thanks everybody for being here with us
today
uh we're thrilled to be uh doing this uh
great panel here at defcon
uh with the ics village thanks to bryson
board for inviting us to do this my name
is jamil jaffer i'm the founder and
executive director of the national
security institute
at george mason university's anson
scalia law school we're thrilled again
to be here to talking
talking today about uh the topic your
infrastructure is encrypted
protecting critical infrastructure from
ransomware we have a terrific panel of
folks with us today
uh sort of going around the horn uh from
my left to right
uh we've got jen detroni the general
counsel at niceos a managed intelligence
company
helping enterprises identify adversaries
and related threats
uh jen has been uh has volunteered uh
for
every year at defcon for a number of
years uh she's been a federal prosecutor
she's run a solo law practice
and worked in a top law firm practicing
commercial law when she's been at defcon
she's been teaching kids how to be white
hat hackers
uh through a non-profit um and she's
been a member of the executive
leadership team and son law and
nonprofit organization
uh dedicated to helping advance female
and house counsel i mean she's a
graduate of dartmouth college of
michigan law school
and she's grown up in the dc area but
she calls southern california her home
now so jen thanks for being here with us
we also have uh ernie bio ernie is an
investor uh with forge point capital he
is uh previously served as the chief
operating officer for the defense
innovation unit at dod
a government startup in the silicon
valley um he's a board member of
huntress labs and and aboard a
board observer at bishop fox now
securing bayshore networks
he has an mba from nyu stern school and
a bs and seller of molecular biology
from loyola university so we're thrilled
to have you here ernie he's an avid
surfer guitarist and music enthusiast
too so uh keep an eye out for that
and last but certainly not least we have
david attu a good friend of mine
he's the chief executive officer at niso
he's got 20 years of experience
at early stage of mature companies he
previously served as the global head of
managed security services at blue voyant
and the vp of managed services at rapid
seven who's the vp obedient gemalto
um and is now is now part of was also
part of
lead the cyber student press at prtm
which is now part of pwc he's had a
number of other awesome positions
he's also a certified information
privacy professional a certified
siso and a graduate of ge's information
manager leadership program so dave great
to have you here with us also
so folks we got a great panel and off we
go to the races so i'll start with you
jen
so you know we've heard a lot about ran
somewhere in the last few weeks and
months we've seen
uh the attack on the colonial pipeline
we've seen the attack on cassaya
we've seen a variety of things jbs the
meatpacker um and we've seen the buy
demonstration do a number of big things
in including two now executive orders in
a row talk to us about what those
executive orders do
you know you're a lawyer or maybe a
recovering lawyer at some point um
talk about whether those executive
orders are gonna be are going to be
effective at
helping protect the nation from
ransomware and if they're not
uh what what are they doing that's
helpful and what more needs to be done
yeah great question and and thanks for
having me and also thanks to ics for
having us this is a great panel
um so yeah i think what's interesting is
that we're seeing
a lot of leaning into the situation um
from from that level and that is very
very different than what we've
seen in the past um i know in the past
we've looked at
things in a task force manner here we're
seeing dhs actually
kind of pushing through in a manner of
sprints and these sprints are really
meant to address
issues that are topical um they're not
going to kind of get to the bottom of
every issue but they're
forcing the industry to look at things
kind of in a cadence
um recently we've seen the ransomware
sprint that came out
um that was april and may but right now
i think we're in the industrial control
systems
sprint and that is a very critical one
because as we saw with the colonial
pipeline
um it is very important that we protect
the country against like
any sort of infrastructure being shut
down and that's where i think you know
this panel has
some great topics ahead of it because
we're looking at how
it's that it's a public private
collaboration i think that is very novel
in this approach
um as somebody who's kind of practiced
in both areas i think it's
really heartening to see that that sense
of collaboration it's always been there
right i i with law enforcement you know
there's kind of the sense of kind of
poking around to see who's friendly
now i think what these executive orders
are doing is basically saying
start talking right and so with this
sense that xero trust
is going to be the overarching like
theme of private and public sector
um and with some definitive controls
around trying to
require two factor or multi-factor
authentication
um trying to segment out networks there
is
that both both private and public sector
are meant to get better
with this approach and it's kind of fun
to watch yeah
so david you know you've you've been
doing some stuff operationally
right uh back in the past in your time
at uh at uh rapid seven
um and blue voyage talk to us about some
of these uh some of the sort of the the
operations
we should be thinking about in the
context of what's happened with colonial
pipeline what happened with jbs
what happened with cassaya right and
then these executive orders and sort of
you know
uh jen's obviously told us about about
the fact that we're looking
at at least the government's gonna move
to zero trust i think the the planet is
talking about moving to zero trust
right is that the answer is that is that
the solution right
is it one of the pieces of it is or are
we heading the right direction and and
and if so great and and how can we do
more if not what would you be doing
uh from an operational perspective if if
you were running the show today
well first i think you know one of the
challenges we have to step back and
realize
is that you know we we've accrued due to
20 plus years of technical debt in
time on the internet and you know i
haven't seen anything from the private
sector or public sector that's going to
uh
pay down that debt overnight and so i
think yeah the first acknowledgement is
that we're
we're working from a deprecated position
and um and i think what's been
challenging
ransomware is i think we've we've always
thought about uh you know critical
infrastructure
as you know from from state sponsored
actors of you know what happened if
there were you know a
uh a combination of cyber kinetic action
where
uh you know the a a state actor wanted
to disrupt our
uh either as part of a an overall
catacore or for economical reasons
disrupt our infrastructure
we didn't really think about the uh the
financially motivated actors and
and the components that come with that
so i think you know the the
the difference between the state actors
and the financial motivated actors these
the financial
actors a lot of the basic blocking and
tackling stuff you know
does start to make a difference that
does raise the bar so you know
segmentation two-factor authentication
