Episode 80: The Man Who Protects Our Secrets: Bob Bigman on Mitigating Enterprise Risks

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda.

Loop.Com hello, I'm Bob Gourley, the Chief Technology Officer of OODA llc. Today on the oodacast, Bob Bigman. Bob, I've known you for years. I'm really excited to be able to talk to you about these cybersecurity topics. Before we get into this, let me give folks a little bit of what I know about your bio.

Okay?

You spent a career at CIA where you provided cybersecurity services to the agency. You, you helped create the technical controls and the policies and procedures to protect some of the most critical national security data. After your career at the CIA, you transitioned to a role in helping CISOs understand the cyber threat and how to mitigate the cyber threat. So you run a consultancy now where you provide this kind of direct consulting services to CISOs and CIOs and CTOs and others, other technology leaders. Did I get that about right?

Yeah, perfect. Yep, that's. That's what I did. 24 hours a day. I do not sleep, do not leave this chair.

That's good. That's good. So, Bob, before we get into it, I wanted to ask a little bit about your foundational story, starting about your. Starting with your degree in college. You were a history major, is that correct?

Oh, I was a mini major. I actually went to the University of Tampa because I was in love with William Faulkner. I had read all Faulkner's books and they had a actual program there and a couple professors who were like, they referred to him as Faulknerites. And I was going to go become a literature major and chase Faulkner and write about Faulkner. And I got there and I decided boys are really boring. So, yeah, I tried a couple other things and I always loved history. Of course, I never gave any thought to what the future was going to be or what I needed to do to prepare for the future. And I chose history and did very well in it and I still love it today. But yeah, I did end up with a degree of history. That is true.

And it's interesting because now what year was that?

When did you graduate with your undergraduate? I graduated in what, 76? 77 was the graduation year, actually.

Okay, well, history, I think, is a great topic for cybersecurity and maybe we'll get around to that in a bit. I bet at the time you may not have thought so. You know, computers were just starting to connect to each other back then. Maybe there were game consoles you could have in your home. But really, if you want to use a computer, you need to go to the mainframe and do some time sharing.

And submit your job. Yeah.

So from there you got a degree in public administration, right?

Yep. Yeah, So I didn't want to go work for government doing something in history, I guess. And I went to American University and it was there studying public administration. I actually got an internship with an unknown agency that told me to show up at a building and do an interview. And I did. Why would you do that? Well, because I was intrigued just to figure out what this was all about. Right. I mean, yeah, here you are, 20 young, 20 something year old, and I wanted to know, geez, who are these? I had a suspicion, of course, I was completely naive mostly. So I went for the interview and of course they told me who they were, what they were looking for, and they said they were interviewing me for a potential internship position for the next year. And I remember saying, wait, what do you mean next year? What about this year? I said, well, no, it takes us potentially a year to do a background investigation. I frankly forgot about it. I mean, I said, yeah, fine, whatever. I didn't want to exclude myself. So I, you know, Rose, my, raised my hand, fill out the forms. Off I went. Four or five months later, people were telling me, call, getting, calling me saying, hey, we got these people walking around the neighborhood, you know, doing a background investigation on us. All right, yeah, so it all went through fine. And then I went to work at the agency at CIA as an intern first working, I don't know if you remember, FBIs, the foreign broadcast. Oh yeah, yeah. Well, I was actually doing internship at fbis, doing one of the data reports and running one of the computer systems that they used. It was kind of a teletype machine, all right, that actually brought in the translated radio broadcast from around the world, the open source, that was what we called open source day. And turning them into text in which I gave the analysts to read, determine whether or not this was interesting to anyone in the national security industry. And as a result, I kind of got interested more in the teletype machine and how it worked and less involved in the history or the business of FBIs. And I then went to work for a cybersecurity company, one of the very early companies that was doing mainframe role writing, right. And they were assisting companies at that time with their RAC F ACF 2 whatever the product was of the day, right? Doing writing, security roles. And oddly enough, I never understood how this got connected. I got a call again from the agency wanting to Know if I was interested in interviewing for a position in computer security. Now how they knew I was working for this other company, I still don't to this day know. But it might have just been kismet, who knows? Did an interview, they came aboard, I told them what I was doing. They said, that's perfect. That's exactly what we need assistance with. Would you like to come in and start a career? I thought, you know, I would come and stay, you know, two, three years or something. Right. Get my, get my clearance and go to work for a computer science corporation. You remember them, and make my millions. And I never left. I stayed in the agency for 30 years, did all sorts of cybersecurity related work. And then last 15 years there I was. I was a CISA.

