Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure

Latest Episodes:

AI, Cybersecurity, and State Innovation: A Conversation with Nebraska's CISO Patrick Wright Nov 06, 2024

Show notes

In this episode of Cyber Focus, host Frank Cilluffo interviews Patrick Wright, the Chief Information Security Officer and Chief Privacy Officer for the State of Nebraska. The discussion centers around the challenges and opportunities of implementing artificial intelligence (AI) and cybersecurity strategies at the state and local levels. Patrick shares insights on leveraging AI to bolster cybersecurity, managing privacy implications, and building strategic public-private partnerships. The conversation also highlights initiatives like Cyber Tatanka, a unique cybersecurity exercise involving military, government, and private entities, and addresses the importance of cooperation with federal agencies.

Main Topics Covered:

State-level implementation of AI and its role in improving government services
Leveraging AI for cybersecurity: challenges, use cases, and privacy considerations
Cyber Tatanka: A collaborative cybersecurity exercise with the National Guard
Strategic partnerships with private sector and federal agencies
Resource allocation and logistical challenges in disaster management using AI

Key Quotes:

"We're leveraging cybersecurity and AI to bolster our defenses against the national and global threats that we face." – Patrick Wright

"We can talk about cyber security from a strategic perspective all day long... But where the rubber meets the road is in providing the the critical capabilities for cyber down to the SLT level." – Patrick Wright

"Being proactive in not only what we're doing from a cybersecurity awareness perspective, but from an emerging technology perspective, from a policy perspective, from a best practices perspective." – Patrick Wright

"When you start talking about targeting the power grid, not only are you disrupting power supply generation for constituents across the state or region, but you're also, impacting power for other critical infrastructure like like health care and banking." – Patrick Wright

"We tend to look at the world through our boxes and org charts. The bad guys don't. They act. In fact, they very intentionally exploit the seams in our defenses. – Frank Cilluffo Relevant Links and Resources: National Association of State Technology Directors (NASTD) NASTD AI Survey Multi-State Information Sharing and Analysis Center (MS-ISAC)

Guest Bio: Patrick Wright is Nebraska's Chief Information Security and Privacy Officer, responsible for statewide cybersecurity initiatives, incident response, and compliance. With experience in both public and private sectors, he holds degrees in IT and public policy, and chairs multiple cybersecurity committees. He also serves on CIS's Multi-State Information Sharing and Analysis Center Executive Committee (MS-ISAC).

Securing the Surface: TSA's Role in Pipeline and Transportation Security with Sonya Proctor Oct 30, 2024

Show notes

In this episode of Cyber Focus, host Frank Cilluffo sits down with Sonya Proctor, Assistant Administrator for Surface Operations at TSA (Transportation Security Administration). Proctor discusses TSA's evolving role in securing pipelines and other surface transportation sectors, emphasizing the agency's expanded cybersecurity focus following the Colonial Pipeline ransomware attack. The conversation delves into TSA's partnerships with industry, other federal agencies, and state and local law enforcement to enhance critical infrastructure protection, as well as the challenges and opportunities in integrating physical and cyber security efforts.

Main Topics Covered:

TSA's role in pipeline and surface transportation security
The Colonial Pipeline ransomware attack and its impact
Integration of physical and cyber security for critical infrastructure
Collaborations with federal and industry partners
Challenges with operational technology (OT)

Key Quotes:

"[The general public does] not typically think of TSA as having a role for pipeline security. And actually, TSA role in pipeline security goes back to the beginning of TSA." - Sonya Proctor

"I have no question that we are in this together. This is one fight. Because this threat is unlike anything they've ever seen before." - Sonya Proctor

"Our resources will grow along with the threat... They have to."- Sonya Proctor

"I was fortunate to have a relationship with [Colonial Pipeline] and to be able to communicate with them and to be able to get information from them that we were then able to share with other companies." - Sonya Proctor

"We have provided classified briefings to more operators than ever in the in the history of TSA... it was important for us to make sure that they understood the threat. - Sonya Proctor

Relevant Links and Resources:

Guest Bio: Sonya Proctor is the Assistant Administrator for Surface Operations at TSA, overseeing the security of pipelines, mass transit, freight rail, and highways. She previously served as Director of the Surface Division in Policy, Plans, and Engagement, and Deputy Federal Security Director at Ronald Reagan Washington National Airport. Proctor started her law enforcement career with the Washington, D.C. Metropolitan Police Department and also served as Chief of Police for the Amtrak Police Department.

