LT.
GEN.
ROBERT ELDER: All right.
It is great to be with all of you today.
I saw a few of you last night had one of those shots and one of those
at least one of those shots in one of those rooms.
I really am pleased to be here.
I'm grad to see a good crowd.
It is not my first DEF CON but it is my first time speaking.
Nikko said the topic the way it was listed wasn't didn't have
enough pizzazz so she put from nuclear
to cyber alternative approaches.
I want to make sure I get the nuclear part
in so you didn't waste your time or waste your ticket here.
So when I was in the military my primary business was
doing nuclear ops.
But interestingly enough, when the Air Force stood
up the cyber mission, they gave that mission to my command,
not because they thought it was like nuclear
but because nuclear was a global mission and they saw cyber
as a global mission.
But what I want to talk to you about today is that we somehow
or quite often are constrained the way we think
about cyberspace except in places like DEF CON.
What I want to do is I'm actually looking
to get some ideas from you quite frankly
because the people in this room tend to think outside the box.
But a lot of this is about looking at things a different way,
challenging assumptions and looking at the way we think about the world
and so the nuclear part of this is if you think about what we did
with nuclear weapons at the beginning, I wasn't born then.
But those weapons were being used for war fighting.
And so when we dropped them in Japan,
they were considered war fighting weapons.
Very quickly they said this is not a good war fighting weapon
and it became what they call now a political weapon.
It was used in a completely different way.
And then during the Cold War it evolved to something that actually caused
the then Soviet Union and the West to not fight
because they got so worried if they got into a fight,
a war would break out.
What's interesting is the weapons took
on a completely different context than they were originally created to do.
I think there is some parallels to that in cyberspace and that's what I want
to talk to you about today.
First I want to talk a little bit about some different perspectives
on cyberspace, different ways to look at it, I guess I should say.
I want to remind you how we tend to look at it typically
from a network protection standpoint, and then I want to try to argue
for possibly a different model to look at it that would be
a proactive view that looks at both defense and then assurance,
the ability to use it.
There is another model that DHS has put out that
they call their cyber ecosystem.
And I just want to show you that if you haven't seen it before.
Actually looking for some feedback for it.
And then tell you some things about trying to get that to work.
And then I want to talk a little bit about cyber workforce development
and extend that to cyber leadership.
One of the big problems we would have in the Air Force is that some
of our very best pilots, they loved flying so much that
they never wanted to leave the airplane and they got very good
at it but they could never get promoted and get into some jobs where
they could really influence some of the things going on.
They would end up complaining about it but they weren't able
to move up.
Some of this in terms of leader development
is I think we need to do more of that in the cyber world
because for the most part people making decisions related
to cyberspace didn't grow up from the beginnings that you are
all familiar with.
So the first thing and this is an old slide I used back
in the Air Force.
It has to do with getting people in the Air Force
to think differently about how they approach cyberspace.
What I found is there were three different ways
people in the Air Force thought about the cyberspace.
The first one was communications group.
Cyberspace is a different way we were able
to communicate, and so cyberspace is what we do because we set
up all the networks.
We set up the communication lines.
We managed those networks.
When they break down, we take care of it.
That view is actually a proper view.
And then you had the intelligence community that said,
well, you know, the only way to really defend
against attacks we are getting in cyberspace is we have
to have this really good intelligence.
And so the only way to, therefore, be able to defend the networks
is you have to be really good intelligence people.
So they argued that cyberspace should be controlled
by the intelligence community because they're the only one that
is would really fully understand how the intelligence and what that meant.
And then but the Air Force took
a different view of this, at least initially.
And they said, you know, everybody uses cyberspace and
as it grows, we are using it more and more.
We use it for all of our different operations.
And at first the things we did with cyberspace, we used it
to extend the things we are already doing.
If I could use a commercial example, these days nobody use Yellow
Pages anymore.
You go on your computer and look something up and get a lot
of information, you can Yelp it or something else and get a review.
That's a legacy capability to say I can use cyberspace
to do that a little better.
Then you have people that really took cyberspace and did things really
differently like Google or Amazon where they say
because of cyberspace I do things completely differently.
Up until now, for the most part, almost everything we do
is through cyberspace.
We do very little actually in cyberspace
to where we're operating inside the space and there
is some type of transactions occurring inside.
People say cyberspace is really a different domain
because it's manmade and you can't operate you can't live there yourself.
If you go into space, you have to have a space capsule.
You can't really go into cyberspace.
So they had some hard times getting their arms around this.
The point of this is what the Air Force did
is says we are going to put cyberspace under the control
of the operators.