um you know i i i i do think you know
there there is some degree of hygiene
that we either have to figure out how to
uh how to motivate and whether that's
motivation through
you know i think we too often follow the
regulatory stick of like well someone
should get a rule that you must do these
things
uh perhaps there's other ways to uh to
drive
um the carrot uh to motivate folks or or
you know one of the things hopefully
chat about later is i'm kind of
i'm bullish that the insurance industry
can have a role in helping us fix things
here because if you
if you don't hit a base level of
capability you know if if you're
if your stairs you're building aren't
safe you can't get insurance and there's
no point where
where that comes so i do think on the
operational side we have some
some basic block contact when you get
done and whether that's you know uh
not you know not exposing you know not
running five-year-old you know
versions of microsoft exchange that have
been out of maintenance for five years
uh or uh you know two effect
authentication you know
network segmentation some basic data
security i think those will go a long
way
but i think we have to acknowledge that
um there's you know this tech debt is
is built up that uh we're we're not
gonna paint on overnight and
how do we motivate folks to do that and
you know get either
get the right solutions in place or you
know spend a lot of time
running uh security operation centers
serving small medium-sized clients
at least get them to a point where they
can detect and respond uh
in a faster period that's again given
what's out there that's not a uh
simple solution overnight but uh like to
like you know
like just i think we've got some good
things making progress some of the
recommendations
so ernie you know it's crazy uh both jen
and david have talked about two-factor i
think or multi-factor authentication as
being sort of one of the things that
that's being pushed now it's kind of
crazy that you know we're here we are in
2021
and we're still talking about
multi-factor authentication it strikes
me as as nutty but you have a
unique perspective right at forge point
capital and full disclosure forged
capital is an investor and a company
that i work for iron at cyber security
um but uh but at fortnight capital you
you help run one of the largest
uh or the largest cyber security
specific fund uh in the gl
in the world uh talk to us about you so
you're looking across
all these sort of all these potential
investments talk about what the right
plays are right now like what is the
what are the game-changing plays that
you all see uh in cyber security
what are the what are the sort of the um
the hot
ideas out there zero trust is one that's
obviously that we've already talked
about
briefly um that we mentioned tell us if
there's some some ideas that you're
looking you're looking in that space
um you know obviously iron it does
collect a defense right that's an
interesting idea
what's what are the hot ideas in your
mind out out in the outcry as you look
across
the spectrum when it comes to grappling
at this sort of ransomware
and a related question given your
experience at diu
and bringing that to bear forge point is
there is ransomware sort of a unique
thing that we need to be focused on
specifically
or is it just a component of this larger
trend of malware
coming from both nation state and
non-nation state actors
yeah no great great question um to
answer your second question
it's it's uh it's just a continual
evolution of
of malware and uh from an investing
standpoint we we kind of look at it
from you know think of it as continuous
attack surface
uh testing as well as extended
xdr extended defensive response and we
look at
it from an investment standpoint network
so how do we restrict lateral movement
so you mentioned rnf but there's there's
the network piece
there's an email protection piece
there's dop hopefully next gen dlp is
what we're looking at
not the dlp that service one percent of
the market
uh threat intel on the endpoint side
obviously you have the edr players
right did the cried strap crowd strikes
out there you also have smaller company
you mentioned huntress early i'm on the
board hunters
they do mdr for the smb the smp smb
is uh has been a right target for
ransomware because
they have msps who are their i.t service
providers
they don't have the sophistication the
cyber talent nor the budget so how do we
defend them
how do we leverage dissection privilege
access management
right and then moving left app security
testing
so everything from traditional sas to
sca
to dast uh fuzzing you name it
and then the other piece is identity
we've made a lot of investments in
identity
as i'm sure david and jen can attest to
its identity
there's a lot of debt there there's a
lot of legacy
so how do we you know start thinking
about
uh monitoring entitlements how do we
manage identities
across multi-cloud uh how do we
potentially use passwordless
authentication
uh identity proofing and then obviously
mfa should be
table stakes so that's kind of how we're
looking there's no silver bullet
it's this composite solution which will
hopefully get your cyber hygiene up
yeah yeah so so jen uh one of the issues
that's come up in this conversation is
this just cyber hygiene right and the
need to sort of
get better at the basics right we've all
talked about that for a long time the
need to
just sort of get that bottom level
protection up so that
you're making the attackers work that
much harder right and one of the ideas
that
that david put on the table was this
idea of insurance right that somehow
insurance might be able to help us raise
the bar on cyber security
right a lot of people you know in
washington dc uh or
where i think at least a couple a couple
of us live david i know lives down the
street from me
um in the washington dc metro area um
you know in in dc a lot of the talk is
you know regulate right or as david put
you know put on the table you know that
we need some sort of government
intervention right or maybe
you know if we just pass enough laws or
we get the ftc or the fcc involved
uh it'll solve everything right but this
idea of insurance i think is interesting
to me
do you do you have a sense of how
insurance like might sort of come to
bear
on this problem um and and in particular
can assure us help can insurance help us
get better at the cyber hygiene piece
and can it do more than that yeah i
think so i think so i mean
david and i don't have any skin in the
game but this is something we've
observed over time but i mean just like
just like getting good drivers out on
the roads right like there's a concept
that you've got to have a vehicle that
meets a certain standard
and a driver that set a certain
competency like that that is who you
will ensure to drive
same same with the insurance industry as
it relates to companies right like
they've
that you've got people sitting on data
that doesn't belong to them
and so how are they going to be the
responsible stewards of that data
right how are they going to ensure that
at these smbs who have a hard time you
know scaling up
have the appropriate security measures
in place i think it's all about
standardization and compliance
those insurance companies can push
requirements down on companies
to get them compliant in a way that the
government won't be able to
right it's a matter of doing business
and so i i think