Yeah, that's where I ran into you, Bob. And I remember those years fondly, frankly, because you were this kind of guy.

Yeah, I loved the job. I mean, it was a great job. I worked with great people mostly and you know, it was always a different, bizarre kind of challenge almost, almost every day.

Yeah, there's some real dilemmas there because, you know, you need to have information and intelligence.

You need to get that to people.

They need to work on it and create intelligence. They have to share it or it's worthless. But you got to share it to the right people.

That was kind of the easy part. The hard part was kind of the mechanical, technical part of trying to make the same person have five different names in active directory. The part no one thinks about. That had occurred in an espionage organization. Right. That common commercial products don't really aren't flexible enough to understand things of that nature. It was trying to deliver routers to buildings that don't exist. This was kind of the hard part of cybersecurity, getting things produced and securing data from just so authorized people. That was actually turned out to be kind of the easy, fun part. Cool.

So as you transitioned out of the Agency, you began working commercially to help CISOs become better. CISOs, right?

Yeah, yeah, yeah, yeah. Kind of. Someone referred to me though, kind of the CISO whisperer kind of helping. And I've worked with many now over the last eight years, helping them build, you know, really good cyber programs, trying to push them as much as I can away from the compliance checklist approach to cyber and focusing on what we really know will make them lose their job. You know, I think that's Russian, the Russians and the Chinese.

I have personally called you the cisos ciso because I have seen these guys in the way they listen to you and hold you in the highest regard.

Well, thank you.

So let me ask. I want to extract some lessons from you on this being the CISO whisperer, because, frankly, I've seen you help a lot of organizations mitigate key risk. And I know I would never say you have made organizations totally secure, but you have certainly.

I wouldn't say that either.

You've certainly mitigated a lot of risk. And through the years, have you gained any lessons you can share with us on why are some organizations better at mitigating risk than others?

I'll be honest with you. I have not found any organization in all the ones I've worked with that are really very good at cybersecurity. Number one, it's hard to be very good. These organizations aren't built just to do cybersecurity. They're built to make money and keep the board happy and produce products and services. Cybersecurity is not really high. Even today with all the risks, cybersecurity is still not very high on their priority list, even though they say it is. When you walk into these companies, as I have many time, and ask them for a layer two network drawing of their entire infrastructure, they look at you like you have two heads on. We don't have that. I said, well, what about. Do you know what your assets are? No, we have no idea. But to answer your question, I think there are some that do it reasonably well. And those are the ones that have the commitment from the top floor, right, all the way down to the people who are responsible for configuring firewalls and setting ACLs and routers and people who understand what their mission is. It permeates the organization. Cyber is part of what they do. It's an important part of their skill set. It's an important part of how they get recognized and promoted. It's actually in the DNA of the organization. Those are the ones I found who mostly, you know, do it pretty well. You know, those are the ones that will have really good hygiene. However, it's a small, small number. It's shockingly small. You know, I would say in the United States, in corporate America, those who really do cyber well, it's less than 5%. All right.

And just extrapolating here, I'd have to assume if I asked you the same question about county governments, and maybe you've never looked at a county government, but I have to assume probably 100% don't do it.

Well, yeah, probably. That would be my guess. The one I looked at Basically was absolutely horrible.

And so I've looked at a couple myself and was absolutely horrible. State governments too. So here we have the soft underbelly of America, these counties where they have data on all of us. Well protected at all.

No, no, not at all. Yep. Yeah, no, I've, I've actually gone for the, the one I worked for. I actually went out and found their data and gave it to them unprotected. Yeah, just run the Shodan query and here's the, here's the server and I did ask permission and they said fine. And it was very simple.

Right. So I don't want this to be a gloomy conversation, but frankly this is a gloomy situation where it's a good.

