I said I was going to call this "Information Sharing Is
Broken," but I figured there would be about three or four people show
up so I decided to make it sound a little bit more provocative.
One of the Cardinal Rules of public speaking is never apologize.
Well, I'm going to break that right now.
I had a irrecoverable hardware failure last night, so we have no slides,
so which means you only have to listen to me.
So I'll try to be as entertaining as possible.
I'm always a little bit anxious, but I'm also very appreciative when I'm
talking with an audience of my peers.
Usually many of you you can put your hand
down now know more about some of this stuff than I do, so feel free
to interject as we go along here.
I don't think I'm going to break any new ground here today.
I'm probably going to pull together
a few things that people have thought about kind of independently,
and what I really want to do is provoke a conversation.
When I spoke here last year, some of you may remember I did a keynote,
but I was a fed at the time, so I was a little bit restricted
on what I could say and how I could say it.
This year I'm not.
And I'm not.
(Applause).
But I'm also not here to bash the government and poke anyone
in the eye.
I have a lot of great friends in the government, at the US CERT,
the NCIC and the other government agencies,
and they work very, very hard just like most of you do, a lot
of time without a lot of the accolades that go along with that.
So I'm not going to poke my former colleagues
in the eye there.
And I'm not going to get close to crossing any lines
because I know there's people out there taking notes to poke me
in the eye with my own words if I do cross that line, so I'm going
to avoid that.
When the title of my presentation was published,
a few people called me to ask me if I wanted to talk
about this issue now that the Snowden and
the prison thing came up, and actually I was
a little surprised about it because that's not what I'm
talking about.
In fact, it's the farthest thing from what I'm talking about.
What I want to talk about today is the kind of defensive analysis,
the counter measures and signatures that each of you are doing,
developing within your own companies
and sharing with each other every single day
without the help of the government assisting you
in doing that.
I noted that's one of the roles of the government, but that's really
the context of what I want to talk about today.
And I'll tell you, I don't pretend to have all the answers here either.
As I said, I want to provoke a conversation.
And as I started putting this thing together, I canvassed a bunch
of my colleagues and the general consensus is this is, in fact,
a conversation that needs to happen.
I know General Alexander said that very same thing at Black Hat
during his keynote, but this is a different issue as far
as I'm concerned.
So I could ask you for a show of hands to see who
in here thinks classified government information is of any value, and
since probably most of you have never had access
to or seen classified information, it wouldn't really be you wouldn't know
if it was of any value to you or not.
And I talked to a few of my friends, and several people asked me why
I thought the government cyber security
intelligence was of any value to the private sector to begin with.
I thought that was kind of an interesting response.
In fact, one guy said from the public sector side,
it's probably just as valuable as it ever was.
From the private sector side, it's probably just as useless
as it ever was.
Very interesting.
So that's a great point.
And after being in D.C.
for the past four years, the last couple of years
with a ringside seat in the government, I have a little theory now.
And one of the great struggles that I had
in being a government I'm a terrible government employee.
I just I wasn't good at it.
There's too many restrictions, there's too much you just can't there's
too many boundaries about what you can say and do
and how you say and do it.
So my theory is this: Washington, D.C.
occupies 61 square 61 square mile geographical footprint.
The entire continental U.S, including Hawaii and Alaska
is 3.51 million square miles.
So percentage wise, D.C.
is geographically negligible.
Here's my theory.
There's so much power in Washington, D.C.
that many people think they actually know more about you
and your business than you do.
A lot of people in government talk
about the private sector like it's some kind
of third cousin from Moldova.
Actually, I stole that line from somebody the other day.
But it's true, people in Washington, D.C.
talk about the private sector even though most
of them have not worked for the private sector, and
they don't really understand the struggles that you
as cyber officials face every day where you actually have to meet a payroll
and you have different responsibilities than we do in the government.
It's a bit of a cliche, but we hear it said a lot that 85%
of the critical infrastructure in the nation is owned and operated
by the private sector.
And I don't know if that's true or not, but I think for discussion purposes,
probably close enough.
But it's simply not logical to think the government can know
more than know more about 85% of the private sector than those
of you who are in the room today.
Those of you who are working in these organizations essential
every day.
So as I said, no government bashing, I'm not going to I'm not going to do that.
But I do want to give you the bottom line up front
for you acronym word buffs.
Bottom line up front, and for those of you that this pops your bubble,
I apologize.
