Episode 10: Cybersecurity Icon Phil Reitinger

Informing your decisions with intelligence analysis and insight brought to you by the team at ooda loop dot com today on.

The oodacast we welcome my friend and long term associate phil rettinger from the global cyber alliance phil how you doing.

I'M doing well bob it's good to.

See you yeah good seeing you and it's great seeing that you guys are continuing and just accelerating your great work even during this crisis time and i want to say thanks for that well.

Thank you bob it's it the challenges are just growing even faster because of the pandemic you know the the things that we were seeing before the growth we were seeing are in cybercrime it's just really been put into a whole new light so it's it's it's been an accelerant for what we expected to happen anyway right okay well phil i.

Know a lot of people in the community know you but i want to give my context on what i think of your background and who you are and then of course if i get any of that wrong i'm going to give you a chance to correct the record but you've been in cybersecurity for quite a while in the late nineties you were in the department of justice you were in the us attorney's office and that's when the department of justice was really starting to learn about this cyber stuff and to realize things were changing there had already been a law passed in nineteen eighty four the communications privacy act or whatever i know that you guys and prosecutors and attorneys were already very familiar with cyber but it was like an entrepreneurial time when you were there and then if i understand right at the department of justice you were the executive director of their cyber crimes division and then you move to the department of defense where you headed up the dc three the defense what.

Is it cyber dod cybercrime center yeah.

Dod cybercrime center which back then as today is still regarded as like the most professional forensics crime detection center in cybercrime just really world class best smart smart folks from there you went to microsoft where you were an executive for several years and then were pulled back into government service at the department of homeland security where you that was there too i guess you'd call them halcyon days at department of homeland security as people were wondering what missions should dhs have in cyber and there was a lot of internal i remember these days parochial bureaucratic fights as different agencies were saying no that's mine you know you can't do that i'm doing this or i won't trust you and you know but you know tough days and i want to talk a little bit more about that but after dhs you then went and took over responsibilities for cybersecurity for sony the corporation for three years and since then you have been in a very entrepreneurial way creating a non profit alliance the global cyber alliance where you're working globally with law enforcement governments big industry volunteer networks and others to make a difference in cybersecurity now that's my kind of short off the cuff bio is that i hit the high.

Points you hit it pretty well bob a couple of additions i'd say i was actually the executive director the first executive director of the dod cybercrime center my title at justice when i left was deputy chief so i was always i didn't i never had the computer crime and intellectual property section i had the distinct honor of working for two of the smartest and best prosecutors ever in this space scott charney who stood up the unit or the i should say the section originally and then later moved to pricewaterhousecoopers and has now been at microsoft for many many years and marty stancil gam who was the chief after scott i was the number six prosecutor so i was the number six centralized prosecutor dealing exclusively with computer crime and intellectual property at the justice department and those were the halcyon days because we were making it up as we went along dhs just a little different i don't know if i'd call that the halcyon days it was critically important mission but that was tough work that was very tough work as you said trying to build out a capability in a space where the the jurisdictional roles and responsibilities had not been fully defined and there was still a lot of growth and necessary growth happening in the overall department of homeland security yeah you.

Know i want to mention something i remember based on my observation of you in those days i think it was a great leadership approach that you had i'd like you to comment on that it's as if when you're given an impossible mission some things you're in charge of and in control of you have some budget some people work for you in the agency but your charter requires collaboration across the entire government and even when in theory you have some influence there it's very natural for government agencies to kind of give you the heisman or if you don't say i don't work for you i work for this guy so that's tough and then you're also expected to improve the security posture of the entire nation and you're definitely not in command of the nation and what i saw of you from afar was you took what you had you built a place where you could bring representatives together and share a common visualization of the threat and a common visualization of infrastructure as common as possible so you could get everybody in one room the n kick and even though you weren't in command of everybody in that room by giving them a common visualization you could move them in the right direction and i always saw that as a great master move in leadership was creating that place where everybody comes together.