What we did is we said, Intel people keep doing what you
were doing.
We want you to find out where the attacks are coming
and help us defend.
And com community, we want you to keep building
up these physical networks and do the things so we can operate.
Just some different ways to look at this.
When we tried to figure out how to leverage cyberspace, I tell people
the reason that we have airlines is not so that you can have a TSA.
You have a TSA to do security so the airlines can operate safely.
It is the same thing.
With cybersecurity, cyberspace does not exist
to have cybersecurity.
Cybersecurity is necessary so you can operate
properly in cyberspace.
Cyberspace is important because of all the things you can do
with it.
And so one of the things that it does, it gives you this capability
to bring together all these different communities.
And as you see listed up here, it can be whether it is a political,
it can be a military, it can be economic.
It allows you to do a lot of social things.
That's one of the areas we see growing
up substantially.
Of course, it allows us to have these information flows
all over the world.
So, it allows us to it is all about networking, right?
You have physical networks.
You have these informational networks.
And then ultimately you have people networks that are using this.
And that whole thing put together is what makes
the cyberspace so tremendous.
But it has these interesting attributes.
One of the attributes is that for the most part,
when people are operating there, it's you're anonymous when you are
operating it.
You don't have to be.
If you want people to know who you are,
you can tell them but, otherwise, you don't.
The other thing, if you are actually inside cyberspace,
if you will, it's some kind of an alter ego that's operating there.
Why?
Because you can't go there.
I mean, you have an username or something and it
is what actually transfers through the cyberspace.
So it is a different way to think about it.
The other thing that has made difficult for people to fully accept this is there
is no such thing as time and distance.
There is a funny anecdote.
We were doing a global exercise.
We had people in the Pacific.
We had people in Europe and, of course, people
in several different places in the United States.
We were doing a planning operation.
Of course, everybody was using chatrooms
and they had headsets on.
And one of the people that came into watch this saw these two people
that were right next to each other and they obviously were exchanging
information with one another.
And the observer said, that's odd.
Why doesn't he just turn to the person
next to him and tell him what he wants?
And they said we were kind of flabbergasted.
They didn't full appreciate the fact that there was another 200
people that were working on this project but they were
in all these different places.
So this notion of time and distance is really different.
The extent to have a virtual presence, it allows you to actually work
with someone and if you can break
through the fact that you don't have the actual human contact,
you can almost feel like you're doing that.
There is two other things about it.
One is that cyberspace information becomes a commodity and
as a result we get a lot of information.
We almost get more information than we stand.
Before we used to pay to get information.
Now we pay people to sort our information for us, right,
because you get so much.
And then the last one is this idea of a smart agent.
Once again, this is because you can't actually function
in cyberspace so you have to have an agent do it for you.
An idea if we ever took the smart agent to its full potential,
today let's say you wanted to order something off the Internet,
a tie to match a suit that you had, for example.
Well, you would go on to the Internet.
You would run a search engine.
Find some places that had it.
You might look up the reviews.
And then you would select that tie.
You would work the transaction.
It would then connect you with whoever was going to work
the credit card.
Then you get your tie and it gets mailed to you.
Well, if you had a smart agent doing this,
you would actually just launch your smart agent and
the smart agent would then meet with all these other smart agents
for you in cyberspace, go make you the best deal you could find
and then the tie would just show up in your mail, right?
You wouldn't be involved with this at all.
And eventually, I mean, hopefully as a matter
of fact that's where cyberspace will go because you
will fully leverage the capability the network brings.
Again, cyberspace is very powerful and just trying to expose yourself
to a different way to think about it.
Now, this group here would understand this chart
more than typical audience that I would talk to.
One of the big challenges we have both in the business community and then
in the government sectors is the way we operate, particularly
in the west, is it is kind of a seniority system.
So you start at the bottom and you work your way up.
And so if you look at the left side there, it's this hierarchical structure.
And the notion is that the higher up you are in that structure,
the more power you have, the more value you have.
And you are also better looking or at least that's what everybody that's
at the lower level tells you, right?
Well, in cyberspace, it doesn't work that way.
It is a network.
It is a meritocracy.
There is no top.
There is no bottom.
Your real power comes from how many connections you have.
If you have a lot of information but you have no connections,
you also have no power.
The more connections you have, the more powerful you are.
It is a meritocracy, so you can have a lot
of connections but if you all of a sudden kind of get lazy
and you are no longer contributing to the network, then your value
to that network goes down dramatically.
So that's very different.
Well, the problem that we have is that the people who have
after many years have risen to some level
by the left hand side model are frightened by the right hand model
and want to push back on it.