And you can probably get up and leave and it won't hurt my
feelings after that.
The government is not going to come in on a big white horse and save you.
It's not going to happen.
The government doesn't have the resources.
There's just no cavalry.
By the way, as I look through the looked through the agenda,
Nick and Josh are going to talk on Sunday morning titled
the exact same thing.
The cavalry isn't coming.
I suspect they're going to talk about some
of the same things I'm talking about today.
The government is simply unable, at least today, to provide timely
and actionable information when you really need it
because the legal policy and operational restrictions
within government are not designed to share with the private sector.
I know that we've had this discussion, public private partnership for years
and years, but it's not working like we hoped it would way back then.
After working there for the last couple of years, I realize
as much as we want it to, it's probably not going
to work well enough in the private sector to depend
on it consistently at least in the area of security intelligence sharing.
The pace of innovation in the commercial sector
is far more rapid than in the government,
and primarily because Darwin's theory does apply
in the private sector.
You know, the strong and the sustainable survive and
the weak don't.
And the government not so much.
In fact, there's so much growth in the private sector development
of cyber security intelligence right now because industry realizes that it can,
in fact, move faster in collecting and analyzing specific intelligence
that's important to them.
Private companies will monitor ICU channels and sites,
like Paceman, just like the government can,
but they can't collect and disseminate information like the government,
and they can't weed out the chaff to meet their specific
government needs.
The government is a huge bureaucracy, and that's probably not a big surprise
to many of you.
It was one of those things that when I went
into government I thought I could change it, and some
of my friends told me I was foolish.
They were right.
So there are a lot of reasons I think why getting any
timely decisions are possible, and lawyers being one of the factors,
sorry about that, I just met a lawyer a few minutes ago.
But they needing to get approval before making important decisions
I think trumps everything.
They're leaving, I already bummed them out.
It's a fact lost on bureaucratic organization,
but in our business there simply isn't time to get everyone's approval
before making a decision.
This will make my some of some of my attorney friends mad at me,
but I find government lawyers, not always,
there are some good attorneys out there, but they are incredibly risk
averse, and they don't understand cyber security.
And that makes it a challenge for us in the operational trenches
to do our jobs.
I know that they don't understand it
because I've seen the look on their face sometimes when I give
them my look and I'm like, I can't believe you're making me do this.
But anyway some of you know Shawn Henry, Shawn
is he's out of the government now, too, he was spent a career in the FBI.
Shawn was interviewed a few weeks ago and he said
as a private citizen and taxpayer it's frightening.
We sit here, more than six years later, arguably in a worst place than we were
before, and we're still talking about voluntary guidelines
and studying vulnerabilities.
So I think the time has passed for that.
What is the value of cyber security and intelligence?
I've been thinking about this for a long time.
When I was with NERC, I read about things classified
about the electric utility industry, but the people who needed
to know it didn't have security clearance, so
the value was useless to them.
And even when they did get briefed on classified information,
it was usually information that they said they already knew about,
so the value, the timeliness of the government information was
always behind the curve.
But there continues to be a mystique to classified information.
People feel like they're not getting it, they're missing something.
But when they do get it, I think they're usually disappointed.
My CEO, he actually had a top secret SCI clearance.
After the second time he got a brief, he's like, why am I doing this?
I'm not learning anything new.
And this is an absolute waste of time for me to go go
through these briefs.
I think it's not necessarily unusual for the kind of information that
the government does provide to the private sector.
When I saw started at VHS in November of 2011, the first thing
the first document I read was by Carnegie Mellon,
who documented the defense industrial based pilot.
I think probably some of you have seen that or read it
or heard about it.
But anyway, the DIB pilot classified measures
and signatures to certain defense related private sector
companies, and there were about 20 companies that participated
in that pilot program.
The report wasn't flattering.
And even though there were, I think, some rational explanations for why,
it makes my case here today, so I'm going to use some
of the numbers a little bit.
Of all the incidents during the period of the DIB pilot, about five months,
only about 4% of those signatures and counter measures were unique
to the private sector.
Let me say it again.
4% included information that the private sector DIB companies did
not already know about.
Now, to be fair, I think the expectations weren't established
appropriately to begin with, and the program was getting better
toward the end, but the bottom line is that the private sector found very
little value in the information that the government was providing back
certainly not enough value for them to spend money
to continue participating in that.