you know we've seen some insurance
companies who are kind of pushing
towards that but that standardization i
think will come
from that from that lateral movement
into industries because they need
insurance no company is going to operate
you know without that and so to get that
you're going to have to
level up and i think that leveling up is
is what a lot of us are here to talk
about today which is
yeah it's more than just you know those
those few things it's so many things we
can't even
describe them all but uh i mean even
even like the cloud migration
i mean i mean we talk about you know at
nissa's we talk about the fact that like
if the cia can get
you know everything up in the cloud
right and they're classified stuff
right it's pretty amazing yeah they had
a hard time so like so so
i think it's just a matter of shifting
the mindset around some of that stuff
and a lot of that is going to be kind of
pushed down again
maybe it's maybe it's partially
legislation maybe it's partially from
you know the folks who help businesses
run like insurance companies
but i think it's a i think it's a team
sport yeah so ernie from an investing
perspective
yeah sorry david do you have something
i'm sorry go ahead go ahead
that was me oh yeah mr ernie so from a
you know from uh from an investing
perspective how do you see
sort of one the insurance marketplace um
and that and that driving
cyber security how do you see actually
the venture investing space or one of
the things i've always wondered about is
how the venture investors aren't saying
to their companies hey look you need to
protect your own assets literally all
we're investing in
is your ip if that's not well defended
you know we're sol
right help me understand sort of you
know what's the right players
are the plays of the insurance space are
there plays in the in the investing
space and and
and if yes or no to those do we need
legislation do we need
regulation like what if you know sit
down in silicon valley i know the
general view is
you know government can stay out there
that's great and i think that's
generally been how it's how it's
happened
but there is a push now for the
government to get more involved in
what's happening in the valley
how do you see that and then what's your
sense of it yeah
you know we're seeing um a lot of cyber
security mgas so
managing general age agents uh you have
the coalitions out there
at bay resilience insurance and their
models are all a little different some
are approaching
the s and the smb some are doing upper
mid market
uh but what they're all doing in
different different levels is
doing security scans before they write a
policy
and during the course of the policy some
are looking at hey how do we do
difr on the back end how do we
keep the hygiene up because at the end
of the day in the cyber business
it's about your loss ratio so if they
could keep the loss ratio down it's more
advantageous to them
and then it becomes this kind of um
you know ooda loop if you will with the
customer
um they're right they're writing more
premiums the loss ratio is less
cyber hygiene's going up especially in
the smb
uh and you know everyone's everyone's
happy uh
theoretically um so i i think that's a
great first step it's very early days
in that industry but there's a lot i
mean look at the amount of funding
that's going in
uh i think appa just just announced 185
million round yesterday or today
so it's uh as far as the government
coming in
i think the government should get their
their own house in order first
right uh like you know quite frankly and
you know follow the executive order
obviously with jen easterly at cesa
right uh in new burger and in the white
house like there's some really a
players uh and um at the end of the day
it's shared responsibility so
let's get our own houses order and then
share information
uh which uh you know i'm sure you you've
lived that
um that hardship right because the
government never wants to share they
don't take any information you give
it's hard for them to share right right
yeah
yeah i'm a huge fan of you know the
coalition and resilience and those
models that you know the
the cyber insurers being more um uh both
more data driven
and more uh you know and providing
frankly you know
in some ways light managed services on
their clients behalf
really raises the bar and and and yeah i
think it's it's not just
in the fact that of the insured i think
you know
what what i'm hopeful for is that they
have the ability to bring people who are
not currently insurable
into the market uh which is a you know a
huge change in our
in our base cyber hygiene and so that
that uh
that you know finding ways to help
people get insurable
is a uh is a big deal well you know
david on that point you know one of the
things that governments have done when
we're talking about you know car
insurance and the like is they sort of
require
insurance companies to take on some
amount of managed risk right some amount
of sort of
you know the 18 year old me driving
around you know nobody nobody wants to
insure that guy right and so
so uh you know there is there are some
some earlier models for that
but i have a sort of a related question
you know one of the things that ernie
mentioned
uh was this idea of of you know of
companies coming in and trying to figure
out
you know what the problems are before
they go in right whether it's with an
investment
we've heard a lot about this in the m a
space right with insurers right
sort of assessing companies from the
outside sometimes from the inside right
we've there are a lot of companies that
have created businesses
out of doing that type of assessment
i've always wondered how
sort of capable those assessments are
right is it really realistic to be able
to tell
how vulnerable a company might be from
scans you do from the outside or the
scans you do from the inside
right and you've been at service
providers that have come in both before
and after the fact to try and figure out
you know what these couple
what it looks like do you have a sense
of whether particularly from a critical
infrastructure perspective and
from a vulnerability to ransomware or
frankly any type of malware it's you
know in a lot of ways
ransomware's simply an example of that
right can you can you really tell
that from the outside in or from the
inside out and if so yeah is it a good
measure for insurance and
m a and you know diligence for investors
yeah i mean so so uh for the city yes
and in full disclosure that's the
business that these
is in today but i i didn't know that
yeah
but but let me tell you why why it works
that's what the adversaries do
uh you know that that uh if you know
that you can you can have
you can take the perspective of the
defender and and uh
and dig in um but uh they're you know
that's what the adversaries do
and it's working for them so they're
testing their testing from the outside
to see who's vulnerable
and as a result sort of that's what if
we do that we can get a sense for it too
is that your point yeah yeah i mean
that they're you know they're they're
using showdown they're using you know
that the
the other they understand what's
vulnerable um you know i
i think you know the the thing from a
service perspective side i think the
thing that where people
get uh get very big challenges but and
particularly when you talk about
insurance or
um you know or supply chain things is
