hi everyone
my name is lauren zabrik and i am the
executive director
of the cyber project at the harvard
kennedy schools buffer center
first i just want to thank bryson bort
and the entire ics village
and team for inviting me here to discuss
our paper
entitled toward a collaborative cyber
defense and enhanced threat intelligence
structure
i want to start with the story just to
paint the picture you know what
how this is really informing my thinking
i spent over a decade in the united
states intelligence community
and a big chunk of that where i was an
analyst working counterterrorism
the group of analysts that i was a part
of developed an entirely new methodology
that at its core suggested that all data
no matter when it was collected or from
what sensor it was collected is
important to identify malign activity
from the benign
this mindset combined with leadership
who removed
bureaucratic burdens such as arbitrary
reporting requirements
let us be analysts and figure out the
hard problems and
you know isn't that what we all want as
analysts who want to be empowered to do
that
doing so allowed us to become very
entrepreneurial in our work
we made relationships across the
community offering
our cutting edge analysis for access to
more data
and even creating our own
forward-deployed spart spots to make
good on those relationships
and to continue the mission in this
setting
i deployed overseas multiple times
sitting side by side with analysts and
operators
in joint operations centers or jocks
where
everyone was free to share information
with each other and where we all had
awareness of the battle space
because of the nightly operations and
intelligence briefing
this is where i first became acquainted
with this model that i described in the
paper
which is best highlighted by lieutenant
general stanley
crystal's motto where he says it takes a
network to defeat a network and that's
the whole crux behind this paper so say
what you will
about our overall strategy in iraq and
afghanistan
from a tactical intelligence and
organizational standpoint
i think we're innovative and there's
some really important
organizational lessons learned here when
i came to the cyber world in january of
2016
i was fresh from government and fresh
from this whole environment
and i watched organizations try to build
up their
own cyber capabilities threat
intelligence capabilities
operating on slim budgets and really
trying to figure out how to
defend themselves in during amid rising
cyber threats
largely without government involvement
and i just remember thinking
there has to be a better way now i want
to be very clear here
i know there was recent pushback over
conflating cyber and ct
and and while there are some distinct
differences you know and some
um areas of similarity you know it's
it's the intelligence
and the organizational concepts that i'm
really trying to carry forward here
i think our current threat environment
demands the need for
more collaboration increased
collaboration we're witnessing
increasing ransomware attacks and
intrusions into our critical
infrastructure by both state
and non-state actors with increasingly
sophisticated capabilities and sharpened
intent
and so the strategic vision set forth by
our president and his senior cyber
leaders
is truly critical to helping us become
more secure and resilient
but to operationalize that vision we
have to ensure that the structures and
the policies
to facilitate that collaboration are in
place and
um as we know there they've been lacking
so this is my idea to create those
structures and policies kind of like
if you build it they will come now from
there
you obviously need strong relationships
between people and
even better ways to operationalize
intelligence and this paper doesn't
exactly address that
but i will make a quick plug for share
the mike and cyber which
in october we're going to be really
focusing on those
human to human tactical relationships
for public-private partnerships
so is this a perfect answer i don't know
but it's a conversation starter
and there's some new ideas in here
building on some existing ideas
from other people um so i'm really
excited to talk to you about this today
so first i want to go over how we did
the research and what we know
about the current state and that'll go
into our five recommendations and wrap
up and await your feedback
we conducted research and interviews
starting back in november of 2019
and we wanted to talk to people across
the entire ecosystem we did
we spoke with people at state fusion
centers
in national labs people who were still
in the federal government or who had
just left
people from sizza the department of
energy the intelligence community the
fbi
we talked to people at isaacs and i sows
we talk to people in various private
sector companies
especially threat intelligence analysts
both large and small
and and some even in the critical
infrastructure sectors
we wanted to map the current state and
an
earlier version of this paper has 20
pages dedicated to the subject but we
cut most of that out for length because
we want people to actually read the
paper
but our thesis was that our current
environment
across the domestic landscape is um
it's very stove piped and uncoordinated
and as you know
it leaves the analysts and the operators
overextended
you're all exhausted um and it's not
getting much better
and and of course our critical
infrastructure remains vulnerable
which was born out of our research now
we know that for defense there has to be
a layered approach between
the diplomatic community the military
and the intelligence community of course
regulations um and this paper doesn't
address that it's really just focused on
the nature of our collaboration and
threat intelligence sharing
um so take that for what it is
we looked at the landscape through four
different lenses
cultural organizational legal and
technological
and it was part of my hypothesis from
the outset that these
were where some of those barriers were
to effective collaboration
as we know domestic cyber security is
really
hampered by limited resources talent
data
funding there's a siloed approach and