And if you think about some of the other private sector reporting,
some of the things some of the public things we've seen
about over the past couple of years the tracking gross netting reporting,
I think it was 2009, the McAfee shading report,
the Luckycat report put out, and MSAPN report.
It was where actually the DNS Corps flood,
the government eventually got involved in it.
Most of the initial work done on those was done
by the private sector.
And then the annual reports by Verizon, Semantic and McAfee,
which have a good accumulation of information those organizations have
seen over the past year.
Anyone remember the Conflicker Working Program?
Some of you were probably part of the Conflicker Working Group.
That was coordination and collaboration
by the private sector to develop something really important
and really useful.
And these guys and gals actually spent time and spent money
out of their own pockets to help everybody, to help the nation;
and despite Herculean efforts to get the government involved,
they did that on their own.
That was a private sector initiative.
If you haven't read Mark Bowden's book, it's called "Worm," titled "Worm,"
it walks through the entire Conflicker
Cabal incidents.
This was in the private sector.
You can agree or disagree with some of these reports.
I don't agree with everything that's in some of these reports that were put
out over the last couple of years, but the bottom line
is they were developed without the government involvement;
they were developed in the private sector.
I think one interesting thing that came out of that was they had
the unintentional consequence of forcing the government
to actually acknowledge some of the nation's state actors that were
involved in some of these events.
That was one of the things when I was
the Deputy Undersecretary at DHS, as I traveled around the country
and met with different companies, the almost continuous theme I got was
why isn't the government doing something
about this?
And not really part of this discussion today,
but I can tell you one of the biggest discussions we had
on a continuing basis at the highest levels
of the federal government is what is the role of the federal government
in some of these events and some of these activities,
especially where nation states were involved.
So I think it's a legitimate question to ask, does the U.S.
Government have a greater U.S.
intelligence gathering capacity than the private sector?
And I think it depends.
It depends on the value of the cyber security information,
because it seems to be an increasingly small subset
of information potentially available to identify
the source and understand a tact methodology
and adversaries' capabilities.
This brings us to what I think is probably one
of the most important problems with government information
and that's overclassification.
Anyone in here that has has had access to classified information I think has
thought this from time to time, that the information you're seeing
is the same has a classified sticker on it, is the same information you saw
on CNN yesterday.
And this is really a big problem for us for a whole lot of reasons.
But primarily, you know, information is classified primarily
for two reasons: One, to protect the source where
the information came from; two, to protect the method how
the government obtained that information.
Most security officials, I certainly know when I was a CSO,
I didn't care about that.
All I cared about was the information of value
to me and could help me protect my systems and my networks.
So I think the government has to get better about taking that kind
of truly classified information and and declassifying sanitizing it so it's
of value to the private sector.
I'm not saying there isn't any value in any classified information,
because there is, obviously, and government
is rightly responsible for that.
It's just that once the information does become classified
it becomes harder to share, and the vast majority
of threat intelligence we need can be found in the open source anyway.
I have a CSO friend who isn't a U.S.
citizen, and his CEO is not a U.S.
citizen, but he happens to be the CSO
at a very large critical infrastructure company here in the U.S.
with a pretty big footprint and actually responsible
for pretty large chunk of something very important
to the nation.
But he can't get any classified information,
and his CEO can't get any classified information.
You can see how that would be a really big problem.
Most people don't know this, actually, and I didn't know it until I worked
at NERC, but the U.S.
gets a lot of our electricity from Canada.
In fact, you know, the lights in here are probably being powered
by electricity generated in Canada five minutes five
seconds ago.
You can see there's a problem there as well.
While we work with the Canadian utilities on a lot
of things, we don't work with them on sharing cyber security threat
information because they're they don't have U.S.
Government security clearances so we can't share that kind of information.
And that's a big problem.
Worked with another story, when I was at NERC, I worked
with a CSO, and we had discovered
a pretty big vulnerability in his company, the source
of it was classified information.
When he when he briefed his CEO and his CFO on it, needed funding,
out of cycle funding to fix the problem, he couldn't tell him the source
of the why he needed the money
because it was classified information.
So it's pretty tough to go to your CFO with your hand
out and hoping that your good looks and smile are going to get him
to write you a check.
Some of you probably are aware of the executive order that was signed
by the president in February of this year.
It has three a number of things, but has three primary components
related to information sharing.
One is a provision for expedited security clearances;
two is a increase in the volume, timeliness and quality
of the cyber threat information that DHS and the government provides
to the private sector; and the third thing
is private sector access to the DHS classified enhanced cyber
security program.