that some of the
you know it it's very hard to identify
the um
you know the the true external foot
private organization and so
we have actually one of one of ernie's
uh companies bishop fox actually has a
has a great offering here too is i think
what what everyone has the story of a
supply chain scorecard that you know
had some got some terrible score because
it included their guest network or
franchise or those things and so
you know the the chat yeah i think the
challenge to it is doing it well
uh but um but i think again our our
adversaries are doing it well it's like
hey i
i'm looking for you know i mean they're
they're going hey
i'm looking for things that have this
you know this known vulnerability that
they exist in this space
for an organization that i think has the
capability of paying this ransom
uh that is it that is in a country that
either doesn't have judicial reach to me
or um you know or or you know law
enforcement action that uh
that would prevent this and so they're
clearly doing it
and i think you know we we have to
leverage that same you know intelligence
capabilities
uh uh ourselves but i think the
important thing is doing it responsibly
you know doing it and
giving you know giving someone a you
know a bad grade
publicly is not uh i don't think it's
gonna help us where we
where we need to be right fair enough
fair enough so no name and shame unless
it's unless it's the chinese of the
russians not foreign
yeah and yeah look there's there's a
point where you know
you you need to be a certain height to
ride the internet but over there we got
we got to realize that
no one's ever going to be perfect in
this and that we uh we got to figure out
how we
again how we motivate not uh not just uh
penalize fair enough so jim one of the
things that david just talked about was
this idea of sort of supply chain
vulnerability right we've seen
this has become a really hot topic i
mean it's been a hot topic for a long
time
but it's gotten really hot in light of
this ransomware attacks in part because
you know people think about you know
what happened with solar storm and the
fact that was
a supply chain vector and now with
cassette that's supply chain vector
right people also concerned of the
downstream effects of of an attack on a
thing like colonial pipeline right
and that has sort of spillover effects
that's not quite a supply chain that's a
slightly attack
but it shows the sort of spillover
effects and then of course the kova 19
pandemic and
we've seen the vulnerabilities in
america's supply chain are dependencies
on on certain foreign countries
including adversaries like china
so jen help me understand you know from
a from a
you know sort of what the government can
do perspective right um and what
or at least what what you know
legislation might do to help address
these supply chain threats one of the
things
that's talked about in the executive
order right with respect to federal
cyber security
is sharing of information between
private sector actors contractors work
for the government right
requiring them to share information
about incidents and potential incidents
we've now heard legislation up on the
hill moving uh where there's
an effort to get people to disclose it
goes beyond data breaches but disclose
any incident you might have
tell tell us how to think about that and
will will disclosure
incidents sort of be enough to sort of
address any supply chain threats or is
it a bigger problem that we've got
we've got to go further on and and is
even
into disclosure a worthwhile thing to
even get in the business of talking
about
i mean i think just it's it's really i
think it'll
we'll find out when it plays out um but
i think
it's hard to say i think i think it's
disclosure i think is a is a step in the
right direction right it's that same
sense of wanting to understand so you
can measure right you can you can
understand if you can't
if you can't evaluate it then how can
you respond to it
appropriately right and so we need to
create metrics across
a very more than just our own
organizations to understand what's going
on
and i think there's a sense whether it's
ransomware whether it's a supply chain
issue
that when companies experience an event
right they they really don't want it to
be
a breach they want it to stay an event
and not even
kind of we deploy all our resources try
to understand
what to do on our company's own best
interest if
if there's a directive to to share that
outside of that which
i think a lot of companies a lot of
lawyers who are comfortable
and have points of contact within
federal agencies like are
are already comfortable reaching out to
try to pick up interesting
whether it makes sense to disclose
something but yes
that says you you need to you should we
want you to
and and and there there's no sense of
impending
penalties right penalties come when you
do something poorly
the penalties don't come when you show
that you were vulnerable
everybody every company is vulnerable
there's no sense of
like um you know we talk about zero
trust there's no
100 percent security like that would be
an amazing state to exist within but no
company
exists within that state so right that
that directive that says
share let us know is is around that
that attempt to try to create metrics
that
allow for a valid response that can be
coordinated
across more than just one company and i
think that's very laudable i think that
is a step
for sure a step in the right direction
whether it's going to be effective and
how quickly
that's very hard to say yeah yeah that's
a great it's a great point about
sort of the the need for information to
get out there in the marketplace in
order to
first coordinate responses so ernie you
know go into this question of responses
right you served in the government you
served the department of defense you
were in the military
um you served at diu and now you've come
out and you're in the investment space
in cyber security
but you know one of the things that's
been talked a lot about is that the
government not only needs to get its own
house or on the defensive side
but it needs to do more potentially
offensively right the government needs
to respond more effectively
uh to these types of attacks you've seen
uh now the bio demonstration talk about
the fact that
you know we're gonna name the countries
involved we're gonna start talking about
holding countries like russia like china
responsible
for some of things that happen in their
space even if they're not nation state
actors but if there are criminal gangs
operating their space and they know
about it
we might hold them accountable what what
is this the right road to go down do we
want to behold one
do we want to treat ransomware as the
fbi director said like terrorism
which i think was code for if you harbor
these guys will start treating you like
you're responsible right is that
is that the right approach um and then
second do we need to get more offensive
i mean
do we need to be punching back more
often i like to use the analogy sort of
the bully on the playground right where
you know we all tell our kids you know
yeah go tell the teacher the teacher
i'll tell the principal and then we'll
have a meeting we'll solve the problem
right
but we also all really know that if in
fact you want your kids something to
build on a playground
the best thing to do is put them in a
self-defense class and punch the bullet