The reality is you don't have a choice.
When you are operating in a global system, it is going
to operate like a network.
You can't force it into a hierarchy.
We kind of learned that with the automobile industry,
by the way.
We thought because we could control
all the automobile sales that went on in the states they didn't need
to do all the things from a quality standpoint,
price control and everything else.
And then the global market came in and the U.S.
auto industry almost failed.
It was a very hierarchical approach.
They adapted the same kind of methods.
It became a global kind of a business again and now
they are starting to thrive and they are doing very well.
So understanding that you can't always force the model to operate
the way you want is important.
But for this group, understanding that you're fighting
the model on the left but you need to keep doing that and recognize that
you're operating this network but there are people that want
to connect with you.
This should look very familiar to you.
This is the traditional way people look I say "they," the Department
of Defense this is how they would look
at enterprise network protection.
In the interest of time, I don't want to walk through it.
There was a national strategy for cyberspace ops that came
out in 2006.
When they were looking to figure out how to implement it,
they said what are the difference things we need
to deal with?
They realized the attack vectors that are involved
in doing this are tremendous.
I mean, there are all these different ways that you can
get in.
This community knows better than most all the different ways you can
get in.
One of the funny things, if you want to call it funny, is they kind
of ignored the social part of it which is probably a good 80%
of the attacks come from.
When you look at some of the things they have
with the way we try to law enforcement, the CDNR, that's
the Commuter Defense Network Response capability.
So if you launch an attack, then you would have some kind
of a response.
But the reality is when people look at this, they say, you know, that's
an awful lot of different ways that somebody can
get at me so it must be impossible to protect.
And realistically, this community would know,
if you take this pure approach, it is going to be impossible
because the advantage goes to the offense in something
like this and you can't possibly defend against every possible thing that's
going to happen.
So that's why I'm suggesting we need some alternatives to this.
We need to have some different ways to think about this, and I asked
if I could talk to this group because if there was anyone
to be able to come up with groups, it would come out of this group.
You are phenomenal at solving problems.
There is one other thing I just kind of wanted to introduce in terms
of the problem set here, and that is if you look on the far left side of this,
you see the DOD networks.
They're controlled and operated a certain way.
They are somewhat closed.
They have done a lot of work to reduce the gateways
to the Internet but there are still gateways.
But there is an awful lot of information that's available
from a protect standpoint.
They have got a lot of intelligence and intelligence comes from a lot
of different means.
And that intelligence is not widely shared.
Now, they extend some of that to the other government networks
and they brought in the Defense Industrial Base,
that's what the DIB stands for.
Because they said our adversaries are going after the defense contractors who
are not as well defended.
Based on that previous model, they are going to have
to have more information to protect themselves.
As you move a little bit further to the right, now you get
into where you are dealing with state still government,
you have state and local governments.
And they get information but they don't get
as much information as they are getting
on the federal side and they don't get
the same levels of protection.
Of course, you have the Einstein and things like that that they've tried
to put in place to do that.
They have done a lot of work for ISACs for information sharing
and made a lot of progress but, again, less information available to you.
And then you get to the far right which is everybody else.
What's interesting is that the information that's now becoming
available there, it doesn't have some of the sources that, say,
the Department of Defense has but the sources are really good.
And as a result in the commercial industry,
people are going and being able to obtain product that
is really do provide a level of protection.
But it is still based on this old model, I guess I would say.
One other thing I wanted to show here is which goes back
to the nuclear part, you get all the way to the bottom where it talks
about the weapons of mass destruction you may
or may not be happy to know none of those operate on a network,
as you would think of it.
They all use circuits.
And that's done for obvious reasons.
They are worried about somebody getting in.
The other thing is it is highly redundant.
So it's not the necessarily the most efficient way, but it
is a time proven way to be able to do to protect a particular piece
of information or a capability that you have to have.
I said I want to give you two different models
to look at.
And what I would really like to do is hopefully stimulate someone
to come back and say: Have you come about this model and come
up with a third model.
This one was actually developed by an Air Force scientific advisory
board studied back in 2008.
Their approach to this, if I take a few minutes to explain the chart,
is they took the ISO layer.
If you look in the middle you will see the ISO layer identified there,
but they put them together so you don't see 7.
They put devices and linkages together, hardware systems together.
But then they added two layers to it.
They put a human organization and mission layer.
They started with that foundation.
They said, what do the attacks look like on those different layers?
And so what you see on the left are the things that they did to try
to characterize how those attacks would be done.