Right now a state of affairs in cyber is gloom. Yeah, that's, I mean that's the honest truth.

So I keep looking for a way that we can dramatically change the situation. I certainly haven't found it yet. I want to keep an open mind and want to ask you that you have opinions on things we can do to dramatically change the situation and make a two order of magnitude improvement on the security of the nation?

I don't know if two order, maybe one order. We need to hold the cyber, excuse me, the IT industry accountable for their foolish errors in coding practices and firmware practices and hardware practices and support practices and supply chain. I mean frankly, the IT industry when it comes to computer security is horrible, absolutely horrible. And they're the cause of most of the risk that we have today. Just think about. Well, today's Tuesday. Patch Tuesday. I think this was a low number for Microsoft, but it was 66. The question is, why do you have 66 code? And by the way, not all of them critical, but many of them critical. They never fixed the principle or vulnerability which has gone back now, my God, since I was a child and there's no accountability, you know, there, you know, we have a lemon law, right, for cars. Yeah. God forbid my Audi, you know, if the speedometer goes 0.07 off of its, you know, recognized path of what my speed is. It's a national, it's a national nightmare. I have to bring the car in, you have to line up. They have to fix the software, you know, or they'll get penalized. Right. But Microsoft, you know, basically has a vulnerability in their, in their principal or software which allows you to do remote code execution from anywhere around the world. Right? No, they don't suffer any penalty whatsoever. That's ridiculous. So if we want to get serious about securing computers, we have to make industry work by some real standards. Okay. And we know how to do it. By the way, the US government does know how to build secure systems, as you know and remember we did it one time largely we had that thing called the orange book, right? Yep. And we had a standard on how to build secure systems. It was kind of foolish and it didn't work very well, but it did result in some fairly secure systems that today you still see pieces of around the world. Yeah.

And in a more modern way, there's also like the Trusted Linux extensions for example that came out.

Those have their genesis back in that orange book, by the way. Trusted Solaris, if you go back, you know that, or even back earlier than that. So we know how to build secure systems, we know how to write secure code. Industry of course doesn't want to do that. I mean they're not going to do it willingly. Just like they weren't willing to put airbags in cars. Right. Someone had to write a law, had to write into legislation for the Department of Transportation that you will mandate that the car industry puts airbags in the car. So you know, famous story about a GS12 wrote a regulation in the TS in the Transportation Safety act of 1976, I believe it was, and wrote it. They dropped it on industry's desk. Industry said, okay, yeah, we'll do that. We've been preparing to do it for some time now. We just didn't know when you'd get around to it. And I don't know how many lives airbags saved, but we can certainly save a lot of cyber risk if we can regulate industry to write secure code and build and secure systems in that example.

I think that's a great example because it really, anybody can understand that example. So that could have been a two sentence regulation. Tell me the two sentence regulation that changes things for the IT industry.

You will comply with a NIST standard for securing all system firmware and software in systems sold to the United States government. Now the hard part is for Ron Ross then to gen up the policy machine and come to some agreement with industry. Right. They can't do this just in the halls of Gaithersburg alone. They need to do this cooperatively with the help of industry and get their input. You don't want them dry, you don't want industry driving, but you got to do it cooperatively. But I think it can be done. Ron even believes it can be done.

But why did you say US government, aren't you aiming low there, that we didn't have airbags? Just for the US Government?

Well, no, but I mean I would start. I think the way to start is with government. And then what you do is you walk up to the FS Isaac, and you say, hey, you see the standard that the government just published, you want to use that too? Who would say no? Right. What industry would argue against adopting a more secure standard? Yeah, I guess the prices of the products would go up, but your security value, the risk would be dramatically lower. And the long term you would do, you'd be much better off. So I think just by getting it done in the government would have tremendous appeal outside you got the medical technology, people would say, hey, it's good enough for the US Government. When you start building your future networks in the medical industry, we want you to meet the standard. Right.

Well now here is a challenge though. And the government prints money so they buy a bunch of stuff. Now I know that they try to be economical, but government folks can more easily do defense in depth in industry. They don't want to spend the extra money for the bells and whistles. Which is why I was thinking maybe that requirement should be for all it.