in front of everybody
and the bull's gonna stop bothering them
and nobody else is gonna bother too now
nobody say tell your kids that right
but it works and so you know should the
government be punching back harder in
cyberspace
obviously this is a great question and
um
i think that on the classifying them as
terrorists you know
i i look at it with with cyber there's a
beno line
there's there's criminal activity and
nation-state activity
that looks to that's directed at
you know data-rich companies whether
it's pure ransomware extortion where
right and then what we've seen recently
with with jbs with colonial pipeline
now we have essential services that are
being attacked
and it's one thing to you know blow up
a nuclear facility something that
extreme it's another thing when
you shut down the supply chain of oil
and gas on the east coast
and i think back this might be a
interesting analogy but i was living in
new jersey when hurricane sandy hit
yeah lost power for almost two weeks run
up in gas prices people fighting at home
depot for generation
it caused chaos and if you think of a
cyber attack
it's it it can have those physical
effects in or those effects in the
physical world
so to me there's a clear distinction
there
and are they you know if you're
harboring
these these cyber criminals uh i think
you should be held accountable
uh for for letting them um operate with
impunity
on the offensive side yes
we should be more offensive you know
general nakasoni at the nsa
ever since he took over the whole he had
the whole concept of defend forward
right and to me that's you know start
punching a little more
and going into other people's
neighborhoods and showing them hey
what's what's going on here so
i i agree with that mentality now what i
don't know being out of the government
now is what happens behind the scenes
all the clandestines
but over um overtly we should be
punching back harder
yeah so so dave dave you know you've
seen some of this stuff you you when you
worked at blue void you all defended
some of the largest financial sector
players in the business
um talk to us about how how bad
is the threat when it comes to critical
infrastructure right
you know you you've seen a lot of you
sell a lot of rapid seven too so talk to
us about
um how bad the threat looks and
and is what ernie says right if the
government starts punching back more
so if we get more aggressive on on
general auxiliary's effort on defend
forward persistent engagement right
you know we've got is there any point
out we've got all these amazing people
in cyber now we've got chris singles
nash cyber director jen easterly
at dhs we've got ann newberg at the
white house i mean rob
joyce is back at nsa on the on the
defensive side i mean it is
it is like a who's who of of cyber cyber
defenders people frankly who are willing
to go a little
sort of a little more up against the
enemy and and punch him right
so so from your perspective having seen
what the threat is the critical
infrastructure is this the right
approach or
or you know a lot of people said we
shouldn't punch back because we live in
a glass house
right and if we punch too hard they're
going to hit us really hard and we're
more vulnerable and more likely to
more likely have problems than they are
is that is that right i mean how do you
how do you think about this
yeah i i i i'm not sure i'd say
glasshouse
say but i think we you know while we are
likely the most capable
uh from an offense perspective we also
likely have the most to lose defensively
uh and i think that has to factor into
our you know the policy of how we think
about this but
see if you talk about critical
infrastructure i mean it's a fascinating
term
we're sitting here talking you know in
the ics village which is you know very
focused on the industrial control side
i mean dhs categorizes 16 categories of
critical infrastructure i mean
yeah in some ways everything is critical
infrastructure in a lot of ways and
i exaggerate a little bit for the point
but i think the challenge of it is is
we we often think that particularly i
think on the policy side
get get wrapped up in the haves versus
the have-nots is you know a you know an
investor in utility or you know a money
center bank
um you know has amazing capabilities uh
you know but the you know by nature of
of
these industries we're talking about
they're all highly interconnected you
know financial services
particular but you know is is is
obviously you know highly connected but
but i think folks you know on the uh
like the energy industry
when you you you know you've lived in
noewell is uh there's
um you know we have a handful of grids
uh and one of them has an impact
and there's there are from major
investor owns
you know multi-billion dollar
organizations uh to very small rural
co-ops and i think
what we what we often forget are the the
state of the have-nots
uh and and uh you know then i think you
know wendy now there's a great piece
years ago of living
you know below the security poverty line
and so you know there's there's
organizations that you know
have have 10 people on i t uh on our
power
and so i think that um when we talk
about things like
you know information sharing and uh you
know and public partnership
like those things are great you know
when you can when you you can take the
you know the the intelligence team from
exelon or from
jpmc uh and you know have them talk to
their peers you know when it's the
uh when it's a you know you know a small
rural electoral co-op it's a very
different conversation
and you know as we've seen from uh i'm
blanking on the details attack but as we
saw
you know in in one of the the you know
uh russian
uh attributed attacks on our uh peter
parker you came in through
a uh a maintenance supplier and a small
real co-op so
i think that that that's that smb
conversation is one that's just so
critical uh
to to our overall you know
infrastructure security that we
we just that that leaves us vulnerable
in the uh in the punchback side again
there's there's definitely places for
for punching back and i'm i'm all for it
i think we've
you know i i love that we've been uh
more aggressive and
recovered money and uh and things over
right so i think there's there's
there's a lot of roles for that and i
think a lot of really um
impressive and creative collaboration
and finding
ways to legally you know take down
infrastructure or take over
infrastructure
uh so i think there's a lot more we
could be doing but i think uh
we just have to keep keep keep our
you know our state in mind as we do that
yeah well so
on that on that front jen you know one
of the things that that uh that we've
seen the government do a lot of right is
is indict cyber criminals you're a
former federal prosecutor
uh right uh or former prosecutor you uh
have seen some of these cases go down
uh you know is is it really
sensible to for indict folks we know
we're never going to get right we got
these chinese
you know military officers with these
russians these russian
cyber criminals some of whom are
associated with the government right
there's
no chances that we're going to get these
folks here and so in a lot of ways it
feels like just a name and shame game
when it comes to these indictments
right is there any value in these
indictments and if there is or there
isn't
right um what about getting more
aggressive are there are there any legal