even
especially at the state and local levels
an emergency management law enforcement
approach
which isn't necessarily a bad thing but
um
doesn't really lend itself to strategic
whole of nation um approaches to the
problem
um the private sector is responsible for
their own networks and their own data as
you know with varying levels of maturity
and resources
and similarly the federal government
suffers from
swim lanes budget limitations paperwork
requirements
to to actually work with the private
sector
classification issues there's a lot of
trust issues between
public and private and you know this
this thought of well
if i'm going to work with you what am i
going to get out of it so a lot of
entities thought they weren't really
getting much out of that collaboration
um not one person has been able to
really hammer this out between the
interagency
and you know engaging with the private
sector um on
from a holistic standpoint and
so to us the fundamental challenge is
that the structures the policies and the
incentives
are lacking the relationships that do
exist are largely ad hoc
and they're point to point there's no
clear operational picture
of the entire threat landscape or
again a coordinated sustained
strategic approach to really address the
issues
we really lack a comprehensive
understanding because we aren't
collecting
processing and sharing that data that's
out there in a coordinated manner
so before i jump into our five
recommendations
i want to read you a quote from team of
teams by stanley mccrystal
where he says organizations must be
networked
not siloed in order to succeed
specifically we restructured our force
from the ground up
on principles of extremely transparent
information sharing
and decentralized decision-making
authority we dubbed this goal the state
of emergent adaptive
organizational intelligence shared
consciousness
and it became the cornerstone of our
transformation that quote right there
is really just the driving vision
for um the the structures and and the
policies that i described here
so um restructuring um
transparent information sharing and you
know at the
different level uh level decentralized
lowest levels making those decisions but
still having that that common thread
across the whole landscape so our first
recommendation
to actually create those structures is
to
take something that exists now and
transform it
and what we're recommending is taking
the current
scissor regional office structure
so they have 10 regional offices right
now
and they are staffed by
from what we could derive a handful of
people they're more advisory posts right
now
but what we are recommending is to take
each of those offices and
just build them out creating making them
bigger
outfitting them with all you know
a number of workstations and
common communications across across all
these nodes
and we're calling them or we want to
call them the
collaborative defensive and analysis
centers or
cdx so mirroring the jock
sorry the jock construct
but you know we don't want it to be over
militarized
but in this setting analysts
and operators would sit side by side
analyzing
sharing cyber threat intelligence
providing early warning across the
ecosystem
and coordinating defensive actions with
stakeholder
organizations and mentioning the
stakeholder organizations people may
think well
who has a seat in the cdoc
obviously not everyone can have a seat
in in the
organization and of course it is
incumbent upon the different entities
um staffing levels whether they can send
somebody or not but at a minimum
we're thinking people like
representatives from the fbi
representatives from cisa
representatives from the state
fusion center so the states that are
operating in that region
the different isaacs and i sows
especially ones that have a heavy
presence in the region
um different private sectors companies
both big and small but especially ones
in the critical infrastructure sector
so bringing all these analysts together
and also giving them
the ability to have reach back
capability to their own organizations
for
additional analytic support and um any
sort of
defensive um actions
a lot of people have asked well why
regional offices we think that they're
key to this vision because they offer
that physical breadth
for the mission and a field office touch
point
um for businesses and and states
operating in that region
we think a structure like this would
ensure a sustained government-led
coordinated presence
in all regions of the country but to
combat the threat on a local level
something that i've heard called
reaching communities
and highly distributed ways
um and having intrinsic understanding
of the entities in that region i think
is really important because
um there's just different needs and
different
realities on the ground and then of
course every day or night
we think there should be an
enterprise-wide operations and
intelligence briefing that everyone in
the cdac could
observe and gain situational awareness
um
you know the analysts would share
strategic intelligence operators could
debrief
incidents and you know note any major
reflections from those activities and we
think this would be the thread that
holds all the different nodes in place
and continues to build that connective
tissue
our second recommendation is to scale
voluntary data collection and processing
you can't really have this structure
without the data to
to go through and to really provide that
foundation for
enhanced analysis so collecting more
threat data
and processing it and by processing i'm
talking
indexing applying analytics minimizing
it so stripping out all of that
personally identifiable
organizationally identifiable
information
to detect anomalies to create that
common operational picture
and then to ensure that it is shareable
at both speed and scale um
we have the information out there you
know that it's it's in
all these different networks it's with
companies it's with government
organizations cloud service providers
isps etc but we need to get this data
again this anonymized data into the
hands of analysts to really drive
those operations and you may be asking