And when you look there the reason I put this attacker photo,
if you are going to deal with those different types of attacks,
you have to focus on the attacker and the intelligence on how
the attacker operates.
The other thing they said is what is the effect of the attacks on the users.
You see those listed on the left hand side.
There are high levels, you get confusion,
and it disrupts our ability to do command and control.
At the bottom, you get performance loss.
You lose your communications, it completely malfunctions.
The reason they thought it would be useful
on the right side that's almost completely done by the operator.
We refer to it as resiliency or mission assurance.
So what they said is if you are going to try to deal with this problem,
you would need to look at this thing and break it
into component parts.
I don't know how many in the room are engineers,
but that's how engineers think.
You take a complex problem and break it into parts.
And so they start trying to look at this thing.
So on the left side you have this intelligence and attack response that's
traditional with your network security.
You have this mission assurance which has been a traditional way that
the military in particular but businesses do the same thing,
business resiliency.
One of the things the business community,
particularly the financial community, does that we don't
for the most part do with our networks
is transaction control.
So there is this anonymity on the network
but if you put controls on the network, then typically it's
a ledger/journal type approach.
But it makes it more difficult for something for a change to be made,
alteration to be made without it being detected.
That's how they and a lot of businesses have those kinds
of controls.
That's how you avoid embezzlement, by the way.
But then we put this other thing over here.
We said it would be a proactive defense.
What the Scientific Advisory Board said if you look at these different layers,
if you think of them as targets, if this were a military problem,
you would look at those targets and say: What can I do
to make it difficult for my adversary to be successful?
There is three typical things you can do.
You can harden it.
You can maneuver it or obfuscate it like Stealth or make it camouflaged so it
is hard to see.
They said perhaps we should identify some of these really critical areas.
And that's how we should be looking to spend our resources.
But part of the problem is that we have not had a lot of good,
proactive ways to deal with this developed.
I wanted to show you some of the things that have been done.
If you look from a purely network security
standpoint and you look at this left hand side there,
what we can do is say, well, in addition to the normal thing,
they've set up these virtual machine sandboxes.
They have done things to monitor user behavior to look
to try to detect to say it's not the right person on there, some kind
of two factor authentication.
There has been transaction controls primarily
in the business community because it fits for them easily.
There's products out that will monitor your registry and,
for example in fact, in the Department of Defense now, it
is called host based security system.
When you first connect to a network, it actually looks to see
if your registry looks the same as it did before and it alerts.
It doesn't do anything to fix it, but it alerts you that your registry
looks different.
You can do things with the hypervisor that operates how
the monitoring system behaves, to see if someone tried
to put something in there.
And then at this lower levels, they can put in resilient capabilities,
if it takes out a router, there is another pathway, that type of thing.
But these are still the fairly traditional approaches.
If you want to try to take a look at how you deal with these targets,
these are some of the things and a lot
of them become more process oriented.
If you found some ways to put some technology behind it,
it could be very useful.
So the idea of the two person controls, that's another nuke part
of this thing which is one of the ways that
they make sure that some single person can't do something with a nuke.
You can't do anything unless you have two people and they always put
the controls far enough part that you can't possibly do both of them
at the same time.
If you are trying to deal with people understanding
the target so if you're a good hacker and you go
in and start looking at a system and start doing
all of your reconnaissance, if that system changes, they rotated
the process, they changed the system or process,
then you have to start over again.
That's considered one of the proactive ways that you
can defend.
That's a maneuver type or maneuver thing.
The session controls, they put a lot of there's some different products that
work with session controls now that look to see if a session's been hijacked
and they basically can terminate the sessions and minimize loss
of data or damage to the system when they do that.
There has been some things done with operating system obfuscation.
It actually looks like it has a lot of promise.
The only reason you don't see much of it being done
is that once you do that, the people administering
the network have to know a lot more about the systems
to be able to deal with it because it is going to look different
to them every time.
They have to know kind of what's behind the curtain
to make it work.
And then the bottom there you see the banks do a lot of this, by the way.
They shift their hardware.
So by rotating hardware is the same thing.
When you are trying to if a hacker is trying to come in, one time
they go and it is one piece of hardware, another time it is a different piece
of hardware complicates the problem for you.
The other thing they try to work with is device diversity.
It is not what they do in the Department of Defense,
by the way, which is a little bit problematic.
They want to make things standard so they are
all the same, right, but no diversity.
If something goes wrong with one of them, then they're all going to fail.
But in the business community, I think they have been
a little smarter about that so you see a lot
of diversity with machines, operating systems, routers, all parts
of the network.
That's one way to think about the proactive defense.