concerns we might have with doing the
kind of things that ernie's talking
about sort of
uh you know getting more aggressive
punching back right or
you know are there are there legal
concerns with helping the smaller
providers can we can we do something
as a legal matter to help these small
providers get the information they need
if they have small teams can we can we
push in the information
um or focus information on them uh
without you know without having
a problem where we're not helping these
other folks right is there is there a
problem when we treat people differently
given how they're situated so a number
of questions there sorry about that
that was i think a three-parter okay i'm
gonna address them all together
um that's a great question uh no i think
uh
i think the word that comes to mind when
i think about the prosecutions is
like symbolism right like it's it's a
symbolic
sort of um shot um it's a long shot
right the idea that these people be held
accountable you know in a court of law
in the united states is very
far-fetched um but is it is it
meaningless
probably not right because i think i
think there's a sense that
even identifying you know somebody who
is hacking you know whether it's smbs or
like
you know our nation itself is bootable
like that person has
an identity behind a screen in a place
that is very
many time zones away but still the idea
of like
literally like throwing down the
gauntlet that this is the person
we know it's you yes that's that is i
think there is something very
um gratifying about that i don't think
it'll go so far as being gratifying
as far as putting them in one of our you
know um
jails um that'll be amazing but but
probably not
but i think you know the the question of
what is
an appropriate response and how do we
properly defend
you know our country and our companies
um
is is multi-layered i think a lot of
a lot of the time like we haven't even
touched on like diplomacy right like
there's the idea of sanctions
the idea of like which which country is
is this coming from
and will they be responsive to the
diplomacy
that kind of accompanies the sense that
sanctions have
the right repercussions for that kind
and
and then can you lean on that country to
then help you find justice against those
individuals who are
part of it now in a lot of the countries
that we're talking about today
those those individual actors are not
individual actors per se right like we
talk about right
in their own hr departments within
criminal organizations
they're very organized they're probably
state-sponsored and that's just not a
realistic outcome
yeah i think it's interesting you know
last week you know there was there there
was a bill there's a bipartisan bill
that's being introduced
allowing companies to hack back and i
don't know if you guys have
seen that yeah that that was a 2017
initiative
it's you know it's been revived and the
question there is like
you know what would be the right
proportion of action by a company
how would a company say all right you
did this like
okay now you get this that you could
rise that level of sophistication
like the question and at the gc level
right like a lot of us are kind of
questioning like
do we want to be the individual who's
saying go for it
yes like right like it's awesome since
go like give it to them
like that is it it feels very
far-fetched but that is a legitimate
bill
that is coming through that is well yeah
there are some that bears some
consideration because that's
if that's where we're at you know we
might as well put everything on the
table and think through that because
there aren't many other options and
remedies for companies
yeah so so ernie look this has come up a
number of times right this idea of of
private sector hacked back right
it dates back right as a military matter
back to the founding of our nation right
where we actually
use private private ships to sort of
form a navy for us and really defend to
defend our coastlines right even though
we had a nascent navy right
we would often give these letters of
mark and reprisals people as people
refer to them you know
it's in the constitution right and give
these things to private individuals to
go fight back on behalf the nation
uh we obviously have today a cyber
command they have offensive capabilities
even before cyber command existed we've
had we had the joint functional
component command for network warfare
that did some more of the offensive
stuff but there is a lot of discussion
about private companies being able to
respond in some way
right some people talk about active
defenses meaning you know look if if
somebody hits me
i can send sort of the way i would like
a die pack in
in a package of money right it'll go
explode in their network i'll know it
was them it'll beacon back it'll tell me
it was them right
never mind that beaconing activity looks
a lot like what malware does right at
the outset but okay whatever
finds it'll beat them back to me and
maybe even it'll detonate and it'll
destroy my data
right but then what if it goes a little
further right ernie is this the place we
should be going where
well maybe it detonates and takes down
their infrastructure not not in not
their whole systems but just the stuff
they use to attack
me right is that a place we should be
going and
should we be worried about if this is as
as jen points out potentially
even though it looks like criminal
activity it might be state-sponsored
activity
right is there a threat that we might
have private sectors companies get us
into that so-called you know land war in
asia do we have to worry about that
that's a tough one that's a really tough
one because part of me
says yeah you should be able to defend
your organization
um and you should be able to respond
proportionately or
maybe disproportionately the other part
of me you know thinks with kinetic
warfare there there's always collateral
damage
uh and there there could be fracture
side uh so
i mean look at that look at not pets
here right i mean not petcha an attack
by the russians against ukrainians you
know
300 million dollars per company right 10
million
worldwide perf perfect example perfect
example
you know the i i think
as much as i'd like to see something
like that i think it would get too
chaotic
you'd have the collateral damage you'd
have you know it's not like
when we had stuxnet there there was an
organization that could use four zero
days and do it very accurately right
that you can you can't expect you know a
mid-more even an enterprise jp morgan to
do that
so i i think i don't know i don't know
jamie dimon might might disagree with
you he's got renewed so
well they might be the one exception but
you know when they were
when the financial institutions were
attacked in 2012 by the iranians
right the government didn't help uh my
understanding
is and i know people that were involved
uh
the government said no and and
ultimately the
um the you know call it enemy servers
went dark
uh and it was the israelis right they
came in
so anyway it's it's a slippery slope uh
i i think we got to be very careful with
that
yeah so jen what about from a legal
perspective let's say we did grant these
letters of marketing reprisal to
companies that you know
that that that um that are that are
being attacked critical infrastructure
companies only and only really capable
ones right only the big ones and all the
smart ones right whatever
