guard veteran
i've spent the last 10 10 years or so of
my career
focused on intelligence predominantly
signals intelligence
and cyber issues i helped to stand up
the coast guard cryptologic group
and the coast guard cyber command
following my retirement
i worked for hewlett-packard enterprise
services
as a cyber and intelligence strategist
where we were working on
projects to help the us government
improve cyber capabilities
and in 2015 i went back into government
as the director of the national cyber
security and communications integration
center
nkick was the clearinghouse of
information sharing and exchange
for the u.s government was also focused
on incident response
and a number of other left of boom
activities
cyber hygiene scanning policy policy and
governance guidance and so forth
um and then uh sisa was stood up in
2019 and i became the assistant director
of
cisa responsible for integrated
operations
the part of our portfolio included some
cyber in the field
physical security chemical inspections
and emergency communications and
continuity of communications
across the nation yeah i think there are
several opportunities for international
partners
to exchange information in many cases in
fact i think in most cases
that sharing of information or
information exchange is done on a
bi-directional basis
it's important to develop trusted
relationships and nurture those
relationships over time
to allow for that effective exchange
you're not going to share information
with
people that you don't trust and often in
many cases
particularly at a national level
operation centers
will share uh information they'll
establish regular procedures where they
conduct phone calls or email exchanges
just to make sure that those
communications links
are open and those bi-directional
relationships
start building trust even at a watch to
watch our analyst
analyst level and when you build the
trust the muscle memory
is in place so that cyber threat
information can be effectively
exchanged in my experience sizza and
brazil
both have shared information
particularly cyber threat information
on a bi-directional basis uh that
effective
uh sharing of information has been uh
effective
but infrequent and uh be my hope that uh
there could be some more information
that uh is routinely shared between the
two nations
there are also several multi-level uh
partner organizations such as the iwn
the international watch and warning
network iwn was established in 2004
and it fosters international
collaboration on a real-time basis
it addresses cyber risk cyber threat
fiber vulnerability
across the spectrum of different
national interests
it also provides a mechanism for
participating countries to share
information
and build global situational awareness
on a more frequent and regular basis
and it also helps to establish uh
knowledge of each other
with respect to capability and incident
response
effectiveness i would also suggest
another effective way to share
information is to become a part of an
information sharing and analysis center
if you're in a uh private sector
vertical such as the financial sector
the maritime sector uh oil and natural
gas
electricity water and so forth the isacs
provide a very effective way to share
information
in a light group and they do so across
national boundaries
i think the the importance that we all
need to remember is that
cyber criminals don't respect any
national boundaries and it's important
for us to
to establish relationships and build on
those relationships
regularly exercise those relationships
so that when
a bad day occurs we can respond
effectively and even before that
we can we can share information to
prevent bad days
from happening i also think that there
are a whole lot of informal
opportunities going to conferences
attending training and so on and so
forth that allow
us to establish relationships at all
levels at senior levels at analyst
analyst levels that watch the watch
levels all those things are important
they cost time they cost money
but the establishment of a relationship
that allows effective information
exchange
cannot be discounted so eli
we know that brazil has been developing
some cyber security
and defense capabilities uh and
what are the main efforts that brazil
has developed
in recent years and that you
consider to be important for increased
cyber security maturity
and how does this contribute to
the critical infrastructure sectors
as i said in recent years several
instruments have been created
to establish guidelines for housing
maturity
and cyber security should evolve the
institutional security cabinet which is
the central
agency for policy development at the
national level has developed a series of
regulations
that ranges from the high level
information security management
to more technical standards such as the
collection on
preservation of cyber evidences
passing through the secure use of cloud
computing
that i have the the personal opportunity
to act as a deputy coordinator
in addition important milestones were
also established
such as the national security policy
which encompasses all actions that the
federal agency
agencies must take to protect not only
government
but to provide citizens with secure
public service
and the protection of the cyber
components
of critical infrastructure actors
adding some aspects
to the national policy on critical
infrastructure that has a more
comprehensive view
of the sector finally an important
milestone in the development of
of strategies is the cyber sector
was the liberation of the national cyber
security strategy
this instrument was the result of a
collective
effort between government and society
which after a benchmarking survey among
many nations
and their respective instruments had the
participation
of several representatives from many
sectors
of the federal government academia and
the private sector
and sought to consolidate the necessary
actions to evolve the sector
in next years which involves
among many actions the national cybers
incident plan
which max actively participates on
and the development of public policies
to promote
the sector as well as i can say