I bring this to this community to look at because you might have some ideas
for how technology could aid this.
But when you take a look at how you do things
from a mission assurance standpoint, it typically involves having some type
of redundancy.
So if you are trying to determine if someone has done something
with your sensors, if you have more than one sensor,
you can compare them and at least you know that somebody's
done something with that.
In an airplane, that's pretty typical.
They have all of the critical flight controls
all have a backup and one you do all the time, to check to make sure
they are the same.
If they were a different, then you try to figure out which one is correct
and which one is wrong.
You assume in most military operations that you are
going to lose communications so they put in what they call
a lost communication processes.
If you put those kind of things together, that's another way you can deal
particularly with some type of an attack that actually caused your
coms to go out.
The redundant type apps means instead of using just one particular
application to do whatever your process
is you had more than one.
By the way, in the Department of Defense, that's enigma to them.
They said we will standardize and have one.
Business community says we will have three or four
because if one breaks or quits working, I want to have a backup.
They started dealing with some of the attacks.
I wanted to go to the talk yesterday that was talking
about some of the ways to beat some of the systems for dealing
with the DDoS attacks and I wasn't able to make it.
But they have some things that they put in place there that
at least would try to mitigate some of those effects.
And then when you get down to the hardware layer,
the only way to do that is to have more than one path.
One of the strange things about people when they talk
about cloud computing and things like that, cloud competing is great
but if you only got one circuit leading to the cloud,
then you only have a circuit.
So if you don't figure out a way to leverage
the cloud and you don't have multiple pathways into the cloud or
into that network, then you have a limitation.
So that's this one model that I guess I'm hoping that some
of you would have some good ideas about how to do that better
or some technical ways to take advantage of that.
This next one is one that was actually put out by DHS.
And their idea was they were going to try to teach or treat cyberspace
as an ecosystem.
And the thought there was you were going to have a static defense
but you are also going to have this dynamic defense.
And if you look up there, the things that they have
under "prevent," those are pretty typical.
They insert a couple of other things that they would
like to see, like the moving target idea.
I talked about it in the other one.
A big part of this thing is you want to have a way
to detect something happened.
For the most part, most of the major attacks that occur
whether it's in the commercial sector or it's in government,
it happens because they actually start seeing
the impact.
And by that point, it is so far down the road that it
is very difficult to contain.
So trying to put processes in for detection gets to be important.
That's still considered kind of the static piece of this thing.
On the dynamic side, they want to have a lot of information sharing.
Why?
Because if you are only looking at small points, it's one thing
to be able to sneak under the radar
because you avoid crossing a level.
But if you are able to bring in from multiple places and you say,
hey, there is this kind of an odd behavior, abnormality here,
same thing here and same thing here, now you say maybe there
is something going on and by combining the information,
you can leverage that.
When you see that, then they want to have processes in place
to respond and then as soon as they can kind of put things
under control, then they want to have processes to recover.
Part of it that's recovered, by the way and it is kind of interesting.
When talking to some people from 9/11, they said they thought that 9/11 was
the first cyber attack and the reason was nobody could talk
to anyone after it happened.
It took out no one could talk on the cell phone
because everyone was trying to talk at the same time.
The towers went down.
They took out some of the PBX systems.
So com virtual stopped in New York City at a time when
they really needed it.
And even the first responders were having
difficulty with communications.
Something similar with Katrina in Louisiana.
They actually saw where there was a problem occurring with one
of the levee breaches, but they didn't have a way
to communicate because they lost they had lost the power and,
once again they didn't realize this.
When they lost their PBX system, the cell phones at that time were
all tied into the PBX system.
Once they lost that, they couldn't communicate so their
ability to respond was lost.
So a lot of this is having courses of action that get you up very quickly
to where at least you have a capacity to do these public safety types
of things.
But you see at the bottom, they want to try to establish a trusted broker.
That's what they try to do with these information sharing analysis
centers, these ISACs that they have established.
So we did a workshop, the Cyber Innovation Center for DHS.
And we brought some people in from industry.
We brought people in from academia and government
and DHS.
And we actually tried to look at some different situations that were
would be dealing with a first of course, DHS is interested
in a hurricane type thing.
So we were doing a couple different scenarios that might
be a DHS type operation where cyberspace
would be affected.
And we started looking to see what would be
the impediments to doing this.
And I got pages and pages of the things that they highlighted,
but a few things just to highlight that I have here
and my goal is not to read this to you because I want
to leave some time for questions.
But bottom line was that even when we had these experts in the room,
it was very difficult to get them to think beyond the protect piece.