ourselves well don't we have
systems like this in place with say
scissors
automated indicator sharing system or
does crisp
yes however while they can be
or they should be very foundational and
and help to provide early warning across
the system they're just not
or at least ace isn't uh to a point
where
they can really do that yet so
they both of those programs need to be
upgraded as far as their technology
and increased in scale so for instance
in september of 2020
the inspector general released a report
that noted at least in 2018 only
219 private sector organizations were
members of ais
and those who did participate found that
the information
that they were getting just really
lacked usable context which as you know
is just not you know as helpful as that
could be
um the the program itself was
understaffed which really limited
outreach to the private sector and the
whole
um you know where dhs is really seen as
a regulatory agency i think a lot of
organizations are very reticent to
participate that in that and so
we need to change some of those policies
and increase some of those
incentives so to get
wide wide scale voluntary participation
we think
uh a number of things should happen so
first
ensuring that anonymization or or
minimization so again stripping out that
information that we don't need that is
personally identifiable or
organizationally identifiable but
stripping that out making that automated
but but even further than that
is to put that burden on the solution
so instead of having every single
entity who participates to to have that
as their responsibility it has to be on
the solution
and that's not only from a legal
standpoint but a technological
standpoint too
access controls based on authorities um
applying analytics and indexing this
data again to be
instantly shareable um and you know
maybe it's through
a data lake or maybe it's through the
notional joint collaborative environment
that the cyber solarium commission
recommends either way
but you know to create
these analytics on top of the data to
help analysts
um to free them up to do the higher
order analysis
and to essentially triage um
and you know couple i mentioned the
legal aspects of the cyber security
information security
or infrastructure security act of 2015
you know should be amended to
help facilitate the sharing so again
um taking the minimization burden and
putting it on the solution and really
the government
to do that and then
removing the limited liability clause
that
limits private sector protection so
essentially adding more protection
to the private sector entities that
participate on there so it doesn't have
to be
just sharing with dhs for instance
um so and ensuring that the incentives
are there the business cases are there
but making it easy for
people to say yes to do this um
so with that i will turn to the next
recommendation
to create a culture shift and again i
will read you
another quote um i think from team of
teams it may be from
[Music]
my share of the task but mcchrystal said
that in the world of intelligence
information was power leading people at
each stage to ask themselves a set of
questions
should we pass this intelligence if so
how much will we get in trouble for it
those doubts cost us speed and often
diluted the intelligence making it less
likely to lead to targets
we widely distributed without
preconditions
intelligence that we captured or
analysis that we conducted
the actual information shared was
important but more
valuable was the trust built up through
voluntarily sharing with others
and that i think is so key um because as
we've seen
the the trust really needs to be built
up between
the public and private sectors um trust
as well as again those those structures
and policies
so much like the task force in the early
2000s
i think that we need to make a major
cultural shift in
our domestic cyber security posture a
lot of interviewees told us that there's
a big disconnect between the field and
washington dc
so they may ask questions to certain
representatives and it would just take
forever because they would have to
root those questions back to dc so
really we have to flip that mindset on
its head promote this expeditionary
culture
in which um a lot you know the major
activities happen in the field
and dc is the reach back office for the
federal government and in fact
chris krebs the foreigners as a director
has said the future of says that is in
the field so
along that that line we think this could
really um
be an interesting solution
and then to incentivize people
to to buy into that then we recommend
tying the ability to go out into the
field if you will
to promotions bonuses and raises for
instance
and then we need to really create a
culture in which sharing and
collaboration is the norm and not the
exception
and the way to do that is for the
leadership
to set the mission the priorities as
well as the conditions
and the infrastructures technologies etc
to do so
but also to build that connective tissue
between the nodes and ensure that people
are executing in line with those
missions
to help do that um for example
we need to move from say metrics
as measures of effectiveness metrics and
numbers say reporting
reports created to analytic outcomes
so in my experience organizations that
mandate a certain number of reports um
at that point collaboration and
information sharing then
becomes not the goal but an inhibitor
to creating those reports so where the
leadership removes those burdens of
production
from analysts and instead focus on those
hard
analytical outcomes and subsequently
operational successes
then your personal become more
entrepreneurial and innovative
and most vital to realizing this
is personnel from leadership on down to
the
most junior levels everyone has to be
welcome diversity is key
focusing on those people but ensuring
that they're
they're welcomed and they're supported
and really focusing on diversity and
demographics
background and experience our fourth
recommendation
is to unravel the interagency
in our research we discovered that the
interagency cyber environment was really
characterized by competing equities and
