Episode 111: Andy Bochman on Countering Cyber Sabotage

Informing your decisions with intelligence analysis and insight brought to you by the team@oodaloop.com.

Hello, I'm Bob Gourley, the Chief Technology Officer of OODA LLC. And today on the OODACast, Andy Bachmann. Andy, welcome Bob.

Thanks a lot. I'm glad that our paths crossed. We found each other. I'm surprised we didn't find each other earlier given all the common interests and associates we have. But nevertheless, here we are, 20, 23.

Yeah, it is amazing how many people we know in common and the circles we've moved in. And I haven't had the opportunity to work with you in any of them. But I certainly know the organizations you've worked at and I wanted to start, Andy, by asking folks for or asking you to give folks a little bit of your background and a bio. How did you get to where you are today?

Okay. I will try to jump across huge spans of time that we don't need to dwell on, but in case an accent comes through partially. I'm from Boston originally. Hockey player, went to military academy in Colorado Springs for undergraduate and in the Air Force started to touch computers. Not as a programmer, more as an acquisition officer. And in the early dinosaur days of cybersecurity, when there's such a thing as the NSA Orange Book made specifications requiring certain levels of security for mainframes basically right back then and then engineering workstations, stuff like that, I was in multiple startups after I left the Air force after around 10 years. I also have a background in literature and so taught at the Air Force Academy before I left. And combine those two worlds of, in theory, being able to communicate with people in written and oral form and the cybersecurity knowledge I picked up to be in multiple startups. Ended up in IBM. Married my time there with my energy interests, I was moonlighting at night as a blogger. Two blogs in the late 2000s, we call those the Oughts, the DoD Energy Blog and the Smart Grid Security Blog. They're still very Googleable and they serve as archives for our thinking. Around that time, Department of Defense on energy and the whole world on smart meters and smart grids and things like that. As those things were evolving, how we could develop and deploy those in ways that were semi secure. Even though people are like what are you talking about? What are you talking about? Cybersecurity. For that stuff, we just need to build it and get it out there. Right. I've been an independent consultant for a short stint. I've worked with the Chertoff Group and but for the last eight years or so, I've been part of the Department of Energy complex in one of the national labs, the one in Idaho. Even though I'm doing this call from where I live now in Milwaukee, Wisconsin, I'll leave off there. That brings us at least to where I work now.

Yeah, and Andy, there's so many interesting things we have to talk about, critically important things about how to protect infrastructure and prevent sabotage and the books you've written on this. How. But there's also these interesting points in your bio right now. Like, I've noticed so many times I'm talking to people on the OODACAST or in other meetings, and they have a background in literature. And I'm wondering, what is it? It must be it maybe it does really help you communicate if you have this common foundation in understanding literature and how people express themselves.

My guess is it's both. And it's probably not true for everybody. Right. But in what we're generalizing. And so, yeah, I think it helps you think and it helps you convey messages. One of my classes was an international class at the Air Force Academy. And so we had cadets from all over the world from mainly friendly countries. And I noticed that some of the best speakers and writers in English were from Pakistan. They like, they killed the Americans in some. In some forms of communication, probably because of their educational system at the time was, in that regard was superior. I just remember saying to them, we were doing like a rhetoric class and we were doing, having them do small speeches like polemics, making a case for something and supporting it in a compelling way. And I just remember thinking, you know, some of these, some of these guys are from countries that are not so stable, definitely not so democratic. And at one point saying to them, when we were wrapping up the semester, like, these things that you've learned in here, hopefully you've learned stuff. It seems like you have. They are amoral. You can use these tools for good or for ill. And who knows? You know, my. My hope is that all of you use these, put these things to good purposes. Some of you are very talented. And now they're out there in the world, and I'm not tracking them to know whether they are doing good or ill. But to your point, you're finding people that have a background in the humanities. We can even broaden a little bit and bring in the English, bring in the history majors. Yeah, there's something about that that helps you become a generalist. And I'll wrap up with, I think in some spaces, in some Sectors. Being a generalist sounds like a lukewarm thing. If you're not a real expert, you're a generalist. I think I'm a proud generalist, and I think that we need as many of them as we can get who have reference points all over the map, and they can use those to help both make better decisions and also to communicate the rationale for them.