uh we pick them we give this authority
we say you can only do these set of
things
right do we want private sector
businesses
doing this sort of thing right is is are
there any legal concerns with that and
here's our legal concerns are there
policy concerns about allowing private
sector companies
even with all the law all the legal
authority in the world from the us
government a little
favor saying you're acting on our behalf
do we want them in that business
i mean at the risk of alienating all of
my friends for
general counsels i would say i would say
probably not i mean
general counsels are not cyber experts
you know
by merit of having except for you well
i'm i'm still working on it that's why
i've got to spend a lot of time around
it
um no but but i think i think it's the i
think that's the problem right i mean
general counsels are the word general is
in there for a reason
like we are just at the heart of it if
we're not then
it's very hard to execute against so
many different things that affect a
company
um the question of like whether we want
to be empowered to
use force under a un charter like
probably not it's probably the same
question as like should i
be carrying a gun even if i can get a
gun from it probably not
uh that's i think it is it's an
interesting question i mean i i think
there are legal ways through it right
and there are corporate governance ways
through it you can create
committees that can evaluate things that
can get down to like a very
narrow issue and protect itself and
understand that it's making a decision
in the best interest of the entity
and then taking into account all the
other considerations which would be
you know the country the collateral
damage the repercussions
and and do it in a coordinated way with
government um
that maybe if that then possibly but i
would still
you know err on the side of what ernie
said which is yeah
it's a big it's it's it's a big leap of
faith right and it's a
faith that may not even be successful
even if you had the technical chops
to execute it what are you going to get
is it that sense of redemption
right doj style like you know
we've now named it we've done something
yeah is it is how how
it's probably very gratifying but is it
is it ultimately effective
yeah yeah yeah so david you know it
sounds like ernie
and general are like look we're not
pricing company doing it's not the
greatest idea
right so let's let's say that's right
let's say we're we're not going to price
the company companies do this and we're
really going to take
uh you and ernie up on on your
suggestion that the government gets more
aggressive and
sort of does its part right does the
government know enough
about what the private sector is being
hit by to effectively respond to it and
and sort of deter behavior right i mean
it's one thing to say okay the
government's not willing to do it right
which they haven't been for a while and
now hopefully under general oxygen
they're getting more aggressive and they
have more authority right
so maybe they are willing to turn maybe
even capable of deterring
right do they know who to go after they
know how to go about it do they do they
have the
information they need to really sort of
deter those who are coming up against
our private sector or do they need
you know we've talked about information
sharing and that's all great and well
right you know
more data fine great terrific right but
a lot of it needs to be about
collaborating in real time too right
working together
consistently day to day day in day out
holding hands as these things happen
are we are we anywhere near that yeah i
mean i think if we're if we're talking
hit back from a cyber attack i think
that's a very
that's a much more complex conversation
and and you know information sharing
becomes a uh
you know really really challenging uh
chat yeah i i i had a conversation
you know a few years ago with uh with
someone at the senior level
at a at a state uh law enforcement
agency and you know that this idea is
like talking to the fbi is like um
you know being a psychiatrist in the
chase lounge is like they ask all the
questions you do all the talking
uh and uh and you know it was a very a
very one-way conversation so i i do
think a
you know a two-way um you know
communication
is uh you know is is critical uh yeah
you know and but
just not only for accuracy but also
things like collateral damage like
like you do this and you're going to
take out you know you know the
you know the east coast you know like
you're gonna take out a pipeline or
you're gonna take out
yeah so understanding the dependencies
is challenging but what but
what i think we're missing in the in the
hackback conversation and
part part of why i love the naming names
uh
you know side is attribution is really
important for two things one
is uh you know it's um yeah it it can
give you organizational insight as to
who's doing it so is is this one person
you know or a small group of people who
are financially motivated does it
you know is it a is it a broader network
that's accomplishing other goals how are
they being financed
uh and and when we know those things we
can all of a sudden take
uh take very different actions it
doesn't have to be just in stable
infrastructure
it can be you know stop their ability to
move money uh you know
not just cyber yeah there's a lot of
other things that
uh that we can do i mean i again i agree
with jen that the likelihood these
people ever showing up in the u.s jail
is low but uh
i just kind of grin and go well there's
a we just took a lot of places that uh
they can't go on vacation and spend that
money they're making
that's that's where extradition comes
into play so i i do think there's a much
broader set of actions that when we know
the
the individuals um you know and then the
entities they're part of behind it that
that the us government's um you know the
you know
has actions that can take and that's a
very different coordination problem that
you know
that coordinating a you know a cyber
defense mission a
you know a a financial you know crimes
mission
a uh you know money laundering or ofac
like things like that
that's a very different degree of
coordination that i'd like you'd love to
see you know
a a difficult sprint around on the
government side and sorting that out
yeah so so this is really interesting so
you know
we're coming up on on the end of our our
time together
and one of the things i want to sort of
end on um is a question about
ransomware itself right because the
topic of our panel is critical
infrastructure and ransomware
one of the things that got really
interesting about the colonial pipeline
hack right was that uh early on in in
the in the attack
uh colonial pipeline took their systems
offline right uh they did some stuff
and then they came back up fairly
quickly everyone was concerned about
the potential for a major supply chain
disruption of oil on the east coast
there were even some people who were
hoarding gas crazily putting bag
gas in plastic bags by the way for those
who out there don't put gas in plastic
bags it doesn't work it's a bad idea
please don't do that um but but there
were these concerns right legitimate
concerns about
about about a supply sheet destruction
and colonial pipeline avoided it i'll
come to find out later on
that they had paid the ransom right now
yes the fbi went
and they were able to get get something