The enhanced the ECS program is a avenue that
the government shares classified information
with certain critical infrastructure companies.
So these are noble goals, I think, as laid out in the executive order,
but I don't think there's any way to scale
by providing any more security funds.
You can't there simply is not enough manpower
and enough money to provide security clearances
to all the people in the nation and all the critical infrastructures that
need them.
I don't think you can even get close to it, so I this is something that was
in the executive order that I think is a noble goal
but probably not going to be not very realistic.
And to bring up the Snowden thing again,
you know in the post Snowden world, getting clearances
to nongovernment employees is going to be a lot more difficult.
The second one, increasing the amount
of information provided back to the private sector, I think
will have limited impact getting the handfuls of companies again,
the scale of this is critical getting handfuls
of the companies the classified information
is not going to solve the problem.
That's some of the bad news.
I always like to wrap things up, talk about some positive things.
And there are some positive things going on.
Sometimes you look at something and it looks bad and the end result
of it is not so bad.
For the past year most of you know the banking and finance industry have
been going through these events, and they have been very,
very challenging for many of the banks and many of the ISBs
and they have spent a ton of money combating these
and preparing for these.
But a couple good things happened out of it.
The first was I actually saw CSOs from these large banks
and large companies sitting together in a room talking about how
to address this problem.
And I can tell you, two years ago you couldn't have got
all these people in the room talking
about issues like this.
I had a talk with one CISO at a very large bank, and she said, yeah,
this is an absolute nightmare for us, but it was good
because it does have we have we have really opened the lines
of communications across this entire sector
in ways that never would have happened.
And so there's a lot of information sharing happening now
on things other than the D DOS related events.
That's really, I think, helped the banking and finance industry
an awful lot.
So we need more of that kind of collaboration.
There's an old military saying that cohesion
is a combat multiplier, and we need more cohesion
across the board and across all sectors
to build a relationships both within and
across industries so when cyber threats do surprise us,
we can pull together the right kinds of teams more quickly than
the well meaning but far too complex
federal government.
Sometimes it actually does take a crisis to get us to work together.
I'm sure a few of you work are involved
with the development of some of the information exchange
frameworks, I want to talk about three of them very, very briefly.
The TAXII program, Trusted Automated Exchange
of Indicator Information, being run out of Mitre, but it's really
an open source operation, a lot of people are involved with this.
And TAXII is an open source collaborative
community development initiative working to define protocols
and messages that allow the sharing of actual cyber threat information.
What TAXII does is give organizations improved
situational awareness about emerging threats and then allows
them to share whatever information they choose with the partners
they choose to do so.
You also have the main DIN 3 open framework,
Incident Object Description Exchange Format, or IODEF.
It allows you to chart and categorize intrusion based
on indicators that can be used to track down attackers.
And the ITF program defines data representation that provides
a framework for sharing information about threats.
I suspect that there are quite a few involved in the development
of those development frameworks, and I think it's, you know,
an indication of Darwin's theory again, one of them will end
up being a standard at some point and the other the others will go away.
There's also the information sharing
and analysis centers, and I know there's some
of you involve with the ISACs.
ISACs were established by President Clinton back in 1986.
They established these ISAC, there was no funding that went
along with that, and so they kind of struggled over the years
to mature and gain relevancy, but there are a couple
of the different sectors where the ISACs I think are being very
valuable, and they provide that forum
for the change of information.
Certainly financial services, the information technology, ISAC,
the defense industrial based ISAC, electricity, telecommunications,
I think those are more of the secure ISAC.
Some of the critical infrastructure ISAC, they're pretty immature.
That's not a criticism, it's the fact they haven't had a lot
of resources devoted to them over the years.
Next thing I want to talk about is the "invitation only"
or "you're not invited" clubs.
And I put that in the abstract, and I've talked, you know, some
of you have probably participated in these over the years.
And they typically spring up in response
to a specific threat like Conflicker.
But they're really effective in tackling problems.
And they're harder to get involved in, and I've actually tried to ask
to be involved in a couple of them, and they typically say no, you're not
the right kind of guy that we need.
They actually want technical people that can help solve problems.
So I bring this up because you may not have been
invited to one of these, but if you have the right kind of skills,
and people who know you are involved with these,
you'll eventually get asked to participate in them.
And actually, probably not telling you anything you
don't know, they're pretty tough to get into.