Well, let me ask another question that maybe will draw on some of your ability to explain things very plainly, and that is, what is Idaho National Labs? Now, I've known you guys for decades, and I feel very honored that I've got to work with a lot of the national labs. But how do you express succinctly to business leaders on what is a national labs, what is the specialty of Idaho National Labs, and what should people know about you guys?

Okay, well, thanks. And I'm going to try to be less verbose than I was in the previous response, but we'll see if I'm successful. That could be one of my great failings. National Labs are all part of what we call the Department of Energy complex. There are 17, maybe 18 of them now scattered across the country. They formed out of World War II in the quest for nuclear weapons. Several of them were involved. But Los Alamos is where you see movies and the Trinity Project down in New Mexico. Right. They all have some special sauce, and they overlap a bit, too. Their mission primarily is to solve grand national problems that the private sector can't, won't, or shouldn't be involved in. And if it's something that is commercializable, like if R and D leads to a product or a capability that could be commercialized, then we have tech deployment offices to help with those transitions and license the ip, and away it goes. Because in a sense, if a national lab only solves a problem but doesn't share that solution with anybody or can't scale it, they haven't really changed the world. It's often the case when you're outside of the classified area that when it becomes commercialized, now you're talking about something that could help the United States, our allies, could help change something in the world. The Idaho National Lab has two parts to it, at least that I'll unpack here. One is, it was born as part of Argonne National Lab, which is just southeast of Chicago, where some very early nuclear research was going on. For a while it was called Argonne west. And then eventually it became went through several name changes to become what it is today, Idaho National Lab. It's its parent is the nuclear energy office of the Department of Energy. And if you've been paying attention to news at all of late, you can see that we're having a resurgence. We everybody in the nuclear energy industry, which in my life has been pretty much a backwater, a dormant thing where nuclear power plants were too expensive, we didn't know what to do with the waste and they were being out competed by everything that was more efficient in terms of energy generation. Well, there's a number of reasons we can get to now or table for later why it seems like nuclear energy has a real future. And so our lab is just going crazy as the center, as one of the centers of that activity. Now the part that I'm there for is the cybersecurity aspects of industrial controls. And then I'll often use a synonym, critical infrastructure of the non IT type. So this would be things that are energy, electricity, oil, natural gas, water and wastewater treatment and water management, transportation, critical manufacturing, in some aspects of communication. All of these things are where the cyber world or the digital world which most people have thought of up until most people still think is this. And it's your laptop and it's the cloud and it's IT stuff and you want to protect your privacy. In my world and in that lab's experience, it's a groundbreaking thought leader in the space of OT cybersecurity. For various reasons, it has to do everything with securing things that make, manage and move electricity, for example, and other critical functions in the private sector, in the government sector and DoD.

Cool. Well, this is all fascinating and I do want to talk about all of that because I have a special interest in nuclear energy. But critical infrastructure, as you're going through the list of the kind of things that you are working on, I'm thinking not just about my nation and our businesses and our supply chain, but I'm thinking about me and my family and what do we eat if I can't go to Harris Teeter and get my stuff. This is critically important to all of us.

I like that this topic can be one that's viewed at so many different altitudes. It can be from outer space, looking down on the planet, it can be coming down to look at our continent and then looking at it from a national security point of view. As you're hovering above the United States, you're thinking about the economy, you're thinking about security like national security and public health. You're talking about what do I eat? That is one of the critical infrastructure sectors as defined by The Department of Homeland Security, agriculture, farming, all of those things. And it does come all the way down to is my family, am I in my family prepared to weather whatever storms are coming? And it certainly feels like there's many ways the world is, or could go terribly wrong in our lifetime. Now, I'll stop with a quote from a mentor of mine. And some, some folks in the audience will have heard of him. He has famous mutton chops. A former guy involved in cyber security at the government level and in some really cool startups. His name's Dan Geer. Daniel Geer. G, E, E R. That was two E's. And in a paper he wrote for the Hoover Institute published in 2017, I think it's called a Rubicon, as in we're crossing a Rubicon of becoming so dependent on these digital and automated and sometimes autonomous systems that were we to lose them, as you suggest, like food, for example, we wouldn't know what to do. We've lost the muscle memory and the brain memory to even know what. How to do some really important things. And the quote that I always pull from a Rubicon, which is worth reading and is easy to find online with his name in that title, is he in one place. He says the wellspring of risk is dependence. So anytime you find yourself, your family, your town, your company, your country, become overly dependent on something, so much so that you haven't even thought about what you would do if you lost that, which is a lot of things, you're in a really unfortunate position and you should be thinking about what you do. There's a good ransomware version of this story, which I'll put over on the side for a second.