A Look Inside McCrary Institute's Presidential Transition Report Oct 23, 2024

Show notes

In this episode of Cyber Focus, host Frank Cilluffo discusses cybersecurity priorities for the incoming administration with Mark Montgomery, co-author and leader of the Cyber Solarium 2.0 Commission, and George Barnes, former deputy director of the NSA. They delve into the McCrary Institute's new presidential transition report that presents a strategic roadmap to maintain the progress achieved in cybersecurity. The report highlights eight lines of effort, ranging from regulatory harmonization and collaboration to building workforce capacity and securing emerging technologies, with the ultimate goal of safeguarding national security and economic resilience.

Main Topics Covered:

The purpose and composition of the transition report
Maintaining cybersecurity momentum across administrations
Eight lines of effort to ensure cybersecurity continuity
- Unifying the regulatory landscape
- Synergy in cybersecurity protection
- Cost imposition and deterrence strategies
- Resiliency through proactive risk reduction
- Enhancing cyber statecraft and international collaboration
- Building workforce capacity and volunteer support
- Safeguarding critical and emerging technologies
- Ensuring continuity of the economy

Key Quotes: "Irrespective of who wins the presidency in November, cybersecurity is going to be a priority and must be elevated." – Frank Cilluffo "The most important thing in Washington is momentum, and to have momentum, you have to have ideas." – Mark Montgomery "Cyber transcends the air, land, sea space and the reality is this has implications and impact much broader from a national security and economic security perspective." – Frank Cilluffo "You can't just sit there and defend. You actually have to put pressure and cost and position in the other direction." – George Barnes "The one thing [autocracies] can't do well is partner. They're very transactional and domineering, as we know. And so partnerships really matter." – George Barnes "[We] need to first achieve regulatory harmonization. You can't continue to pile requirement on requirement on the private sector without first ensuring that you're not asking them to do the same thing in five different manners." – Mark Montgomery Related Links: The full report: https://eng.auburn.edu/mccrary/pttf/ Guest Bios:

Mark Montgomery is the leader of the Cyber Solarium 2.0 Commission, focusing on strategies to improve national cybersecurity and protect critical infrastructure, and a senior fellow at the McCrary Institute.
George Barnes is the former deputy director of the National Security Agency (NSA), a senior fellow at the McCrary Institute, and the Cyber Practice President and Partner at Red Cell Partners

Cybersecurity Diplomacy and Technological Leadership with Australia's Toby Feakin Oct 16, 2024

Show notes

In this episode of Cyber Focus, host Frank Cilluffo speaks with Ambassador Toby Feakin, Australia's first Ambassador for Cyber Affairs and Critical Technologies. Feakin reflects on the evolving cyber threat landscape in the Asia-Pacific region, Australia's cybersecurity strategy, and its growing focus on balancing economic ties with China while addressing critical security risks. The conversation delves into Australia's international partnerships, public attribution of cyber threats, and critical infrastructure protection. Feakin also shares insights into his role in spearheading Australia's cyber policy and the future of technological leadership in quantum computing, AI, and supply chain security.