Comments on that i guess so bob i'd say i don't want to take the credit for that you know my management and leadership philosophy has always been hire the best people possible people smarter than you and have them tell you what to do so i was blessed at dhs with an amazing group of people to work with including rand beers the counterterrorism advisor and the undersecretary for what was in the national protection and programs directorate mike brown navy admiral came out of nsa ran a lot of the key initiatives greg schaefer the assistant secretary for cybersecurity and communications now runs governance risk and compliance for walmart bobby stimfli who came out of disa i know you know bobby very well she's gone on and she she leads the efforts at the software engineering institute for certcc at carnegie mellon i mean it was just an amazing group of people jenny minna who is an executive at us bank now so all these people have gone on and done great things i will say on you that i like to quote jim lewis on sort of authority in government jim lewis at csis says there are three sources of of power if you will in government one is resources the second is authorities and the third is access to the president and when i got to dhs we were kind of deficient in all three we had resources but we needed a lot more on authorities i used to tell people that dhs had great coordination authorities so if there was a crisis we could coordinate the heck out of it but that was really all we could do the rest of it was all soft power and convincing and in terms of access to the president you know back then certainly maybe less so now but back then the access to the president of the secretary of homeland security was not what for example the secretary of defense was so you know you're fighting a battle not with both hands tied behind your back but you're you're the new kid on the block you don't have the authorities of dod or the justice department and you're still lacking in resources so it was a lot about building a coalition of the willing about exercising soft power and building a team building people like bobby and greg and mike and jenny whose goal was to make the world a better place cared a lot less about credit and a lot more about getting things done and you know we were blessed besides rand beers who's one of the greatest government leaders i've ever had a chance to work with with you know janet napolitano a good great secretary of homeland security and jane hollude is the deputy secretary for dhs or s one and s two as they are called in dhs it was a great.

Group of people that's cool thanks phil and as a way to transition into what you're doing now i mean would you briefly i mean you were also a ciso at one of the world's largest corporations would you say it's a similar kind of power structure there for a senior security professional it's authority budget and access to the leadership it's not.

The differences between the public sector and the private sector are far less than you would think it is in some cases it's easier to be more agile in the private sector and pull levers quickly but in some ways it's more difficult so you just have to work in the environment you've got in all cases i found that the ability to convince people and influence people is a lot more powerful than the ability to.

Direct people cool fascinating and now that brings us to the global cyber alliance which i've watched as you pulled that together and that's another one where man it seems like an impossible task but if anybody could do it you could do it and next thing you know you're really making a difference in the world and my hat's off to you for that but i wanted to ask a couple simple questions one what is the global cyber alliance so we're a.

Bit of a unique animal in cybersecurity there are a lot of nonprofits in this space and a good chunk of them are sort of of the think tank variety you know people who study problems and write reports and recommendations and i'm not denigrating those guys at all they do great work but that's a that's a that's a pretty full space there's great people doing great work there are entities that do information sharing and analysis and operational coordination you know both the isacs and the isaos great partners we've got like the cyber threat alliance or the cyber defense alliance in the uk they they do great work there there are there are other groups people you know nonprofits that work in particular spaces like they're focused exclusively on small business cybersecurity what we the group of us that put this together and i you know i joined gca actually two months after it was founded the founders were the manhattan district attorney cy vance the city of london police and the center for internet security and the guy whose brainchild this was was will pellgren another person you know who originally stood up the ms isac and then ran cis for years so again i don't want to take credit i did come in as the first ceo and i was again blessed with the opportunity to have some resources and say what really needs to be done what really needed to be done was some entity that wasn't focused on a particular target set or a particular sector but looked globally and said where do we have solutions what can we operationalize that's not being operationalized where are there places where we could make a real effect but both government and industry are not really able to address the problem there are market failures or other issues and it really takes a community approach and so that's what we are we're a little like doctors without borders for cyber so we don't do reports and recommendations what we try to do is find places where we can actively bring a partnership of entities together and we've got about two hundred and seventy partners around the world to implement a concrete solution and make a real difference with a measurable result so i mean a good example is trying to drive global deployment of dmarc a protocol that stops the most virulent type of phishing but when we started this was you know a very limited deployment so we said this is a solution it's out there but not enough people are taking it up how can we make a difference either by building technology or by driving targeted awareness or working with government agencies to implement policy any of those things right cool and.