Andy, this is so well put and so relevant to the things we write about at OODA Loop and the things that we love diving into on the Udacast here. So let me just say I'm going to talk about your book a little bit, but as a intro to your book, I first, as I got into cyber security, there were a lot of people who just didn't see what the issue is.

Tell me what that year was. What. Because it's important to know when you, when people enter into this thing.

Well, so first of all, it. It is. I did get the. Pulled into it. You know, I was a Navy intelligence officer, so you could say I knew about security since 1982. They drill into us, the clearances, the Protect your IT tell us if a spy approaches you. So, but that's Everybody. But in 1998, I was tasked with becoming the J2 at the first Cyber Command JTFCND and that was my real baptism by fire that was. You know prior to that someone in the halls of the Pentagon had told me about eligible receiver 97 and how NSA red teamers were able to prove they could go from the Internet to supernet and prove that they could manipulate databases of things like a blood type is serious, a wake up call. And I remember to this day my response when he told me that it was, it was that sounds important. I'm glad others are working on it.

And I think unfortunately which remains remains the situation 25 something years even before that. I think one of the er moments is captured in Clifford Stahl's book the Cuckoo's Egg where I think there's only four nodes on the Internet at that moment and he's at Berkeley and we're using file transfer protocol early version of FTP to move files around for to share among academics or semi academic things. What harm could come of that? It's better than mailing it via post. But that was the beginning. There is an intrusion in that book and it's well told and dramatic and that's when things started to when some of these ideas came and you eventually got appointed. Funny so many times when you talk about the first cyber person in an organization it's not somebody stepped forward and said I'll do that. It's more like in schoolyard volleyball or schoolyard sports where they say okay, do we have any volunteers? And everybody steps back to one person who wasn't paying attention. That's the new network that was the network administrator become the first who now has another hat which is called cybersecurity.

What the heck is that now as we stood up this group we did start getting briefings from Department of Energy and national labs. One of the first, I think the first advanced persistent threat was happening at that time we didn't use that word but it was attacks against Department of Energy servers as well as Department of Defense and academia is called Moonlight Maze which I'm sure you've heard of Shen. The national labs were key targets. Now that was an espionage threat. Others were talking about a critical infrastructure and the need to protect it. Of course there was the President's Commission on Critical Infrastructure Protection which reported out right at that time, created these concepts like Isaacs. And so people were realizing this is extremely important. But others are like show me you know nothing has happened yet. It can't be that big of a problem. And that's another place where I think Idaho National Labs in particular helped people understand the threat by demonstrating it.

You know, there's a couple different types of people in the world. Somebody you can explain something to them in written, in oral format. And if you do a good enough job and if they have the right background, it can work. You can, you can move people and educate them just by talking other people. Is it Missouri, I think is the show me state. Other people, you can say whatever you want, but until they see it with their own eyes, it didn't happen. It's kind of like in social media picture or it didn't happen is one of the responses when someone's saying something. So right on the heels of both 911 at the turn of the early and early turn of the millennium and big blackout in 2003 in the Northeast that wasn't caused by cyber means according to forensics, but had an element, I think it was called the slammer worm that slowed responders responses that could have kept the blackout from cascading as much as it did. Some policy acts that happened 2005 and some things that were more on the classified side through some experiments. A former Navy, another Navy intel officer whose name I'm sure you've heard of, he became a close friend of mine and he has since passed. His name's Mike Asante. He was part of some of those experiments. And when we were thinking about, when the government was thinking about after 911 and the failure of imagination, what are other ways you could grievously hurt our country in a really asymmetric way. And it turned out that our grid at the time, early 2000s into mid 2000s was just a wonderful big fat juicy cyber target. As you said, people weren't even aware it was a target. From that we were still doing gates, guards and guns and trying to keep squirrels from chewing on the wires too much or causing short circuits. So that led to a project called Aurora. It's not that helpful a name for searching because a lot of things are called Aurora. But it's where before my time there, they procured a medium sized diesel generator in the megawatt range and through Digital means with VIPs in attendance at a healthy distance, caused that machine to self destruct. I don't think it was supposed to be public news, but eventually it became accessible to everybody. And in fact today you could search on Google, searching for Aurora demonstration inl cyber something and you'll see the video of the thing killing itself. And it's a little bit frightening for those people that understand the size of this thing and the weight of it and the capacity to generate power. When this thing is bolted in with massive bolts into a concrete platform slab thing and it starts shaking itself loose, you can feel it. The people that were there that were far from it could feel it. And so that means they even from people from Missouri are like, I get it. That was just a guy hitting a few strokes on a keyboard some miles away in the town and made that thing kill itself.