We would tell them, it didn't work.
We've lost cyberspace.
And that was one they would go back and fight.
No, it didn't happen.
It did happen, you have to deal with it now.
And that mind set makes it very difficult to get these other parts resourced
because, you know, the government, businesses for that matter,
they don't want to spend money for things that
they don't think are going to happen obviously.
So part of the things we have been trying to do,
the DEF CON community does a great job of this which
is highlighting the fact that it's if someone really wants to get
into your network, they're going to get in.
And we keep trying to reinforce this with people
in government and in business.
But then to get them to actually do the resources is really difficult.
The balancing piece that you see there really has to do with the fact
they always want to put the money into the protection which is good.
We've argued that if you assume that the protection
is going to fail, there's some smart things that you can
do to set the stage in advance so that your ability
to basically respond, minimize the impact and quickly recover would
be helpful.
We then talked about some things from a detection standpoint that there's
a lot of noise on most of the enterprise networks.
It makes it difficult.
A lot of the things they have, the automatic detection mechanisms
throw out so many false alarms that it is very difficult to deal with.
This is actually one of the things to go back
to the operational community.
So whether it is a business or the government, people using
the system say we really need to have you not do these things
because when you do that, it throws so many junk
on the network that we can't really tell when something is going wrong.
There was a lot of interest in trying to set up these automatic systems
to where the machines would automatically
respond to deal with these things.
And there's some problems with doing that, particularly some
of the drastic or draconian response you would have.
So one of the things we discussed is that you really you need
to have a way that you can keep a human
in this decision making loop but be able to basically be operated
in a sensor response system that basically goes
at the speed of information.
And then, finally, I guess I actually talked
about the last one there, about balancing this is really
for the people that figure out where you should spend
your money.
They need to have a process to figure out how to do that.
So now this is my appeal to this community here.
When you look at this workforce, these are the different elements that are
involved in doing this workforce.
And if I went across this room, you'd see that parts
of you are involved in all these different places here.
And we do a lot of stuff looking at trying to eliminate
the vulnerabilities and we do a lot of things trying to figure out what
the threats are.
But there are some really good opportunities
in the software assurance, in the parts that actually look
at the resiliency of the transaction controls.
And then one of the things we can do to help make the users
of the network more accountable for their actions and more careful
about their processes, I bring this to you because I think this community
could actually implement this and make this work.
So that's the workforce part of it.
The leader part of this is kind of interesting.
This is a typical model for any kind of a pyramid type organization, right?
But you have all these different functional specialties
at the bottom.
And just like we showed on that little chart before,
the communities come from many different places.
We tend to get good in those individual areas.
But the people at the next level, the operational leaders, they are
the ones that are able to integrate and pull these things together.
In the cyber community we haven't done a good job of figuring that out.
We tend to be very stovepipe.
So a lot of the things we have been trying
to do is encourage people who have expertise in one part
of the cyberspace to cross over and do something else
and learn about that other piece of it so they can help later
with this integration.
The strategic level, that's where we actually are trying
to tie the thing back in.
And you try to make it useful.
And the other part that we're trying to do is we have a lot
of strategic leaders today that know virtually nothing about cyberspace.
They don't want to know in some cases.
But it's incumbent on us to try to get them to understand
the things that you know about cyberspace so that
they can be better strategic leaders and
they can better leverage cyberspace.
So that's what I hope that I was able to talk to you about today.
I think I left a few minutes for questions.
I'm happy to take questions.
I brought my pen with me because I'm happy to take ideas.
Thanks so much for spending time with me.
And I hope you have a great DEF CON.
(applause) Where are you going?
You don't have any questions?
You with the long hair.
Come back here!
Anyone have any questions?
Come on.
Needless to say they don't give us wireless mics here.
(laughter).
You really tantalized us with conversation
about nuclear weapons and they are not connected
to the Internet but connected via circuits.
I know you probably can't give us details, but at least tell us you have got
the best people on this.
(laughter).
LT.
GEN.
ROBERT ELDER: And it is all two man control, too.
No, they're the Department of Defense and the Department
of Energy both put their best people.
It is kind of interesting, we talked about this two person thing, by the way,
it even goes the Department of Defense does not own the weapons.
The Department of Energy does.
And it is done that way.
Everything is split right down to the weapons itself.
So the Department of Energy owns the weapons, not
the Department of Defense.
It is that kind of approach that they really try to lock themselves into.
I tell you, though, it is kind of interesting, if you think
about administrators on systems see, the banks do this, by the way.
They set up their superadministrator accounts
and it takes two people to be able to get into the log or do anything
to affect it because they don't want anybody
tampering with the logs.