That'S a perfect example i wanted to talk about dmarc and also the work you've done with dns your toolkit and dmarc to me is something where if you are running a small business you need to know about it to get it configured and you need some expert help you need it like a tutorial and then you get it configured and it's pretty much on autopilot if you do it right it's going to work but you need that expert to walk you through it and i see that as a benefit of what you've put online you can start from scratch with no real knowledge of dmarc follow the steps you've provided there and next thing you know your email is being you know it's much more anti spoofable and the email that's coming to you there's less chance of that being a spoof or a spam email right so that's.

I think exactly right bob dmarc is not only the best it's really the almost the only way to effectively prevent direct domain spoofing and what it does is it allows an entity that owns the domain to say who can send email from that domain using another protocol called spf how it's going to be signed and then with dmarc what to do with email that fails it so for example if you're microsoft and you've deployed dmarc and microsoft has then they can issue a policy that says if you get an email that says it's from us but it's really not i want you to let it through but tell me about it mark it as spam or send it to the bitbucket trash it never let it go through so what it does is it for a bank for example it prevents email that appears to be from the bank but isn't and it's really the only effective way to do that there are lots of threats it stops and it not only protects you it protects your reputation it protects your customers so for example i've often said if i really wanted to get into a secure entity you know what i do i'd find out who their lawyers were and i'd see if their lawyers had deployed dmarc and if their lawyers hadn't deployed dmarc i'd take a real legal document from some case they were involved in i'd weaponize it probably as a pdf and i'd spoof an email with that as an attachment and i'd send it to the executive assistant of the general counsel or somebody in the general counsel's office i bet you i get a higher success rate in doing that than almost any other attack vector and it'll work it'll work the vast majority of the time unless that law firm has deployed dmarc so it's super important we built a wizard we're the global cyber alliance it's available in eighteen different languages including latvian and azerbaijani to help people deploy dmarc we've got a lot of training and we built it in you mentioned the toolkits we built those tools into the toolkits to make it even easier for small businesses to deploy dmarc that's.

Great and then along those lines i also want to talk about dns the domain name service you and i have talked dns for decades and people in the cybersecurity world know dns very well but if you're just an internet user you don't have to know that you just turn on your computer or your phone and this stuff just magically works so the average user and probably ninety nine percent of businesses out there don't mess with their dns it just works their isp gets that you know information to and from where it's supposed to go but with a little bit of knowledge on what dns is you can configure that in ways that dramatically reduce your risk on the internet but you just need kind of like dmarc you need somebody to help explain what it is you need to change and what the good is that's one thing about dns and i know you guys are doing that well and then another thing about dns if you use a smart service like quad nine you can have something like a firewall in the internet that makes it harder for malicious code to communicate from your organization out did i capture the essence of what you're.

Doing in dns there ryan so that's exactly right the you know the thing about dns bob as you point out is it's it's fundamental to almost everything that happens on the internet so i like to tell people it's the phone book of the internet so you know if i dns for those of your listeners who may not know this it's like for ooda dot com right if i if i type odoo dot com into my browser what does a computer know from that dns is the service that says where is odoo dot com really it returns the numeric address that says where that server really is and it's fundamental to everything that happens in your browser and oddly enough even stuff that's not in your browser like if you've got malware on your system it's probably using dns to find out where to go to get command and control about what to do so here's the cool thing as you suggested about dns it's a background service it's always there once you set it up or change it you don't have to worry about it at all and the super cool part is there's this thing called protective dns or a dns firewall you talked about a firewall in it same thing if you take this dns service the domain name system the domain name service and you put threat data into it then the service can transparently stop you from going to places that are known to be bad right so if you click for example on a link in a phishing email and it's going to take you to a site that the dns service knows is bad it can just tell you that site doesn't exist so you don't go there you get like a four hundred four error or you know site does not exist message or whatever it is depending on the app you're using so you don't have to worry about that at all you just don't go to that place you can get enterprise class security protection through blacklisting of all of these sites without with literally taking a minute to two minutes of work and that's why we at the global cyber alliance along with our partners the packet clearinghouse and then ibm built quad nine so quad nine is one of those protective dns services it's free it's available around the world it's fast it's high performing everywhere and the biggest thing that we did let's see the two biggest things that we did that are different about it is it doesn't rely just on one threat provider it's a community approach so it uses threat data from almost twenty different threat providers up to that many and it's designed to be gdpr compliant and privacy protective from the start so it doesn't keep track of what you as an individual do it just keeps track of what happens in your city and so you don't need to worry about somebody afterwards going back and figuring out what you did or knowing that you may have a problem on your system it just stops that and so it's super effective it's broadly available and it's free of charge there are also other good services that are out there you know open dns from cisco provides some of these services and cloudflare is now offering a service that also offers protective dns capability so we've started a work from home campaign and the three things we're urging everybody to do right away is patch your systems use multi factor authentication and use a protective dns service there's videos available on our website or on the quad nine website it's quad nine dot net quad the number nine dot net and it will literally i'm quite serious you can do it on your computer in two minutes or you can change it on your router at home and it'll take a little bit longer but it'll protect everybody in your.