Yeah, it's really.

And now it's real. Now it's a thing. Yeah.

And there's, there's a video on it you can see. And so if somebody is saying, it's just, oh, it's not my problem, it's not going to happen. Well, it can happen here, look.

And everybody that's involved in making, managing and moving electricity, anybody that has any other business that has backup generators because sometimes the grid isn't reliable, this was a demonstration that that thing that you're counting on to back you up is potentially not going to be there. And not just because it ran out of fuel or you didn't run or perform maintenance on it. There's other ways of telling these things to go to sleep and stay asleep or kill themselves. Right.

And Andy, maybe as a segue to your book, you know, we can, I think, first of all, demonstrations like that is critically important for reasons you just mentioned. It proves to people it's real, but it doesn't say what to do about it.

Right.

So we need more thought, more research, more plans, more best practices. We need the great heads to get together and come up with proposals on what to do about it at multiple levels. And this gets a bit into your book, Countering Cyber Sabotage. Is that why you wrote the book?

Yeah, first of all, I wrote it and for reasons like, you know, that I had been involved in literature and teaching in the past, so I, I had the right background. I hadn't written one before, but I'd written shorter things. And so I felt like I could do it. If anybody out there has, has considered writing something of that length themselves and wondered if they can do it, I'd be happy to talk to you about the process because it's really interesting. But I didn't make this concept. Consequence Driven Cyber Informed Engineering, CCE for short, comes from people like Mike Asante, one of the godfathers on it. There's a couple of us on the patent, but Mike is the main guy and several other folks from the lab are mentioned and part of the patent as well. It's a Business process, patent. Right. It's about how to do something. In this case I would reduce it to how do you protect things that must not be allowed to fail because what they do is so important to the nation, so important to a country company that's in critical infrastructure that were cyber adversaries allowed free reign and the ability to map and target and deploy a payload and then execute on it for whatever reason they were going to. It would be the end of that company or it would be the end of that military mission. And military units exist to perform a mission. If they can't do it, if it's a mission kill, then there's no reason for them to exist. With companies it's more like again, think about electric utilities, water utilities, transportation. If they can't in the case of electric, make, manage or move electricity, then what are they doing? And so it seemed like at the time, and this is in Micasante's and others heads, my own eventually, that all the things we were doing for cybersecurity and this is still true today, it's as true today as it was when the ideas first started percolating over a decade ago. You can have firewalls and you can have training and you can have a culture of cybersecurity and you can have intrusion detection and you can do segmentation, you can have secure coding practices and you can keep an eye on your supply chain. Basically you can do everything that the SANS Institute for Cybersecurity that DHS and DOE recommend with their maturity models. You do all those things and do a great job at it, at it with a good budget and good leadership. And yet if certain people want to have their way with you, they're going to do it. I have a slide that has Michael Hayden on it and he said this back when he was in his position, dual headed CIA, nsa, they're going to get in, get over it. Because then and even now most people that haven't been in the cyberspace like you have think that the job is to keep people out. And cce, the methodology begins with the premise. When we're talking to the CEO or general or Admiral, we usually start at the high level, work our way in there. How would you kill your company? How would you kill your mission? Because there's people in your systems now and that's what they are exploring, that's what they're preparing to do. And that begets a very interesting conversation because usually people in those positions, at least on the company side, they spend no time thinking about how they would kill their company. All they try to do is grow it or keep it healthy, go into new fields, go into new businesses. But we go right at how would you kill it? And we eventually with them come to find that there are certain processes, certain functions that were they to lose them for a significant period of time, they'd be dead. And all the people that care about them, like defense, critical infrastructure, dcei, energy infrastructure. The ripple effects of taking out critical infrastructure, as I know you have explored, are unacceptable. Right.

So I think that's very well put. And you're describing risk to our nation and also businesses in a way that really resonates with me. Yes, we want to raise defenses, make it harder on the bad guys, but we really need to understand our key risk. What's the risk of being destroyed and how do you mitigate those risks? I think is a, is a key, key point I'm really glad you brought.