So here's what I think would happen. You're right. They might not on day one want to, but what would happen, I believe is security would become a marketing tool. Right. And these industries, and I believe this very much would happen. They would then basically advertise the fact that their products, you know, their financial products of bank A meet the US government standard. Well, now you have a competitive advantage, Right. It's not going to be long before the next bank says wait a second, we can't let them have that competitive advantage. We're going to meet the DAM standard too. Right?

Yeah.

So I think you would have such a mass appeal by the population, they would force it upon their industry customers to adopt these types of standards. Think about the FIPS142 which is still the most successful NIST standard of all time. Right. Everyone, everyone adopted. It was written just for the government, remember? Yeah, the Triple des. The DES and Triple DES standards were just government standards. But industry looked and said, well that's good if they, if that works. Well, what industry today doesn't use the FIPS142? They all do.

Right, good. Well, I asked for big ideas and this is a good idea. I think it could make an order of magnitude improvement.

I think it would help. I can't think of anything else. Training hasn't worked. Fishing exercises haven't worked.

Cybersecurity Awareness Month.

Yeah, it's A bumper sticker, right?

Hasn't worked.

Yeah, yeah. Let's face it. Why is it that right now, today we have more technology in the cybersecurity industry than we ever had before? I mean, every day there's 27 products coming out of Israel and in the United States we're full of them. Right. I mean, it's just, I can't tell you. I mean, I used to try to keep track and I know you keep track of it as well, but it's almost impossible. You know, there's new companies with new ideas, but yet the problem is not getting better, the problem's getting worse. Well, something's wrong here. If we've got more companies doing it and more people focusing on it, yet the problem is worse and worse and worse. What's the problem? The problem is the code sucks. That's the problem. Yeah. The bad guys know it and they're going to take advantage of it and ride that rail as long as they can.

Let me ask another question, more of a non technical one. Have you ever seen or do you have any ideas on anything the US government can do to slow down or stop or deter actions by China or Russia in cyberspace?

No. The only thing they can do, and they won't, and they shouldn't, is threaten a kinetic response.

Yeah. And that puts us on an escalation ladder we need to be very careful about.

Exactly. And I believe it would be foolish to do.

So.

Short of that. Yeah. Well, we can respond with cyber war and you can have this. And we already. It already exists right now, but it's not going to impact the cyber criminal world at all. It has no impact on them whatsoever. They're still there, they will still be there. And it's very similar to the illicit narcotics industry. As long as there's takers and money to be bought and money to be made, they're going to find a way to take advantage of the situation that exists and run ransomware. This is why ransomware has become so successful.

Yeah, I agree. And that's a very good analogy. The global counter narcotics criminal syndicates, some differences. Moving counter narcotics by sea is about 20 knots. Cyber is going at the speed of light through our networks and measured in milliseconds. And both of them are innovative criminals. But the innovation and cyber.

And the vulnerability exposure is so broad. Right. As you know, in the military, one of the things the military is trained to do is to limit your risk exposure. If you land in some area and you're taking over some area of responsibility, very first thing you want to do is limit your risk, understand the battle space and know what you have to defend. Right. Right now in cyberspace, we don't even know how big the area is to put the fence around. We have no idea.

Yeah, well, let me ask another question, Bob, because everything you're saying makes a lot of sense and it fits with my observations. You go into a large enterprise and never start out telling them, look, we're going to make you secure. We're going to raise the walls so strong and dig a big deep moat so nobody will get in. We say, sure, raise your defenses, but be prepared for breach. And when they get in, try to design with enough automation so you can detect them pretty quickly and try to have special protections around your most important data, the stuff that would destroy you if they got to or exposed. Is that all we can do now in this environment if there's no changes?

You know, I think there's a few other things we can do. Although the news recently hasn't been favorable, I try as much as possible to convince my clients to use like a hardware route of trust and to exploit the capabilities of the TPM chips, right, to sign code with a known good certificate that hopefully can't be exposed. But it looks like now that they are being exposed and the hardware rooted trust is not so trustworthy as we first thought. But I think there are a few things. I think there's still a lesson to be learned for isolation and segmentation. I don't, by the way, mean zero trust necessarily, although I think that helps. I actually now have had a client come back to me and ask me about how can they actually isolate their crown jewels. And when they said isolate, they meant physically isolate them. Is there some way we can make this actually work? Because we don't think our network, which we have to operate globally, have to operate globally to run our business will ever be sufficiently secure.