Again, it is a two person approach to things.
The point is, there is a lot of things we can do that wouldn't
necessarily cost a lot of money but we just haven't had
the people think it through enough to figure out how to do it.
We don't have the people with the expertise.
Earlier you drew a comparison between TSA
and cyber security.
I was wondering, so if we don't have a TSA, we know
the things that happen.
People put bombs on planes.
People turn planes into bombs.
Can you imagine a cyber world without a dedicated cybersecurity force
and what it would look like?
Why do we need that in the way we need the TSA
to protect airlines?
LT.
GEN.
ROBERT ELDER: When the Internet was established what's
funny about the Internet, when you go back
to the initial ARPANET.
I will give away some of my age.
I got to use one of the initial ARPANET terminals.
It was a research thing and trusted people working together,
just like you would go to a bar and you would tell your
buddies a story about something going
on in your life and you trusted them.
That's the whole origin of this thing.
So now what's happened is after the fact, we're having
to figure out a way to make sure that people don't use it
against you, if you will.
And so the cybersecurity is, basically, how people can still use cyberspace
but have a way to feel like they're still protected.
But the reality is, I think you need to have a dedicated cybersecurity force,
but I also think up with of the mistakes we make
is we let our users off the hook, particularly
on these enterprise systems, and we don't hold them accountable
for their actions.
Because the best defense at the point of the spear
is for that person, that operator that's on the system
to say, that doesn't look right and then do something
about it rather than wait until it gets so big that you do have
to have the cybersecurity professional come in and deal with it.
No, there's no way we can ever go back.
The cybersecurity field is going to continue to grow.
My argument here is there are some other ways it should
grow beyond a purely security and into more proactive defense
and this mission assurance type of approach.
I'm sure everyone is happy to hear that Elvis Presley
is in the house and has a question about cyber.
(applause) Thank you very much.
Thank you very much.
I'm Elvis.
You may have heard of me.
I'm kind of a big deal in this city.
So one thing that has happened in history is, like, for Pearl Harbor,
Pearl Harbor came out of nowhere and brought us in.
Even 9/11, before 9/11 there were people already
saying the things that needed to happen and no one wants
to spend money until after the crisis.
We even saw it for Y2K and you were probably
like 50 then or so.
Even for Y2K (laughter) there were people saying there's problems
in code and when it rolls over there could be a problem.
There were people that told Congress this.
We always waited until the last minute.
For cyber, we're doing the same thing.
We're saying the same stuff.
And I'm glad that you're here and you are giving a lot
of good information and you are soliciting information.
I think it's great to partner like that.
But what's being done to actually get the wheels
to actually turn?
Are we going to have to have like a cyber Pearl Harbor
before anybody really wants to put money into this?
Because everything will cost money no matter how smart
we are.
LT.
GEN.
ROBERT ELDER: That's a great question.
(applause).
So, first, Elvis, the bad news is history has a tendency
to repeat itself.
So before we really see them putting the money into this that they need to,
there will probably end up having to be a cyber Pearl Harbor.
That's the bad news.
The good news is that in a lot of the sectors, business people
like to make money but they are also risk adverse.
So they actually bring in risk management principles
into the way that they do these things.
So a lot of these companies are now starting
to invest the money that they need to, particularly the larger companies.
I will tell you the defense contractors, they now with what
they now know about what the threats are,
they are definitely putting money into these type of things
because they are fully aware.
The banks understand it.
Some of the other communities have done that.
So the communities that recognize that their ability to continue to operate
the way that allows them to make money or do their business,
they are now starting to put money in those kinds of places.
But we're still, like, maybe 10% of all the sectors in the United States.
And everybody else just assumes that the government is going
to protect them from this.
And this is not something I mean, cyber com is not going to protect
the small business owner from a cyber attack.
Once they figure that out I told people it
is like the 12 steps for an alcoholic.
First step is you have to admit you have a problem.
The thing that scared me when we did a workshop,
I had these experts in there.
Even with the experts, they kept trying to go back and say,
well, clearly we'll figure out a way to keep this from happening.
And it's very difficult to get people into that mind set.
It is one of the things that you guys
through these conferences do, is you highlight
to people that there are these vulnerabilities and hopefully repetition,
they'll hear it.
I applaud you to do that.
And I encourage you to do that because that's the only way we
will get the message across.
Three questions.
One question.
There is two other people and we got to get out of here.
I will say all three at once so you get to answer
all of them at once.
I like it.
You are manipulating the system.
That is inappropriate.
(laughter).