Up because you can't. I mean also a key part is the first phase of that and I don't intend to go through the whole thing, but the first phase is called consequence prioritization, which flips into prioritizing what you're going to do by consequence. It's part of the risk equation. Right. The most simplified version being risk equals probability times consequence or likelihood by impact, whatever terms you use, Is something going to happen and how bad is it going to be if it did happen? Right. And so we start with we don't worry about likelihood at all. As I said in that first opening question or challenge to the senior leadership, how would you kill yourself? We operate with the assumption that they're already in and they're already, they're already busy inside your networks and you just can't, you just don't know it because they're pretty good. Certain people are pretty good, not everybody is. Consequence prioritization means we can't protect everything. And I say this to people on cyber and when I'm doing climate, physical risk, the same thing. We can't protect all our assets. So where are we going to get the biggest bang for the buck? What must not be allowed to fail, what mission? What function must not be allowed to fail? And then below that are the assets, the people, process, technology and supply chain that support that critical function. That's what we drill down on with the folks that we do CCE with. And now we have partners that are mainly engineering firms and they do the same thing with their large and medium sized clients. What are the functions that cannot be allowed to fail? What's the digital stuff that buttresses them. And if you were to kill, that would kill the function, kill the mission.

Well, this all resonates with me because I tell you, I've been a student of my business partner Matt DeVoe for years, who created these companies that do red teaming. I mentioned the early red teaming and DOD when I was at JTFC and D. Well, Matt was behind a lot of those things, supporting them and he created companies that didn't just do red teaming, but full on adversary emulation. And these are companies that don't just do scans and then tell you you got some vulnerabilities. No, I'm in. And I can destroy you. And this is the critical area where you can get lessons learned to really improve your security and reduce risk.

It sounds a lot like what we were saying with the Aurora demonstration. If someone comes and briefs you and as a consultant says, yeah, there's tools out there and people out there that could take you out, the senior executive might be, yeah, I'm aware of that. It's a risky world, but I gotta, I gotta turn a profit and we gotta keep cranking. But if a red team led by Matt or anybody comes in and shows you, here's, here's how I would do it and you want to see me do it, you know, up to a certain point, let's do that. That's what happens in the CC engagement. At one point there's a targeter, a person who has, we say the evil bit is flipped in their head. It's part technological savvy, it's part creativity. And those are the folks, guys or gals, very interesting breed who devise the optimal pathways into the targets and the creation of the payloads that would create the unacceptable effects these red teaming people. And they do this in the energy sector too. There's a couple good cases of it. One's called Snowpud, a co op I believe up in the Northwest. They did something like you're saying they hired cyber attackers, like a pen test, except they supercharged them and the executives didn't tell the employees what was happening. This is another thing that's searchable. They were able to do whatever they wanted in ways that are deeply disturbing to the people.

Yeah, we still do quite a bit of this kind of work and so frequently we'll end up going and briefing seniors and board folks on things they didn't realize. We also very frequently get brought in because a leader knows they need to express things to their board or the peers in the C suite and they know they need someone to demonstrate this. So it gets back to like this Aurora project. Sometimes you just have to show them.

Absolutely. And I think we mentioned in a earlier conversation that it sounds a little snarky when I say it, but both from my experience on the Hill and in boardrooms with senior people, that many of them have built up antibodies to the forms of communication that that most of us use on a daily basis and take for granted that this is how you communicate important knowledge. They built up antibodies to white papers and to PowerPoints. And so you can make the best case, you can support it with evidence. You can just be bulletproof and not use too many words like I do. And still it's just going to go, what's it? They got other stuff on their mind. They. You've lost them after the first page. If they even got to the bottom of the executive summary. Right. So the sneaky way that I've used one of them to communicate things is through back to the literature comment. If you can find a novel, say something by Clancy. In my case, the one that I used the most for cyber concepts was called Ghost Fleet by Peter Singer and August Cole. And it describes. So it's fiction term can be speculative or useful fiction. It's set in the future, but not too far in the future. And it describes hostilities between China and the United States, mainly on the western side of the country, but also on water and outer space. And it's littered with technological things that you're surprised they exist. That's what makes it seem like science fiction, except for. And a lot of it is cyber or digital oriented, except for every time they say something like a submarine launches a tube that contains what looks like a lobster robot and it crawls up on the beach and sets itself down and puts out antennas and now it's a node at night and no one knows it's there. Right. They gloss it and show you that's being developed at darpa. That's a Raytheon thing. All of their things exist or are about to exist in the real world. The time these guys are reading it, there's just enough sex and violence and drama that they are. They think they're reading a story, which they are. It's pretty good. But they start to feel a sense mastery is too much is too strong a word, at least initially. They start to feel more comfortable with some of these terms that before were alien to them. And I've seen it that one executive has taken Ghostly and this happens with other books too, and hands it to Another one in the board. They get passed around boards when they find something interesting. I bet you've seen this too, because. Because they're kind of doing their job as a board member by educating the other other folks. And so it sneaks its way in. I almost sometimes say there's this. There's this invisible port in the back of people's brains and spines here. And that knowledge gets in there and they don't even know it. And all of a sudden, if they're on the hill, they can start to ask questions of someone from a cyber security company or somebody from DHS DOE that they wouldn't have felt the confidence to ask before. And so think about that way.