So let me ask a couple other questions then, because I believe that and I want to get into this topic of metrics. I've known you for quite a while. I know you're not a huge fan of metrics and compliance based checklists.

That's right.

But over the years I have come up with a thesis I wanted to try out on you, kind of an uber metric, one that's kind of above all the others. And that is if you have an organization and the leader of that organization, either the CEO or, or the agency director or cabinet official, doesn't care about cybersecurity, that's a metric. If they do care about cybersecurity. There's still a lot of hard work to do, but there's hope. If they don't care about cybersecurity, they're not going to be able to get enough things done in the organization to really mount a serious.

I think you're right and I don't know exactly what the metric is. To me, the Met, you know, does the CISO re report or communicate, work with the board on a regular basis? You know, that, that type of commitment to me I think is good. I have noticed the companies that do take a senior level, board level, CEO, president level interest in cybersecurity. I mean, actively engage the CISO and the CIO at the board level. Right. They do tend to have stronger programs and to tend to be more secure. But again, we're talking about a small percentage. I mean most of them are just as you mentioned, they don't understand. This is again, one of the aspects of this is largely generational. You still have mostly an older generation of CEOs running companies who really don't understand cyber or it at all. I mean, you can't go and expressed to them in a way that they would even understand and make useful, thoughtful decisions because they just, the language is so arcane. Right.

So that's a very good point. And I hope that those that come after them will have a better understanding and appreciation for this.

Yeah, we're seeing that now. I'm working with a company right now. It's online organization, they're developing some, some new technology. And the CEO, I was talking to him the other day and you know, he was talking to me about Python programming and, and I'm thinking to myself, well, this is a sea change. Yeah, yeah. And he had, he had experiences, you know, doing. Yeah, he said I, he's a cyber security. He says, I, you know, I configured some of the first Cisco routers so I, you know, he, he understood, he, he knew the world.

That's cool. Let me try another one out on you. And it's maybe it's a category of metrics and that is. Well, first of all, the, the CIS top 20 cybersecurity controls has like 15 controls that can be automated. You know, measure this, measure that. And five of them really have to be kind of human led. One of them is about testing your stuff, red teaming. And I think that's another important metric because you either have a red team program or you don't. And if you don't, if you're not testing your own stuff from an adversary's viewpoint, you're not learning. If you are testing, those guys are getting in. You can measure things like how long did it take the red team to get in? Was it longer than last time? Once they're in, how long before your team detected them? Once they're in and they were detected, how long before you could really push them out? And those kind of metrics I think are more important than others because if you're not doing all those others, you're not going to make progress in.

I agree. I think the important one that you mentioned there is the time to detect. Keeping them out is important. And I do focus a lot on making sure that there's measures in place to keep them out. But I agree with you. What to me shows growth in a cyber defensive organization is their ability to detect. Have they configured their system properly? Do they have the right integrity mechanisms installed in the network and in the file systems to monitor and see when something changes that that represents a security anomaly. Right. That they have to focus on. So that time to detect me is very important. But yet again, I'll say what I just said before and you may have experience as well. I've not seen many organizations that have a very good time to detect, if frankly any time to detect. This is why ransomware is so successful. There's no time, they don't detect until it's too late.

That's interesting. I have very small sample size, but one we worked with not so long ago actually detected our operations in three days. We told them, look, this is not bad.

Yeah, three days, not bad.

And the CISO said, great, I'm going to have T shirts made that said we're not bad.

Yeah, there's a lot bad guys can do in three days, but that's not bad. I mean, listen, I work with one company, major, major, major U.S. organization, spend millions, millions on cyber defense. It's not three days. I'm not gonna tell you what it is, but it's not three days, it's much more. Yeah.

I want to ask another question now, if you have any advice for let's say the mid sized company and by mid size, I'm not saying small, I'm saying a company that might have revenues of between 2 billion and 30 billion a year. So they got some heft, but they're still mid sized players and probably don't have a big security operation. What kind of advice do you have for a company like that, wants to mitigate risk?