Main Topics Covered:

Australia's evolving cybersecurity strategy and public attribution of threats like the Cloud Hopper incident
The balance between economic ties with China and cybersecurity risks
International partnerships with Five Eyes and regional players like South Korea and Japan
Critical infrastructure protection, including undersea cables and cyber-kinetic threats
The significance of China's pre-positioning cyberattacks
Emerging technologies, including AI, quantum computing, and their impact on geopolitics
Feakin's role in shaping Australia's cyber diplomacy and international engagement

Key Quotes: "Something that Australia continually has to balance is this kind of multifaceted relationship with China... it's balancing the economic ties that you have with such a behemoth in the Asia-Pacific and globally, economically, alongside a growing understanding of security risk." - Toby Feakin "[China's pre-positioning] absolutely should concern not just other governments, but it should concern industry because they are the guys... who own and operate a majority of infrastructure and they need to know clearly that's the level of threat they're dealing with." - Toby Feakin "If you look at that tech convergence, you cannot afford to sit still for one second because it's all moving such a fast rate that even the developers themselves have no idea where this journey is ending up." - Toby Feakin "[To safeguard supply chains] Australia in making much more rigorous assessments of not only where does the equipment come from, but where does the money flow from." - Toby Feakin "Businesses need to feel comfortable in the chaos of trying out new technologies and creating right pockets of environments and business cases so that they can trial new tech and not be frightened of it." - Toby Feakin Related Links:

https://insights.sei.cmu.edu/blog/operation-cloud-hopper-case-study/
https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
https://www.iiss.org/publications/strategic-comments/2019/australia-huawei-and-5g/

Guest Bio: Ambassador Tobias (Toby) Feakin served as Australia's inaugural Ambassador for Cyber Affairs and Critical Technologies. He was responsible for shaping Australia's international cyber engagement strategy and has been instrumental in fostering partnerships across the Asia-Pacific. Feakin has played a crucial role in Australia's public attribution of cyber threats and has been a key advocate for balancing technological innovation with security risks.

From DJI to SolarWinds: Navigating Supply Chain Risks and Building Resilience with Bob Kolasky Oct 09, 2024

Show notes

In this episode of Cyber Focus, host Frank Cilluffo talks with Bob Kolasky, Senior Vice President at Exeter and former head of the National Risk Management Center at CISA. The conversation covers key topics related to supply chain risk, security, and national defense. Bob provides insights into the evolving threats within supply chains, especially those linked to cybersecurity and critical infrastructure. He also touches on legislative efforts and the role of public-private partnerships in mitigating risks from foreign actors, particularly focusing on concerns regarding Chinese companies like DJI and Huawei.

Main Topics Covered:

The hybrid nature of supply chain threats and their intersection with cybersecurity
Notable supply chain attacks like SolarWinds and the role of software vulnerabilities
The rise of Chinese technology companies, especially DJI, in U.S. supply chains
Legislative responses to supply chain risks, including the China Select Committee
Critical infrastructure sectors and the importance of visibility and resilience in supply chains
The need for secure alternatives to foreign technologies, particularly in drones and communication systems
Public-private partnerships to address systemic risks in national security

Key Quotes: "Supply chain has increasingly become an important element of how nations defend themselves, but also an area of attack." – Bob Kolasky "We're seeing order of magnitudes improvements in manufacturing techniques that are being enabled by digital. And whenever you say the word digital, you can say the word cyber because a digital supply chain is a potentially cyber-vulnerable supply chain." – Bob Kolasky "How are we as a country going to see the investments made in alternatives to DJI [drones] so that law enforcement can still get a cost effective solution to meet their mission needs?" – Bob Kolasky "It's not just about bringing supplies back here. It's about friend-shoring and trust-shoring and making sure that there are the instruments of power used to stimulate the development of technologies and markets for technologies that are crucial." – Bob Kolasky "Let's empower the institutions that Congress has created, the executive branch has created to continue to do this work. Administrations may have different priorities, but the more we jump around... the more we get drawn away from the end state goal, which is more security and resilience." – Bob Kolasky

Relevant Links and Resources:

National Risk Management Center

Guest Bio:

Bob Kolasky is the Senior Vice President at Exeter and a former leader at the National Risk Management Center at CISA. His career has focused on addressing supply chain risk, cybersecurity, and critical infrastructure. At CISA, he worked on supply chain security efforts, particularly in defense and technology sectors, and was a key figure in developing national policies to protect critical infrastructure from cyber and physical threats.