One of the things that we've seen DARPA do is they have engaged
the community through the cyber fast track.
Apparently cyber fast track has turned off.
Will DHS pick this up or will the money go
to the big contractors or slow innovation or will we see
the same kind of initiative engage this community
to develop those unique ideas, those unique defenses?
LT.
GEN.
ROBERT ELDER: I thought DARPA still had money in the cyber fast track.
Defunded.
LT.
GEN.
ROBERT ELDER: That's typical for DARPA.
DARPA is supposed to get things started and have other
people pick it up.
What I can tell you is that DHS does have some programs.
In fact, the stuff that I do at the Cyber Innovation Center which
is pro bono work for me is work that's actually funded
by the National Science Foundation and by DHS.
If you go around the country, there are a number of are they tend
to be non profits that have stood up all around the country that are
starting to take this thing on.
So it's becoming somewhat of a grassroots effort.
And I'm actually encouraged by that.
There is a lot of interest to do that.
It is not going to have the kind of funding that DARPA was able
to put into it, though, that's the challenge.
The other thing that's being defunded is the DIB.
You have mentioned the DIB during this whole process.
Who is going to take that initiative?
LT.
GEN.
ROBERT ELDER: So the DIB pilot went
out but the information sharing continues.
They do have the information sharing piece
but they are using the ISAC to do it now.
To what degree do you think from an information assurance
standpoint you can start selecting the guy that wrote black swan would
called anti fragility.
We are in an environment of a few large targets,
large target sessions, crack exploit everywhere.
Where what we need to do is start going towards a diversity
of smaller, more robust targets.
Are how are we going to get that changed
around since the business imperative seems to be
toward conglomeration and single source support, much
the standardization much the way the DOD does.
LT.
GEN.
ROBERT ELDER: You are exactly right.
It is a huge problem because particularly
in the business community, they're looking for efficiencies.
Sequestration in particular, everybody is looking for efficiency
in government as well.
Where I see some encouragement, by the way, for your question
is actually in the business community and
the process that they're using is a risk management process.
They apply it across their business.
They are now starting to apply to their cyber systems.
What I'm worried about is they're now starting
to do some things like in the industrial sectors
with the industrial controls, things like energy, transportation,
they're now starting to look at this.
But it turns out they are looking at it and they say, you know,
we design it had to be this very efficient system.
It is difficult to go back in and reengineer it to be the other way.
They are starting to do it now.
The only way to keep this thing going we have
to keep telling the business owners, we have to keep telling
the Congress that it's important to not put all your eggs
in one basket and demonstrate to them what could happen.
Sir, you did a lot of talking about the processes and
the high level strategies.
One of the things I've seen over and over again
in government organizations that I work with is that this is about the people.
The government has gone to a point where it
is about the certifications you have, DOD8570 and so forth
to where we have lined a lot of pockets of certification companies
in an effort to prove that people know these skills.
But on the outside, in the commercial sector,
that doesn't seem to be the case.
They don't have as much desire to have people with certifications
to be able to prove they can do the job.
If they can't do the job, they move on.
And they have a hierarchy set up to allow people to grow
within their organization.
And most government contracting companies that I have seen and
the government military and civilian markets as well,
they want people to get a large breadth of knowledge.
Is there any thought about maybe changing that paradigm
to where we get specialists?
Where we let people focus in on the technical aspects
on the things they like to do, that they're good at,
and let them stay there without penalizing them
in the system and maybe getting away from making it so hard to get rid
of people and encouraging growth from within.
LT.
GEN.
ROBERT ELDER: Yeah, so to be perfectly honest,
I still have friends in government that work
on the personnel sides of things and they are actually looking
at the exact type of thing you are talking about.
A lot of the standardization piece, it is funny, they were trying
to mimic what they saw on the outside and they said,
we should try to do something like that.
Of course, whenever the government does something,
it turns into its very bureaucratic and you lose sight
of the actual objective and you get locked
into all the processes bureaucratic processes.
But there is a huge effort, number one, to grow a cyber workforce, especially
in the Department of Defense and the other government agencies
and they are looking to find ways to make it attractive for people
to do that.
So the types of things you are talking about are
all being considered.
So one of the things, by the way I'm not
in that business myself but I have a lot of friends that still work with that.
And so I will give you my card because I'm looking
to get those ideas and I will pass it to them.
So let me make sure I give you a card before you run out of here.
Thank you very much.
(applause) All right.
We need to close the stage for the next speakers but we
will take the General over to the Chillout Cafe.
So he will do some Q&A there before he heads out to the airport.
All right.
Thank you very much.