House yes we'll include links with that too on our site as we push this video out in our podcast too i agree with you this is something that is so easy and quick to do and after you do it it adds in so much protection reduces your risk in a lot of ways i want to mention another thing that you've been doing to help reduce risk you already talked a little bit about the toolkit you've pulled together the toolkit is this designed for small businesses yes so.

As we looked at the environment you know there's a lot of focus on critical infrastructure there's a lot of focus on the cloud but there are a lot of small businesses that run you know their own little it systems have their own computers and they don't know what to do in fact they don't have the capability or the resources to even figure out what to do there's really good guidance out there for them but what good does guidance do you know a small restaurant franchise who's going to read a ten page guidance document about what to do so what we did was we said this is a problem so we built a cybersecurity toolkit for small business and it's designed we try to focus on operationalizing things making things real so we took the guidance and we brought together some of our own and some other people's free tools so you've got a essentially a set of step by step instructions to go through and take a series of steps like using a protective dns service turning on multi factor authentication on your service on services on your on your on your systems so that you can achieve a much higher greater security without spending a dime it'll take a little human effort but all of these things are free and we launched that a little over a year ago in february of last year since then we've been gathering a lot of feedback we're in the process now of doing a revision to make the toolkit even easier to use with more embedded video training and make it easier to flow and perhaps most important we've continued to internationalize that toolkit so if any of your listeners are outside the united states the toolkit is now available natively in english french spanish and german and there will be more languages to come so if you speak natively one of those languages you can go through the videos are all in that language the instructions are all in that language and it's it's a great way to take some key steps to make yourself more secure cool hey phil.

I want to ask you some thoughts about the future too at least a little bit and first i want to try a thesis out on you because i think this is an indicator of where the future is going right now we're in this major global crisis and one of the great things about this is it seems like humanity is all in this together we're fighting a common enemy there's so much collaboration and coordination and entities around the globe trying to fight this virus so incredible coordination and collaboration and people working together across multiple countries on the other hand there's also bad guys out there and they're collaborating against us they're still attacking and it's really despicable they're committing of course the same levels of fraud but on top of that i've seen a business email compromise against medical facilities i've seen denial of service attacks distributed denial of service attacks against research facilities so an entity trying to work on a vaccine and they're getting clobbered by a ddos attack we've seen heightened fraud against organizations that are impacting the ability to get personal protective equipment to the medical community this is despicable stuff and to me it's an indicator that you know even on something so bad as this global pandemic the bad guys are going to attack and they're going to keep coming and keep coming so to me what that says about the future is expect the bad guys will be in our future whatever the future is and i would like your view on that thesis and any indicators of what you you think is in our future and what we should do to mitigate the worst of.