You usually have to have two or three people to vouch for you
to get invited to one of these groups.
DT and Antwan and I were talking about it a couple days ago.
The BCBU issue is ripe that you're the kind
of group that cannot get together.
Start putting some pressure on the vendors to solve this issue.
This is not a hard problem, but we can't do it.
The manufacturers, the router manufacturers really need
to pick up the ball and work on this.
And it seems to me it's a really good opportunity
for somebody to say, okay, let's start a our own group and work
on solving this thing.
So there's also a couple of things that I think
the government can do.
You know, they're going to continue to develop classified information,
and that's their job.
You know, the Department of Defense has the role
of looking outside the continental United States,
looking outside of our borders at threats against the U.S.
And that's you know, that's their natural role and they're very,
very good at doing that.
But I think there's things that they can do that we
as private companies can can benefit from a bit more.
And one of those things is research and development.
You know, the government has been
over the years been really, really good at doing good research.
And that has kind of changed a little bit over the past few years
with some of the budget issues going
on in the federal government.
One of the first things that tends to go away, first thing that tends
to go away is training.
The second thing that tends to go away is R and D money.
But the government does fund and develops
an incredible I think advanced technology in some of our labs
and some of our other facilities around the country,
but I think we need more money for that.
And we need more money for the kind
of creative and competitive startup companies, 90% of whom are going
to fail at some point, but you know what?
The 10% that do make it, there's value and there's richness
in that that the government and the nation can benefit from.
One of the other things associated with R and D is technology transfer.
Probably be astonishing to most people in here
to know how much great technology is sitting on the shelf
because the government hasn't figured out how to take that technology
and transfer it to the private sector.
It's actually heart breaking when you think about the some of the billions
of dollars that have been spent on some of this, and
they haven't figured out how to get it back
out into the public domain.
I think that they could sponsor more training.
This is one of the biggest issues I think facing the nation, certainly
in the security arena right now, is the lack of talented
and trained people.
Part of my job at DHS was traveling
around the country and talking with not only companies
but talking with higher education and even high school, and one
of the the almost constant constant mantras I heard
from the private sector was they don't have enough people,
they don't have enough qualified people.
And I could ask everybody in this room
to raise your hand right now if you have
all of the qualified people you need in your company,
and there wouldn't be very many hands in there, I can tell you that.
I don't know if anyone had the chance to walk the floor,
the vendor floor at Black Hat the past couple of days,
but something I had never seen before, there were help wanted signs
in many of the booths over there.
This is a big deal.
We do not have enough qualified people either in the government or
in the private sector.
And the government is starting to feel the pain a lot more
because because of the budget issues, you know, and
the sequestration issues, and the furlough issues,
and I think government employees are waking up on days now saying why am
I doing this again?
Thanks.
Why am I why am I busting my ass every day working 14 hours
and you're going to furlough me and dock me 20% of my pay,
when I can go and work in the private sector?
It's I'm sure it's not lost on this crowd, but if you have any skills
at all in this business, you can get a job anywhere.
So I really do think that this is something
the government could take a leadership role
in and provide more training.
And certainly not just in cyber security, in the intelligence analysis roles.
It's a huge, huge gap and we really do need
to address that.
So I do one of the other things I think is funding of the ISACs.
I think the government should take that.
We have 16 defined critical infrastructures now.
The government needs to fund the ISAC.
It's the source of the information sharing among these
critical infrastructure sectors and right now they're very haphazardly
operated and very haphazardly funded and the government could take
a role in that.
To wrap up I would like to state the obvious.
The government is going to have the resources to look outward
to the threats, but you can't depend on getting the information to save you.
The security threat information is up to us.
Some forward leaning organizations, many of you here today, I'm sure,
have already begun, and there are dozens of startups
up there that focus on cyber security threat analysis.
I probably talk at least to one company a week now where
they are doing cyber security intelligence development and trying
to find an avenue to get that back both into the public
and the private sector.
So remember my bottom line up front, the government is not going
to be sliding in a cloud of smoke to save you when you have an event.
You have to depend on yourself.
The government just simply does not have the resources, is not going
to have the resources to do that.
So conversations are occurring about these issues and others,
but unless the government figures it
out pretty soon, I'm afraid that a lot of companies, including many
of those that are already participating in classified cyber security intelligence
sharing program will simply decide not to participate
at all because it's too hard.
And that'd be a shame.
Thank you very much.
(Applause).