Yeah, and I do have clients like that. I think that right now their best bet is to go to the cloud and they're not all created equal. I think some are more secure than others. You do have to do it smartly. You do have to think this through. You do have to. But you have more security options in the cloud than you can afford doing yourself. Right. You can buy securities of service and without a whole lot of expense actually get a high degree of at least the back end network and your server environment pretty much, you know, if you play your cards right, lockdown. And that leaves you pretty much story about the clients. Right. And how you connect to that, the end user devices. Yeah. So at least you reduce the amount of things you have to worry about and secure. So my suggestion, and I've been suggesting a number of companies is all right, let's transition your data centers up to a cloud service provider. Here's 20 things you need to do to lock it down properly. Get that done. Use their services for security monitoring, user services for threat management, vulnerability assessments. You know they, they have these tools available it, you, you can't, it's not just a matter of cost. They can't compete for the expertise. You know, no one's going to work for these mid level, these mid sized companies. Right. There's not just not you can't pay them enough. They can make much more money working for the companies who provide it as a service. So go to where they're at. Don't try to bring them to you. Go to where they're at and lock down. Here's another 20 things you need to do to lock down the client and you'll be okay mostly.

Bob, I want to ask kind of a broad question here about your views of the future of cybersecurity. You see, listening to you through the conversation makes me think, you know, there's a lot of stuff we can do to dramatically improve the situation. It's not a done deal that we will do them. And I want to ask your thoughts, what do you think is in our future when it comes to cybersecurity?

Well, putting on the optimist hat I eventually think that there's going to be enough pressure being put on Congress and on and administration might not be this one, but eventually that they will start regulating the cyber, the IT industry. Right. And I think that at least gives us the start of turning this, this aircraft carrier around in the right direction and at least reducing this massive exposure space. Right. As we were discussing before, at least trying to, to knock out some of the long historical problems with things like the SMB protocol, which here we are in 2021. We still have vulnerabilities in the SMB. Well, yeah, someone should be paying money for that problem. So I'm kind of optimistic. I think people will at least catch on at some point and say, hey, maybe the problem is with industry and not with me. And I think that offers some promise. So I guess I'm partially optimistic. Great, great.

And Bob, one final question. I would really like your advice on what we should be studying people who want to keep learning and growing in this domain of cybersecurity if they want to be better decision makers and leaders.

Yeah, I mean, from a technical level, what I like to do is I like to actually read the assessments that companies do of malware infections. The reason why I like doing that is because you really start to understand what the bad guys are doing and taking advantage of and you can understand and help your clients understand better what they have to focus on. 92% of all exploits in the last two years are memory exploits. Right. Well, we have a problem with the way we secure memory in computer systems. Ron Ross, Chapter 1 in the Security standard ought to be securing memory management. Right. So if you. So I. So I like to study that and you know, the other things to do. You know, there's tons of books. I don't. There's not one. I think that's actually really outstanding and understands that explains risk. I wouldn't invest any money at all in understanding cyber risk. I think that's a. That's a loser. But I would spend time and go in reading up understanding how hackers hack, what do they actually do as opposed to what people say they do. Right. And what some of the media outlets report. Spend some time in really understanding not just the modality. If you look at. And I think it's been an excellent effort is the MITRE attck. I think that's just, you know, that's helped everyone dramatically understand how hackers hack, what they do and what they take advantage of. And when you read that, one of the things that I found surprising was it's mostly pretty. The attacks are exploiting the same things the same way all the time. You know, it's. Oh, okay, it's another memory injection attack. Oh, it's another buffer overflow. Oh, it's another directory traversal attack. Oh, it's, you know, blah. It's all happening in memory. Well, geez, that's surprising.

Yeah. I have to agree with you. That is one of the. It's a very virtuous activity and it's something they did for the community, and it helps educate all of us at a level where we can.

Well, it wasn't completely virtuous, but it was, it was a very good. It really was very helpful. It helped everyone raise the, you know, it was that tide, that raising tide that raised all boats. Right.

Bob, thanks much for the time. I really appreciate it.

Sure. Thanks for listening to this. OODA Loop production For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.