Gary Berman’s Post

Transcript

Hi, everyone. This is Gary Berman, host of the Cyber Hero Adventures show coming to you from Reagan International Airport. So if you're some announcements, that's what that is. And we have a very, very special briefing today with Doctor Georgina Shea, who's going to share with us some of the key takeaways from an amazing event, Georgiana or also George, welcome to the show. Thank you. So thanks so much for taking time before your flight. It was delayed. So that actually worked well for our audience. But I'm sorry it was delayed, but let's just kind of jump jump right into this. When I first learned about the report to the president, it's it's entitled the Strategy for Cyber Physical Resilience. There's going to be a link so that you can download a PDF version of it. I thought, wow, this is really pretty amazing and. The reason I thought that it was amazing is how with 27 other colleagues, some of the smartest people in the world about all of this, you know, stuff, first of all, you know, got together on a singular mission of the linkage between, you know, cyber and physical security. And so tell us, you know, what was the genesis of this initiative? Cyber physical systems security and resilience. The cyber physical systems is both information technology and operational technologies. So it goes beyond just your ones and zeros. It's the machineries that are run by software and hardware. So there's a kinetic output to what the ones and zeros are saying. And then the resilience aspect of that is ensuring that there's continued operations during the phase of adversity. So whether that's a cyber attack or a natural disaster. Supply chain disruption, human error, whatever. When you look at the critical infrastructure and supply and water, electricity, you know, health services, those those kind of things. Can't withstand A disruption. We need to continue operation. So we're focusing on the resilience of those machine and IT pieces IT OT cyber physical systems that enable those kind of capabilities. In the opening letter that you wrote to that you collectively wrote to the president you cited for example the colonial pipeline attack you know and and just the notion of water and things like that to the larger audience folks who are not in cybersecurity. One of the challenges is how do you cascade. You know this information that can be very complex into something that people will understand and that it does impact their lives like being able to drink water, you know or get gasoline or buy meat at a store just as some examples. Yeah, so we we have 16 sectors of critical infrastructure and those are those critical things that we can't live without is a nation. Energy, water, manufacturing, finance, finance, Department of Defense that. Industrial base 16 sectors and and all of these sectors rely on those information technology, operational technology combo cyber, physical systems that do things that enable our everyday life that we may not understand. You know like drink water have electricity. So you know the the paper really focuses on ensuring that we. We continue to have those necessities every single day. I think one of the major takeaways from the event that you also talked about in the report, you know is, is this notion of accountability. And So what is like I think there was minimum, minimum, viable. The minimal viable objectives or performance goals or products and services, Yes. So that help our audience understand that, Yeah, So every sector, the recommendation is that every sector should have minimal viable objectives. So for example, in the water sector that might be. No more than X people will go without water for X amount of days, right? X amount of water with X amount of days. Right now we don't have those type of minimal viable objectives for every sector. The objective is have water. So once you identify what those those goals are, those objective is minimal viable requirements for that sector. Then you can start sort of reverse engineering the the requirements to ensure that happens in terms of resilience. Recovery, resilience, recovery, identifying those critical systems, No. Indeed, indications of risk with those indicate that is critical systems and ensuring that. Let's just say for example you have the example I use is the DeLorean. Just so people kind of understand it, If you have the Back to the Future DeLorean and you've got tires, you've got a flux capacitor. If if a tire goes out, OK, no big deal, you can kind of patch it. But if the flux capacitor goes out, that's a lot bigger indeed. So if you talk about the flux capacitor of water, the flux capacitor of energy, the flux capacitor of manufacturing, what, what does that mean in terms of getting that back up and running and getting the water, electricity, gasoline to the to the you know, people are getting just to to build on that. I mean this is a massive sort of. Initiative, you know, across almost everything in American life. You know from day-to-day things. How do you prioritize? You know how to allocate your resources? Do you have appropriate resources from the government? I know budgets have just recently been leased. What's your assessment of all that, if you can say that you know publicly? You know, identifying those issues and giving the recommendations and then it's up to the sector to identify what their priorities are. So prioritizing their their functions, their critical functions and then identifying those critical technologies, what their, what their mission is and what they need to ensure that they're producing that minimal viable, you know, product or service. So it's, you know, it's not to me to prioritize, it's up to them and their their mission indeed. And you know one of the interesting things I took away from yesterday. This discussion was, you know, the, the threat actors, whether they be nation stage or criminals or gangs or tornado or tornado, like so. So. Yeah, yeah, of course. Yeah. Not just cyber. Yeah. Yeah. Which happens a lot. It happened to Houston. You actually talked about that in your report. Yeah, thank you. My focus is generally on cyber, but it's important to open the aperture, it's risk, the distinction between the cyber security piece of this and the resilience. Because a lot of folks will try to. You still got address. Yeah, good point. Yeah, for sure. Like cyber really focuses on keeping the adversary out of your systems. And we're really focused on if it's a cyber issue like they're in your system. So how do you continue to do your business well, So one of the other things that came from the meeting and it's it's in your report was this notion of an observatory. I can't remember if it was Phil or Eric who brought that up. But it's a notion of, of, of, of recommendations. Can you tell us about that? Yeah. So as as National Cyber Observatory, which is in essence a digital twin of our critical infrastructure, so that we can understand how we, how we look, what our posture is, what our weaknesses are, what our strengths are, what our interdependencies are, So that we actually know our systems and our strengths and weaknesses, vulnerabilities better than our adversaries. And I bring this up specifically on this. Never side with people because if you were to let's say penetration testing you you find your penetration testers, you give them information about your organization and they may have a month, maybe two months to do their homework to figure out how they're gonna break into your system. But when you look at, you know, real world activity, our adversary will say the hacking department of China, they're not spending a month to get ready to break into your system. They're spinning years looking at your system. So they pretty much know that our. Systems better than we do because we wow that level of effort or like understanding where you know our our security strengths and weaknesses are you know Doctor georgina.shea@fd.org and as I said we'll we'll have a place that people can download the report. On behalf of a grateful digital universe thanks for who you are and for what you do and most importantly why you do it. Thank you.