back that's a whole nother question
about how the fbi had the private key
uh to the bitcoin to get that to get
that uh that grants it back that i'll
leave for the audience
but i have a question for for each of
our panels which is
should we be permitting companies to pay
ransoms
in order to get them back up and running
faster and if your answer is
yes or at least for critical
infrastructure a qualified yes
doesn't that incentivize the business
and if it does how do we solve that
problem aren't we sort of quote unquote
negotiating with the terrorists i'll
start with you david and i'll end i'll
end with jen
because she's the lawyer in the room and
i want to get the lawyers out but david
first see you
i thought i i i would not uh i'm not
supportive of the government um
having a no ransom policy uh today is
that that folks
that that people need to make a a
risk-based decision their business and
i it it i again it i loathe
uh the fact that it supports uh these
actors and
and continues to um uh it helps
propagate the problem but i think that
you know
any the the government telling a uh a
private sector
um you know entity what they can or
can't do you know with
you know financially in a risk situation
uh you know we we
you know taking i tried all parallels we
didn't go back and say you couldn't take
yeah you couldn't pay kidnapping ransoms
uh that uh you know we dealt with that
as
uh as a as a law enforcement problem and
so
i i think we're not quite ready for that
i do think there are a number of
um there are some things where some
tools that
we that that while you say yes you can
pay
uh i do think we're under leveraging the
um
you know the the ofac and uh uh and
you know money moving process that yeah
there's a there's a
small growing kind of school of thought
that paying ransom
uh should should require some more
knowledge and attribution of the entity
to make sure that you're not funding
uh you know as a as a us entity you
can't fund things that are
that are sdns uh so i i think
there are ways that we could um we can
wield other things
uh beyond the individual uh companies
okay
but can i can i ask about that so i
always hear this right like okay we
should make sure
as long as they're not paying terrorists
or or you know whatever but look they're
paying
cyber hackers right for all we know
these high records are fun
i mean what do we suppose to ask them
for id before we pay them like what
how how is that going to work i don't i
don't get that yeah i mean yeah i mean
yeah look there's there's there's
there's ways um
there are there are services out there
that help with this
there are um and i think you know there
there's
you know perhaps there's ways you can
come come to
knowledge about the transaction that
gets you to a comfort level uh
but we you know we we've had this sdn
methodology
you know as a as a country for a long
time and it's
you know while it's not perfect it's
been it's been quite effective at uh
taking out you know particular groups of
actors and i'd love to see
use more here and sdns are especially
designated nationals right people who
aren't sort of the terrorists and the
like
sanctions list um all right ernie over
to you um
should we allow companies to pay ransoms
and if so what about this uh this threat
that it'll just incentivize the business
more
yeah so first i i don't think it should
be binary you either pay or you don't
uh in a recent study i read only eight
percent of organizations got all their
data back
and 29 got half which blew my mind
because
i thought if you paid you probably like
a 75 percent chance to get it back
uh so today i agree with david it's
you're not going to tell like if you're
if your kid gets taken hostage
you're not the government's until you
don't pay the ransom you want your your
child back so
they might but you're still going to pay
the rent yeah
but it's it's a risk-based decision is
is
pii on the line uh or is it an essential
service is it affecting national
infrastructure is it affecting you know
um
something that that could cause actual
physical heart you know
harm in the physical world so i i think
it's up to the businesses
i i don't like it but i think there's no
there's there's no you know binary
answer to this yeah can i just follow up
on that though so okay so
let's see let's it sounds like you'd be
more willing to accept payment of
ransoms if if critical infrastructure's
involved is that did i hear that right
that that's yeah it's you have to look
at first second third
and yeah yeah okay so so if that's right
though
aren't we just telling the bad guys hey
you know what you should really go after
you should go up to critical
infrastructure
because that's where we're gonna be
willing to pay the biggest ransom so hey
clone pipeline that was smart
do more of that you'll get paid more
often
yeah i i would not write that down or or
suggest that it would it it's again it's
business risk
with the business knowing what type of
risk uh that that that ransomware and
extortion where it's going to affect
on their customers and on our calculus
all right jen you have the first word
you get the last word
tell us what you think about about
ransomware
you know and and should we be allowing
companies to pay ransoms and what about
this
incentive effect right if we if we tell
them like ernie says hey look
the one place i'm willing to pay ransoms
is critical infrastructure for sure
well doesn't that make quirky voucher
even bigger critical infrastructure
sorry
uh an even bigger target than it already
was
yeah i mean i agree with both david and
ernie so i'm going to kind of layer on
to their
sort of suggestions but also kind of go
far which is like can we get to a point
with with public sector with government
agencies where like because the thing
that we're not talking about with that
ransomware is that it's a very rapid
response that's required
so making a very quick decision and as a
company everything that you do
as an officer is in the company's best
interests that's kind of the overarching
theme like
obviously the collateral effect is
important but if it
but if it's if it is if it's
contraindicated by
something legal then that takes it off
the table i i kind of query whether we
could get
through this like you know the biden
orders and the sense of collaboration to
a point where companies feel like they
can
turn to law enforcement during a
ransomware attack
to say this is happening we're gonna do
this we're letting you know
and and maybe get some some some sense
of assistance
even to try to get to that level of
attribution
right like maybe that's where this all
goes maybe you split it
and try to get there and that's kind of
the best case for right now because it
is a very
repeated issue i think companies are in
a really bad situation especially
as ernie said when there's pii on the
line the government is not willing to
indemnify you
right from all those suits that are
coming so
so you've got to still make the best
decision for your company that's a
that's a very multi-layered question
right well it looks to me like that's a
great note to end on thank you so much
to ernie
david jen thank you for being here thank
you for contributing to this
conversation um
and thanks to bryson board and ics
village for hosting us at this defcon
panel talking about ransomware
curriculum structure and and the
potential impacts have a great afternoon
everybody thanks a lot