Signals Intelligence, Zero Trust, and the Next Generation Workforce with NSA's Dave Luber Oct 02, 2024

Show notes

In this week's Cyber Focus, host Frank Cilluffo speaks with Dave Luber, the Director of Cybersecurity at the NSA. Luber shares insights from his extensive career, spanning 37 years in the intelligence community. The discussion focuses on the NSA's dual mission in signals intelligence and cybersecurity, its collaboration with industry through the Cybersecurity Collaboration Center, the importance of public-private partnerships, and the evolving threat landscape. Luber emphasizes the need for secure-by-design principles, the role of education in developing the next-generation cyber workforce, and the NSA's efforts to address threats from state-sponsored actors like China and Russia.

Main Topics Covered:

NSA's dual missions: Signals Intelligence (SIGINT) and Cybersecurity
Establishment of the Cybersecurity Directorate under General Nakasone
Public-private partnerships and the Cybersecurity Collaboration Center
Global partnerships with U.S. allies and Five Eyes nations
The role of academia and the Centers of Academic Excellence in building the cyber workforce
State-sponsored threats, particularly from China and Russia
The importance of secure-by-design and zero-trust models in cybersecurity
Intersection of space and cyber domains, including the protection of space systems
NSA's role in shaping the cyber defense landscape and publishing cybersecurity advisories

Key Quotes:

"NSA has two primary missions: signals intelligence and cybersecurity. About five years ago, we combined these strengths to form the Cybersecurity Directorate, enhancing our capabilities to protect national security systems." – Dave Luber

"You need to use the hacker mentality to think about how to protect critical systems." – Dave Luber

We've brought together the talents of NSA, along with the talents of industry, to really scale cybersecurity in a way we've never been able to do in the past." – Dave Luber

"Russia has decided that, you know what, espionage is more valuable than attack, because if I can get the insights I need from Ukrainian networks, I can drive an outcome that benefits Russia on the battlefield. So you can see that actors will choose a different playbook depending on what they need at a particular time." – Dave Luber

"Over the course of the last five years, we've continued to see state sponsored actors increase in both their sophistication and scale and capabilities of an impact of some of their operational activities."– Dave Luber

Turning those signals intelligence insights into actionable cybersecurity guidance is really, I think, where we bring unique opportunities for our nation. But again, just ourselves is not enough." – Dave Luber

Relevant Links and Resources:

Evolving Cyber Threats: Insights from Former CISA Executive Brandon Wales Sep 25, 2024

Show notes

In this episode of Cyber Focus, Frank Cilluffo interviews Brandon Wales, the former Executive Director of the Cybersecurity and Infrastructure Security Agency (CISA), who served for over 19 years in the Department of Homeland Security (DHS). They discuss the evolution of the cyber threat landscape, lessons from significant incidents like SolarWinds, and the role of public-private partnerships in building cybersecurity resilience. Wales also shares insights on geopolitical concerns, including Chinese and Russian cyber capabilities, and the importance of preparedness across critical infrastructure.

Main Topics Covered:

Brandon Wales' Career at DHS and CISA
Evolution of Cybersecurity Threats
SolarWinds Cyber Incident
Public-Private Partnerships
Geopolitical Cyber Threats
Future Cybersecurity Challenges

Key Quotes:

"I can't think of anyone who's probably had more impact on CIS than yourself." – Frank Cilluffo

"The first shot fired in the Russia-Ukraine conflict, was cyber, was the disruption of Western critical infrastructure, ViaSat satellite constellation by Russian intelligence services to disrupt command and control in Ukraine." – Brandon Wales

"Our strength really is the vibrancy of our industry, the innovation that comes from it, the expertise that's resident in it. And for us to win, we need to harness all those capabilities and bring them together." – Brandon Wales

"[US Election Systems] are arguably more secure and resilient than ever, and people should have confidence that when they go to vote, their vote will be counted and counted correctly" – Brandon Wales

"Industry is not only on the front line, it is the front line in cybersecurity." – Brandon Wales

https://CISA.gov

Guest Bio:

Brandon Wales is the former Executive Director of the Cybersecurity and Infrastructure Security Agency (CISA), where he served for over 19 years within the Department of Homeland Security (DHS). He played a pivotal role in shaping the nation's cybersecurity posture and responding to high-profile incidents like the SolarWinds attack. Currently, he is the Vice President for Cybersecurity Strategy at SentinelOne, where he continues to focus on strengthening cybersecurity for critical infrastructure and private industry.