That's really awesome. And I wanted to mention a couple things. One is later I'm doing a oodacast interview with Adam Szostak, who has just written a book where he takes the lessons from Star wars and applies them to good security engineering. It's a fascinating read. And for anybody who's a fan of the first three movies, he has so many scenes in there that are used to underscore points of good engineering. You might think that Star wars is a movie about a hero's journey, a moisture farmer who gets the call to service, but it's more. It's an espionage thriller about stolen intellectual property and stolen designs and massive scale sabotage.

Yep. And he's being sneaky because people are going to be entertained by it. Certain people will be entertained by it that otherwise wouldn't go anywhere near that type of information and it'll work its way into their heads. They might become more useful in the world when that happens.

Right. And I. I mean, I. I really enjoyed the read. And it's such a hard thing writing a good book like that, but I'm encouraging him to consider writing one that's aimed at the board of directors because I think these guys, many of them are sci fi fans. Another thing I've noticed with boards you mentioned literature and reading. I do like Ghost Fleet. A lot of people I run into in boards are history fans and they're reading some history or another. And for me, the greatest, most exciting history is when there's two opposing forces who both have a common objective and they use all of their human creative skills and the one with the most discipline and persistence and creativity wins. And these stories from histories, I think are good ways to segue into the persistent adversary that, as you say, is already in your network.

I'll do that in a second, but I'm going to use that political maneuver where you answer a question or respond to a TF in a way that you want to and not necessarily where you were being led. But we'll come back.

That's fair. That's fair.

Since you brought us into science fiction, we both went there, but into outer space. Let's veer over from the Star wars franchise into Battlestar Galactica, which is where in a paper that I wrote for csis, the Think Tank with Mike Asante and a friend and colleague, Tim Roxy, who's brilliant, we had a reference to Battlestar Galactica. And for those people that are old enough or have a memory or heard about it later on, there's a scene in the opening where they basically all their ships became super automated and super digital and they were all able to be wiped out via things like emp, electromagnetic pulse weapons, stuff like that. One ship was older, one ship was still more analog. To use an analogy. It's like the. Where we are now and that survived. The older thing worked. It would be like the, the 75 Camaro still, still is. Okay. When the 2023, whatever it is, it's hopelessly dependent on computer networks and software and things like that. The 75 Camaro may or may not have a cup holder. It certainly doesn't have a digital display, but it will do its primary mission.

Yeah, you may have to roll down the windows with the crank.

Yeah, but we use that analogy when we were writing that paper. And again, it had to do with our dependency on these things which we're building and deploying for great economic benefit. It makes us more efficient, technology makes us more effective in some ways and more flexible, save money. But if we're wholly. When we become wholly dependent on it, the horizontal risk, like with solar winds, famous cybersecurity topic of about a year and a half ago, we found out that everybody was using solar winds in government and industry for network management and some cyber security things. And when everybody's using it, I'm slipping in the topic of horizontal risk. When everybody's using the same thing. Well, isn't that just like a great thing for an adversary to target? Because you get. It's a one stop shop. You learn about this thing and the world's your oyster. So look around everybody at all the things that you're using that everybody else is using too. It's a great target. It's worth your while as an adversary to go after those things that are not one offs but everybody's become dependent on.

Yeah, awesome. Well, this gets into this point. I Wanted to hit again. We've mentioned several times the need to communicate. Well, your literature background you say has helped you a bit in that you've communicated at very senior levels these very complex topics. And I wanted to kind of ask any other advice for the technologist or the senior leader who needs to communicate with board level executives or senior members of Congress or others who may not understand this technical stuff?