It sure so our mutual friend mike tangy likes to say hackers gonna hack right and that's kind of what it is right so i think the word despicable describes it pretty accurately i've started advocating publicly for prosecutors around the world to say that if somebody dies as a result of a hack on a medical facility that they'll pursue something like felony murder charges against hackers it's just you know i don't really believe in the death penalty but i might change my mind on this one it is pretty bad out there right now the fbi reported i think yesterday that the internet crime complaint center has seen a three to four times increase in internet fraud complaints in the last month or so so the bad guys are definitely attacking you know they've had lots of time to prepare for this natural disasters et cetera they've always resulted in upticks of fraud associated and attacks associated with with that natural disaster and so that infrastructure and that ability has been built what's different now is that we're in a much more vulnerable environment cause everybody's working from home and they don't have the face to face contact and that means that they're remote they're outside the corporate perimeter so they've got a greater attack surface area weakened protections to some extent and a really really aggressive attacker community and that's scary that is a real problem but to look on the bright side right you're absolutely right there are people pulling together and this puts a strain on folks so i mentioned before the work from home advice we've given do immediately patch your systems use multi factor authentication and use a protective dns service for that site it's workfromhome dot globalcyberalliance dot org we came up with that advice we started talking to other nonprofits and they said yeah we agree with that so we've already built a coalition of twenty three including us global nonprofits that are giving that same advice they're doubling down on here's what you want to do reducing noise trying to provide advice to make things much more simple and much more effective the other thing i hope we'll see is i think i hope we will see renewed government funding and focus on things and corporate funding and focus on things other than just critical infrastructure right so this we have a real opportunity here to bring not just national but global attention to a problem and really work to solve it there are the big problem we've had historically about with cybercrime is the solutions we've had don't work at scale or with the complexity of the internet there are things that will work we just have to change how we do things and i'm happy to talk more about that but i'm hoping that you know we start to see you cisa the ncsc in the uk the cccs in canada and all these other entities say you know we got to really worry about small business we got to worry about everybody how do we tackle problems at scale right thanks.

And you know i have another thesis here and that is now now i'm an optimist and you know the problem with optimists is sometimes we just get things flat wrong but and this could be one of those cases i feel like the economy has been put on pause and it's like holding a big balloon underwater and soon we're going to be freed up again and that balloon is going to be let go and it's going to take off like a rocket and i thought about that i thought yeah i'm being kind of naive it isn't maybe it's not going to go that fast but if we can't mitigate some of these cyber threats especially in the small business world the economy is going to have a much harder time so it just underscores the point that to really get this recovery going again we need to invest the right amount in cyber and my friend matt devoe has mentioned as we were talking about this maybe we need a cyber stimulus package four trillion dollars being spent to restart the economy how about twenty five billion to do cyber in a much better way at the same time.

Look bob as a nonprofit entity that's always looking for funding to get things done i'd absolutely love that another good marker i tend to be a little bit i'm both a pessimist and an optimist i know it's weird but i managed to work that i think things are going to continue to get worse but i always see potential to get things done just a couple of days ago microsoft announced that it was taking its high order threat package that's available for office three hundred sixty five and making it available free to medical institutions public health institutions and to humanitarian organizations right so that's the kind of thing when a company of that size and that scale says you know we could try to make more money but we're going to give this away free that yeah that's how you solve problems at.

Scale yeah yeah cool thanks phil and phil i really appreciate the time today and the update on all of these issues and i want to ask any final thoughts.

I should have prepared something a little bit more about final thoughts i think you know i'd say this things are going to regardless of what happens continue to get worse and part of that is the scale and complexity problem i talked about before we've always had a problem with not being able to solve cybersecurity problems at scale and iot has increased that challenged by an order of magnitude now to go along with iot we've also got everybody remote right which makes as i said before makes us less secure and makes entire types of cybercrime like you mentioned business email compromise how much easier it is to do business email compromise when you can't walk down the hall and see if the ceo really said come cut a check to this vendor so we've got a brave new world in terms of scale of threat and difficulty but there is an approach that will work we just have to think differently about cybersecurity we've got to stop worrying about verticals and enterprises alone and think about getting building a global internet that will defend itself we've got to treat the internet like the human body so it's my prediction i haven't seen anybody else predict this i predict within ten or twenty years we're gonna have as many computers on the internet as we do cells in the human body you know roughly on the neighborhood of thirty five trillion right now people are saying one or two trillion i bet we get to thirty five trillion and so the internet is gonna look as complicated as the human body but each of those cells is gonna be a computer right which itself is super complicated right the only way we can defend that kind of environment if we build the intelligence into the network to turn its size to the good if we build we reduce vulnerability at scale so we make the internet basically healthy and we build an internet immune system that automatically detects problems using these trillions of eyes that can detect bad behavior and respond and mitigate threats it sounds like pie in the sky but it absolutely isn't it can be done we just need the focus as a nation and a global economy to say we are going to make this happen and use all the levers of government power to make it.

Happen awesome thanks bill i really appreciate that and i appreciate all your time.

Today thanks glad to talk with you.

Bob thanks for listening to this ooda loop production for the latest analysis on cybersecurity technology and global risks please visit www dot ooda loop dot com.