the development of talents to fulfill
the cyber security gap
that we have here in the country
elliot i agree with you 100 percent
uh there's a a massive gap in
cyber talent especially those those
cyber
professionals that understand cyber
security
and ics or scada iot
uh and the ones that actually can see
both sides
right so so there's that kind of gap
and that's why exercises like cyber
guardian and others
can help polish uh
those skills and find the right folks
to support brazil and the us
now i have a question for you max
so in your case max you act directly as
one of the
coordinators of the cyber guardian
exercise
which this year is in its third
version i believe so
what important results has brazil been
achieving in the context of cyber
security
and defense that have a direct impact
on the protection of critical
infrastructure
oh good question the subway guard
exercises now
is the storage edition this year and
is designed to coordinate and integrate
intelligence environments
covering public and private bodies in
brazil
verify the effectiveness of procedures
apply good cyber practices simulate
incident protection process and employ
information share tools
today one of the main tools that we have
encouraged
it's using the context of the
information share during the exercise
is the means people yes malware
information share platform
which is used within some companies in
the critical infrastructure sector in
brazil
even last month the computer side
incident response
center of the lucha burger team provide
extensive training
worldwide of unless on learning issues
and best practice in using the
platform i recommend talking uh
taking a look at the guy's website
website
as it has a lot of material available
misp is a threat information share
platform that's free
an open source software a tool that that
collect information for partners
their analysis their tools normalized
correlates and enriches the data
allows team and commodities to
collaborate with
security tools automatically protection
and
output feeds analysts tools in addition
to using misp within critical
infrastructure sector
the cyber defense command maintains
close collaboration with some countries
that make up the american cyber
defensive forum
used the miss platform to exchange and
share
information the iberoamerica involved
the
countries as portugal
spain yes argentina and other countries
it's also import import important to
highlight the brazil keeps
in the taipo technological park
foundation
a project for a hone in edge ics scada
that today has generates relevant
information on attack signatures
that has helped the taipo hydroelectric
power plant itself in the construction
of
more effective security measures and
that also be
shared with some other partners the
propose
for the future is the constructor of
disability
honest torah of the country as brazil is
a
continental continental country thank
you max
for your your answer um spot on
i i like i like where uh cyber guardian
is going uh especially how
you're taking this to the next step up
uh the next
level up uh in terms of
uh information sharing and and you know
getting the community uh together which
is just
awesome and that's just really uh what i
would like to see
uh and now i have a question for uh
john felker who who can give us you know
help us to you know connect the dots
uh in terms of information sharing so uh
john uh what are some of the ways that
these
important information sharing
relationships can be built
and fostered there are a lot of ways to
achieve the needed muscle memory that is
so important
to effective information exchange from
watch to watch
or analyst to analyst interaction on a
daily basis
whether it's based upon an emerging
threat or simply just to maintain
contacts
it is critical to regularly use the
communication channels that you have in
place
to take it to another level conducting
basic
operational drills utilizing utilizing
players on both sides
of an operational relationship is
critical
this this can enhance the flow of
information that's useful for both sides
and it also helps strengthen the bonds
of the relationship
one of the best ways to grow
relationships is to conduct a full scale
exercise
with all of the relevant people
including senior leadership
senior leaders need to know what's
expected of them
what's expected of their team and how
they can become
more effective in conducting
left of boom activities as well as
activities that occur
when there is a cyber incident in place
practicing
regular response routines whether on the
keyboard
in front of the media or in the
boardroom is critical to the success
uh your success in any uh cyber incident
thank john for the awesome comment
i fully agree with you about
leadership being involved throughout the
process and exercises
and having this understanding that
you know they're the leaders and
without their support it's just really
really hard for
things to happen at the tactical level
so
we we need more leaders with that kind
of understanding
uh so thank you so much for uh your
comment
uh this question is for max and elio
so critical infrastructure
and the key resources are important
assets
for nations and the more collaborating
to protect them the greater the
resilience
in the specific context of information
sharing
what actions could support greater
collaboration
among critical infrastructure sector
sectors or even international
collaboration
oh thank you for this question i'm very
glad to talk about this
i believe that actions that brazil and
many countries have been taking
have been achieved great results for the
development of the sector
uh the instrumentation the the
instruments that i mentioned
before the critical infrastructure
policy the national
cyber security policy establishes across
many actions to improve the
collaboration between national agents
but but international international
agencies
as well this technical and academic
exchange carried out by many brazilian
american and european institutions
as well as joint actions with
development
banks have already presented important
results
uh the national cyber security strategy