Cyber Focus Brief: Unpacking the Lebanon Pager Attack's Ripple Effect on Global Supply Chains Sep 20, 2024

Show notes

In this special Cyber Focus Brief, Frank Cilluffo and Bob Kolasky discuss the impact of the recent pager and communication device attack in Lebanon, reportedly orchestrated by the Israeli government. The discussion explores the unprecedented scale and complexity of this operation, the sophisticated use of supply chain vulnerabilities, and the psychological and strategic implications for both nation-states and critical infrastructure. The conversation also highlights the importance of supply chain security in the modern era, emphasizing the blending of cyber and physical threats and the need for enhanced defensive measures to protect vital systems.

Main Topics Covered:

The scale of planning needed for this type of supply chain infiltration
Psychological impact on adversaries
Implications for supply chain security
Blending of cyber and physical threats
Strategic lessons for governments and businesses
The importance of trusted suppliers and defensive measures

Key Quotes:

"When you start seeing something that has potential loss of life and physical consequences, I think maybe people will actually pay some attention to a significant set of issues facing our countries, our societies and obviously our companies." – Frank Cilluffo

"I do think it will likely lead to some new applications and tactics, techniques and procedures we may see in the battlefield or even in a civilian battlefield." – Frank Cilluffo

"I keep coming to the phrase hybrid, because I don't want to call this a physical or cyber. It's an element of both things… there's a digital aspect of how the physical attack was done. And so, you know, we're going to get lost if we spend our time debating whether something cyber or not cyber enabled, physical enabled, it's all blended together. – Bob Kolasky

Frank Cilluffo is a leading expert in national security and cybersecurity, having served on the Cyberspace Solarium Commission and the Department of Homeland Security's Advisory Council. He has advised senior U.S. officials, testified before Congress, and worked closely with NATO and Europol. Following 9/11, Cilluffo was appointed to the Office of Homeland Security by President George W. Bush, where he served as a key advisor on homeland security and counterterrorism strategy.

Bob Kolasky is Senior Vice President for Critical Infrastructure at Exiger, leading efforts to manage third-party and supply chain risks. He previously founded the National Risk Management Center at CISA and held senior roles at DHS, focusing on cybersecurity and infrastructure protection.

Navigating the Cyber Storm with NightDragon's Dave DeWalt and Katherine Gronberg Sep 18, 2024

Show notes

In this episode, host Frank Cilluffo is joined by Dave DeWalt, founder and CEO of NightDragon, and Katherine Gronberg, Head of Government Affairs at NightDragon. They discuss the intersection of technology and cybersecurity, emphasizing the growing convergence of physical and cyber threats. The conversation highlights key areas such as AI, machine learning, quantum computing, and the need for greater resilience in critical infrastructure. Both guests offer insights into NightDragon's investment strategies, the importance of public-private partnerships, and the role of innovation in addressing global cybersecurity challenges.

Main Topics Covered:

Technological innovations and the "cyber storm"
NightDragon's Investment Approach
Public-Private Partnerships and Government Engagement
Cyber-Physical Convergence
The Global Cybersecurity Landscape
Quantum Computing and the Future of Cybersecurity

Key Quotes:

"Cybersecurity is a team sport. It's one team, one fight, public, private, and so crucial." – Frank Cilluffo
"We look for the biggest threats, the biggest risks that we see on the planet across all five domains. And then we look for technology that can scale to meet that risk." – Dave DeWalt
"If we don't map our physical assets to our cyber assets, we're not doing a playbook for resiliency. And that's really the word now we need is resiliency." – Dave DeWalt
"We have cyber ranges. We have the ability to test. We have the ability to test together, but we haven't implemented it right." – Dave DeWalt
Thinking beyond just cybersecurity, because the world isn't really only anymore just about like cyber threat intelligence, it's also about real world threat intelligence. It's seeing even beyond the the synergies that exist for network security. It's actually seeing how data can be fuzed. – Katherine Gronberg

Relevant Links and Resources:

https://www.nightdragon.com/
https://www.iqt.org/

Guest Bio:

Dave DeWalt is the founder and CEO of NightDragon, a venture capital firm focusing on cybersecurity, safety, and privacy. Previously, he served as the CEO of McAfee and FireEye, leading them through significant industry changes. With over two decades of experience, DeWalt is known for his thought leadership in the cybersecurity space.

Katherine Gronberg is the Head of Government Affairs at NightDragon. She brings extensive experience from her time in cybersecurity companies like CrowdStrike and Scout, as well as her earlier work on Capitol Hill. Gronberg plays a pivotal role in guiding NightDragon's portfolio companies in their partnerships with government agencies.

OT Under Threat: Dragos' Robert M. Lee on Navigating Cyber-Physical Risks Sep 11, 2024

Show notes

Episode Overview:

In this episode of Cyber Focus, host Frank Cilluffo sits down with Robert M. Lee, CEO and co-founder of Dragos, a leading industrial control systems (ICS) and operational technology (OT) cybersecurity firm. Rob shares his insights on the evolution of operational technology, the critical importance of ICS cybersecurity, and the increasing threat of cyber-enabled attacks on physical infrastructure. The discussion covers key incidents, including past cyberattacks on power grids and water systems, and the growing threat from adversaries seeking to cause real-world physical damage through digital means. Lee also provides an inside look at Dragos' recent research and the lessons learned from major global cyber events, such as the attacks in Ukraine.

Main Topics:

Introduction to Operational Technology (OT) and its distinction from IT.
Cyber-enabled attacks on physical infrastructure, with real-world examples.
Ukraine cyberattacks on power grids and the lessons learned from these incidents.
Dragos' recent findings on ICS malware, including PipeDream and Frosty Goop.
The importance of a risk-based approach in ICS security.
Emerging threats and global cybersecurity trends, along with the role of collaboration between government and industry.

Key Quotes: "[Operational technology] is all the stuff you have in IT, plus physics. - Robert M. Lee "These are cyber enabled attacks that can have physical consequences." - Frank Cilluffo "[PipeDream] is the first time we've seen ICS or OT malware that is repeatable, reusable, and scalable across industries. It works in everything from a servo motor on an unmanned aerial vehicle to a gas turbine" - Robert M. Lee "There was an attack in 2017 where an adversary broke in to a petrochemical facility in Saudi Arabia explicitly to cause an event at a facility that would have killed people if they were successful." - Robert M. Lee "Right now in the operations technology community, we deal with low frequency, high consequence attacks. IT deals with high frequency, low consequence attacks. And if we start to see scale, we're going to start to see medium to then high frequency, high consequence attacks. We're not ready." - Robert M. Lee Relevant Links and Resources: https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf?hsLang=en https://www.dragos.com/blog/industry-news/chernovite-pipedream-malware-targeting-industrial-control-systems/ https://www.cnn.com/2024/04/28/opinions/small-town-water-systems-global-hacking-cyber-targets-lee/index.html Guest Bio:

Rob Lee is the CEO and co-founder of Dragos, a cybersecurity company focused on protecting industrial control systems (ICS) and operational technology (OT). With a background in military and intelligence, Rob has worked at the National Security Agency (NSA) and U.S. Cyber Command. He has been instrumental in raising awareness about the vulnerabilities in critical infrastructure and the need for better OT cybersecurity. Rob is widely recognized as a leader in the field, advising government agencies and industry leaders on protecting essential services from cyberattacks.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure

Related Podcasts

Links

Stay Connected