priorities and
up until the creation of the national
cyber director
not one person was really only are able
to unravel that yarn to determine those
priorities and who
arbitrates among the interagency um
uh you know the equities the
classification battles and then
as also as they are coordinating with
the
private sector so with the creation of
the new national cyber director role
it appears that the deputy national
security advisor for cyber emerging
technologies under
and new burger will handle title 10 and
title 50 cyber issues so more on the
offensive side and the ncd
will be responsible for the rest of the
interagency
and engagement with the private sector
so on the defensive side
from a strategic standpoint while in
continuous coordination with each other
and this distinction is important we
recommend
that the president really
imbue the ncd with that authority to
ensure that the director can
determine those priorities and and
hammer out those conflicts because
when congress set this position they
really gave the president
some some wiggle room on on how to
actually shape this role so we're really
hoping that the president can really um
give that role the authorities that it
needs on par with
the the counterpart at the nsc so in new
burger
so where andrew berger and chris english
set that strategy
the other agencies and especially cesar
will operationalize it
given the agency's importance and its
relatively small budget
and the recent political political i
can't say it politization
we echo the call forces independence
from
dhs we believe that it would give
greater authority
bigger budget more operational
flexibility to an
agency that just really needs it right
now
we think it could provide greater
flexibility in hiring practices as it
looks to scale up and out
and informally we've heard you know some
frustrations there
so we believe that it would also allow
for
reform of the sector risk management
sector risk
management agency construct that i'll
get into in a second
but with sysa as its own freestanding
agency
we are recommending that it establish
its own intelligence arm
becoming the newest member of the
intelligence community
that way the office can work with the
different cdx to inform
the intelligence collection requirements
and priorities
because at this point there's no real
institutional mechanism
for um to inform the the
collection framework despite
a lot of those threats really focusing
on the homeland
so on the srmas
we think first that ppd21 should be
revised to enhance collaboration and
sharing
across all sectors and entities so
transforming the focus from a sectoral
approach to a cross-sectoral
mission focused and collaborative one
and then second
if you could take those missions to
collaborate
and share information with the private
sector that are currently on each of the
srmas so
think dle think um tsa
for pipelines for instance instead i
think you could
transfer those missions to cisa but
really
operationalized at the cdx so again at
the cdac level then they would
be the ones taking care of sharing that
information and working with
their constituents basically in the
private sector
our final recommendation uh it really
focuses on personnel
we often read about the gap between the
number of open jobs and cyber security
and the number of
quote unquote qualified personnel
according to cyberseek there were over
half a million open jobs in the us and
we currently lack the personnel to fill
them
the pipeline is always going to be an
issue
there are a lot of people who are
looking to get into this career field
they're working towards this employment
but for a variety of reasons they're
they're finding it very difficult to
make that jump and
and one of the biggest reasons and and
there are a lot we won't go into them
right now but one of the biggest reasons
is that a lot of jobs even entry level
jobs
want their candidates to have experience
so how can you get experience if you
can't get in
and a lot of people are you know even if
they're able to overcome those high
costs
of training and certification to make
that jump has
has been very prohibitive and so to
bridge that gap we're proposing
a service here in which a person
interested in this field could
say receive training and support for
certification in exchange for at least a
year of service
at one or more of this is a
regional sea docks for instance but
really getting that critical boots on
the ground experience
now this is not the military you're not
going to have to get up and do pt you're
not going to have to deploy overseas
it's just this is your national service
in exchange for training certification
you're getting that experience
and then importantly too i think it
would really help to
to fuel civic renewal which is something
i think we desperately need right now
but uh you know to make this happen um
the president actually signed a law
the american rescue plan that included 1
billion dollars for national service
and so we recommend that the white house
establish this interagency service corps
um between now dhs but if says it
becomes its own regional
um uh freestanding agency then something
like that for instance
and and you know eventually maybe
include other agencies as well
but um in in cooperation with the
national community service organizations
to create those opportunities to create
those pathways in
because as we know we desperately need
people
and then on the other end of the
spectrum you know to to raise the level
analytic capability across all federal
entities
and to get people who are very
interested in cyber but who haven't
really found those pathways over yet
to create those opportunities for
analytic exchanges between the agencies
but especially between
cisa fbi and nsa and so we think that
it would sort of raise the level of
capability it would provide vital
experience and training
but also build that connective tissue
and that trust across the different
interagency elements so thank you so
much for
hanging in with me i know that was a lot
to digest
but i'm really thrilled to be here and i
really look forward to your questions
and your comments
so thank you very much