for brazil
is one of these results that i can say
uh
another one that i can say from my own
experience is the contact that we are
having with the ois
and in the course of the establishment
of our third
we will establish we have the oes and
cert americas an information sharing
channel
that uh we think that will be vital to
our success
in protecting the presidency of the
republic
likewise i had the opportunity to
participate
in the george marshall's george c
marshall
center the program named program on
cyber security students
that is leaded by the marine retired
colonel philip
lark it is an american initiative in
conjunction with the germany
government that annually trains hundreds
of professionals
at the executive level who go to their
nations to develop and
improve national instruments and
international cooperation on cyber
security
this collaboration is essential for
increasing the cyber maturity and here
in our nations and establishing
more reliable uh channels of trust
to share information uh
especially when it comes to to
consolidate channels to communicate
with critical infrastructure actors but
it also allows an alliance of many
actors to join forces
to act again increasingly sophisticated
and present-day cyber threats thank you
very much
oh over the years i have participated
in events and training aimed at the at
this
ics environment one of the things i take
serious today is
understanding the environment and
getting closer to
the operation professionals and having a
dialogue close to their speech
and one of the training that cut cuts
my attention the most was the sons one
the ics 505 given by robert emily
who is also the founder and ceo of
drago's
company in the sense material itself
will have a chapter
dedicated to to information share threat
intelligence
it's clear that the challenge today
ahead
will be multigrad greater with the
development
of the new exploits malware services
fragility in the supply chain
vulnerability in the iot environment
among
others and if you represent
a particular automation company company
if you are not the target of the time
you may suffer from the side effects
and then seeking to increase the capital
popularity of an information exchange
and share information will only
contribute
to seek it to be one step ahead of
possible threats in this way i believe
that
group cooperation agreements at the
national
international level for this type of
approach
will make all the difference in seeking
measures to avoid
possible impacts and compromise mainly
for those focus on critical
infrastructure
thank you max and and thank you elio
great response i think that you know
this question now will kind of
tie uh everything together
you know obviously brazil is a cyber
powerhouse uh in south america
and and having this relationship
uh between the us and brazil in terms of
information sharing especially when you
think about
cyber threat intelligence and iocs
and and how fast we can
we can exchange this kind of information
um you know and how uh
precise the information is you know the
fidelity
of all this stuff um all this
must obviously improve with with the
proper
leadership in place in the proper
knowledge
uh in place but i would like to ask
um john felker a question that
like i said i think it's gonna tie these
things so as
uh systems evolve more and more
interaction
between i t and ot takes place
that's that's the reality folks so what
are some
some things to think about in these
circumstances in particular information
exchange between brazil and the us
go john when one device or control
system is compromised
it can impact many others control
systems
are effectively systems of systems that
are increasingly more interconnected
with business systems
the itot connection there are many many
incidents that occur in control systems
probably on a daily basis that just
don't break squelch
control system cyber incidents affect
all industries
manufacturing buildings transportation
electricity water to name a few
i think a close review of these cases
would indicate that malicious incidents
make up a significant percentage of
control systems cyber incidents
in terms of numbers and impacts as i
mentioned earlier
sharing incident information between
partners is one way to address these
potentially
vulnerable interconnections i think also
that participation in focused ot
training
like that provided by says at idaho
falls would be a benefit to many of the
cyber professionals
that have for years focused on i.t
only and they don't understand the itot
connection
and the potential vulnerabilities that
exist as a result of that
i think also using training and
exercises to build relationships between
brazilian
and u.s partners in government and in
private in the private sector
is critical to effective information
exchange
so the ics village uh simulates
ics environments and they really truly
unique
in what they do uh tom van norman
is the actual uh co-founder of this
awesome
ics lab and non-profit organization i'm
sure
you've seen them at def gone and it's
just such an
it's such an amazing village and and the
opportunity to learn about ics
uh through the ics villages is quite
incredible
so i have a question for uh for tom
so tom uh would you please tell us
how you envisioned the ics village
supporting
brazilian and american national security
in terms of information sharing please
thank you paul ics village's mission is
to provide industrial patrol system
security and awareness through community
engagements and information sharing
by advocating for the sharing of
information between governments
companies
organizations or among individuals
everyone's security posture
will be greatly increased however when
information is shared it also has to be
in a format that is
easily understood by the receiving party
this could be
education indicators or compromise or
iocs tactics tools and procedures or
ttps
intel reports and any other relevant
information
if you were an operator of a critical
infrastructure asset
and were compromised in the same way
another asset owner
was wouldn't you have liked to known the
iocs or ttps ahead of time