Yeah, I would just say, you know, there's the board setting which is a formal process. Right. Every quarter or every or once a year too. There's certain types of communication and there's very limited time for any one particular topic. In my experience, having time with individual board members or advisory board committee members separate from that is the most helpful. And so to the extent that you can before, during, but before and after those formal proceedings, you can get side conversation over coffee or some other beverage. And in a way that's more comfortable for that board member to expose their own gaps in knowledge, their own vulnerabilities. Right. But just in a more trusted setting, I think that can be really helpful. Now, getting those people's time is hard depending on who they are, but often they will find, you'll find they'll be amenable to that type of one on one knowledge session, sharing session that will make them better in the actual board setting. Yeah.

You wrote in 2018aMedium post, which I'll link to in our show notes, where you hit this topic pretty hard and you say there are still senior leaders on boards today, CEOs and boards of directors who essentially have their head in their sand. Head in the sand, just hoping these issues go away or we had a problem, we patched this and now we don't have a problem. And I think it's extremely important that, that we put talent on these boards who can articulate to other board members what the problems are. Now the SEC has two regulations for publicly traded companies that they're about to come out with in March that will require publicly traded companies to at least say who their cyber guy is on the board. I think that'd be a nice first step. But I really wonder, is that going to do enough? Is that going to fix this challenge we have of getting boards to understand cyber?

Fix is an interesting word. No, of course not. Everything is incremental in our world. The crusty cybersecurity people that have been doing these things and trying to educate themselves as the world's been changing and then educate others who are in positions of to make a difference. Having somebody called the person that can address cybersecurity topics on the board means it'll probably, if there are, if they're an existing person, have they ever touched a computer, have they ever coded, you know, when they were, when they were in their earlier days? There is a bit of a generational thing happening, right? Boards are people get older and eventually leave without being too crass. And the people that replace them are still alive and probably younger. And in their education, including their own corporate experience or government experience, they probably interact with computers a hell of a lot more than the folks from boards today that are retiring or recently retired or soon to retire. It may just be an IT person, somebody that has familiarity with it. And since they have some of the jargon, some of the words in their vocabulary, they'll be the person that's identified to the sec. Now whether they can do cyber things, cyber defensive, cyber content, that's another level, that's another whole universe for that IT oriented person. And then there's another huge leap which is OT operational technology synonymous with, roughly with industrial control system, ics, cybersecurity. Sometimes we say cyber physical systems. Those are the three main ways of saying the technological systems that control kinetic processes or that influence kinetic processes all the way from sensors that are sensing temperature or speed or pressure or moisture, humidity, all the way to actuators, things that push, pull open, close valves. That's all computerized now, which means it's all potentially reachable. And in many cases, as a friend and colleague who runs major show called the S4 Conference, which will be next month in Miami, his name's Dale Peterson. He's one of the first people that coined the term. He might be the person that coined the term for industrial control systems. Insecure by design meaning, and this is true in other parts of the world that I think you touch. It's a system, could be a technology thing, could be a component that the designers of it, the engineer designers, they just weren't thinking about an adversary at all. They have use cases. How do you use this product? And who's going to be the person that's using it? What type of background do they have? I want to make it something they can use with relative ease. And they never thought how can it be misused by an intelligent adaptive adversary? What if somebody else has the ability to use this thing and their intention is 180 degrees opposite of what we designed it for? What could they do with that that's insecure by design and something that we're always working to overcome. And to your point, it's somebody else's problem. We bought the thing for various reasons and now the security people will take care of it. We believe at Idaho National Lab across the complex, increasingly that you've heard this term, anybody that's touched security for more than a year has heard the term it's better to bake security in than it is to bolt it on. So we're doing everything can with universities, including engineering schools, to have the engineer, the baby. Engineers understand that whatever they make, it's going to be a computer, it's going to have software and memory, it's going to have communications out to a cloud and a data center somewhere, that it's going to live its whole life in a cyber contested world. And so what can you do at that earliest napkin sketch or early design stage in the CAD program, which itself is a piece of software which can be hacked to make it harder for the adversary to do what they want with that very, with that potentially very important system?

Andy, you know, one of the guys I really feel for would be the man or woman on the board of directors who's now being designated officially in writing in their 10k to the SEC as the cyber expert. And now they're also going to be personally liable if that company screws up and can be sued. But they're the expert now. And I just wanted to ask you what advice would you have for, for the board of directors director who's been designated as the cyber expert. How can they get smart on all this stuff? Quick.

Wow. That liability thing, that sounds like the case we were describing earlier on the Schoolyard, where everybody who wants to be the cyber person and everybody in the board steps backwards to somebody else who was checking their text. Okay, it's you. All things being equal, it's possible nobody has that background, in which case nobody has enough to fake it and therefore they got to hire somebody, they got to bring on a new board member expressly for to serve in that role. So that person at least will come in knowing what they're getting into. But the liability aspect, that's, that's potentially heavy duty and will make it less desirable, I would imagine. What can they do to get educated, assuming there's bandwidth in their life? There are. It's going to be a terrible answer. There's just so many places that they could go, so many folks that could help educate them. My own colleagues in Idaho National Lab, inl, our sister labs, several of them, which have very good workforce development programs. The Department of Energy itself, Homeland Security, I'm saying All government stuff. But the SANS Cyber Training Institute has fantastic five day programs which are very immersive. And once you have gone through one of their classes and they're on a variety of topics, whatever's most relevant for this board member, then you're part of a community where you can always ask questions. As you learn more, you can zap your latest question in from to the SANS people and get immediate authoritative responses which could be quite helpful, especially in your board capacity. Now you've got a new problem that emerged. You heard about it from the CIO or the CSO or the general manager out there. You immediately have access to people that know what they're doing. In fact, maybe that's the short answer is develop relationships with experts so that when you need help you have the quick access to those people. Because you're never going to get it all in here. Nobody has it. But get a handful of people you can trust, at least one good one and have them ready to respond when you need something and need it fast.

Thanks Andy. A lot of great insights today. I really appreciate it. You've written a great book. I'm going to link to in the show notes here but I wanted to ask kind of a wrap up if you have a recommendation for us on what you're reading now or other books should be in our library.

This will, this will be. So there's some technology things that I'm reading of course, but I and some of my colleagues are deeply involved in what's going on in Ukraine. We were involved in the December 2015 attack on distribution level utilities. We were involved in the next year in December when there's an attack on a transmission utility and a substation, both of which these caused blackouts that weren't that long. They didn't last that long because they hadn't gone all the way over to full automation. And so they had the people that knew how to really run these systems, these devices at the engineering level, they were able to bring them back online and then they didn't move quickly back into automation. Once Russia did its little demonstration to show what they could do. By the way, that was a demonstration for Ukraine. It's also a demonstration for the rest of the world too. So we've been going to school on those attacks and there's a lot you can learn for this would be board member that's trying to get smart about it. There's some great things, especially if they're from the industrial space, there's some great things to learn about those. Those studying what's been written about those two attacks? But to your point, about what have you been reading in literature in this whole world and following Ukraine and trying to help the Ukrainians as much as we can. I have never been to Russia. I've never been to Ukraine, although I've trained Ukrainians in cyber things before current events. But a close friend of mine recommended this book. He said it's one of the best that he'd ever read. He's a retired CIA person and it's called A Gentleman in Moscow. And it has nothing to do with technology. It's set in the 1920s in the most exotic high end hotel where this former, well, he still is sort of a aristocrat, kind of like what we would today call one of the oligarchs. The revolution's happening and so people with wealth are now enemies of the people of a sort. Right. They're not like the regular, they're not like the regular working person in a, in a future communist society. But I'm trying to get a feel for like, what was Russia like before all of this happened to it. It's arguably the, one of the worst places in the world to be born. It's one of the worst places to be. And in fact, when these call ups of conscripts started happening by Putin, some of the best and brightest seems like many of them left. So they're hollowing out their, their country. I wanted to know what was it like before? Because these are just people and they're in a system, a really foul, murderous, corrupt system. But in literature, there's so much from Chekhov and Dostoevsky and everybody. It's a real, real rich tradition that they're proud of right now. They have nothing to be proud of. I was just trying to see if I could get a glimpse of what it was because maybe someday it could become, it could go back to those roots, to your history point.

Cool, thanks. Yeah, definitely Check that out. Andy, thanks for all this today. Really appreciate the insights.

Oh, you're absolutely welcome. I've loved it, Bob. And since our paths have now crossed and we have each other's contact information, I look forward to continuing these conversations with you with Matt and folks that and the community that you've built. Thanks for listening to this Ooda Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.com.