Episode 96: First Federal CISO Greg Touhill on Advanced Cybersecurity by Design

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda.

Loop.Com hello, I'm Bob Gourley, the Chief Technology Officer of OODA llc. And today on the oodacast, Greg Tuhill. Greg, thanks for coming today.

Thanks for having me, Bob. It's good to see you again.

Yeah, it's good seeing you. And Greg, I think most people in the cybersecurity community know you. A lot of others maybe further out may not. And I wanted as an introduction to read a little bit of the highlights of your bio and what I took away from this because frankly, in studying your bio I learned things about you I didn't know until today. So here's what I took away from your bio. 30 year career in the Air Force starting in 1983. In that career you worked in a wide range of assignments, many of which tended towards the technical and complex cyber related positions. A lot of leadership positions. You had CIO roles in our largest wartime combatant commands during a time of some of the most demanding and challenging times of combat for DoD. You were also the senior defense official and Defense Attache at the US Embassy in Kuwait. So you got a bit of a diplomat in you. After retiring from the Air Force, you continued service in a lot of capacities. One was in writing a book on cybersecurity which had a lot of lessons for me. It captured what executives really need to know about this important field. I should say what all business leaders need to know about that. You then returned to government and had several leadership positions, including at Department Homeland Security. And you were the first federal ciso. Since then you've served on numerous boards, including many nonprofit committees, and have also had executive positions in industry. And currently, Greg, you serve as the director of the cert, a division of the Software Engineering Institute. Did I get the highlights about right there?

Yeah, I think so. You read it just like my mom wrote it for you.

One thing that I did not see from your bio was an understanding of why. Why did young Greg Tuhill decide to join the Air Force and sign up in 1983?

Well, that's actually a really good question, one that my sister and brother continue to ask. They said, well, why we did not have in the two Hill family a tradition of military service. But when I was in high school, I was a member of the Air Force Junior ROTC program in high school and I was really attracted to first of all, the call to service rang loud and clear for me. And then further, when it came to technology, I knew I wanted my career to be involved with technology of some kind. I was inspired by the space program and the Apollo missions, and I kind of wanted to do stuff like that, you know, boldly go where nobody else had gone before. And the Air Force assigned me, upon commissioning, to be a communications and electronics officer, and that rapidly morphed into computers. I remember the day I came into the squadron as the electronics maintenance officer, and there was a box in the. In the office, and the lieutenant colonel was scratching his head with his head, his coffee cup in one hand was scratching the other. And he said, what is that? One of our captains said, well, it's a boxer. And I came in and said, oh, cool, we got a computer. And the colonel said, you know what that is? I said, yes, sir, I do. It's a computer. And he said, you're in charge of it. And then from there, the sky was the limit.

Awesome. Now, looking back on that career in the Air Force, I wanted to ask. You can tell me any. I'd love to hear any leadership lessons. And by leadership, I mean what is a leader in general, but then in specifics, what does it take to be a technology leader?

Well, there's a lot to unpack there, but let's start with leadership. I believe that anybody can be a leader. And when it comes to leadership, my philosophy is, first of all, leadership is about setting priorities and taking care of people as opposed to bossing them around. If the focus of your leadership is about serving others, serving the mission, setting priorities, and gaining the resources for the people that are under your charge to do their job. And those are really good foundational elements of good leaders. And further, one thing that I learned very early on was you need to be very supportive of the folks that work for you and with you. General Patton supposedly have said, don't tell a sergeant how to do the job. Tell them what you need done, and let them surprise you with their cleverness and innovative spirit. That's something that I followed throughout my career in the military and then in government, and now even here at Carnegie Mellon University Software Engineering Institute. But I try to take care of people. I help to set the priorities, and I help make sure that they have the resources to do their job. And they, in turn, inspire and make me feel like I'm part of a great team by their ingenuity, their innovation, and their enthusiasm for our collective mission.

Greg, you remind me of a couple things about my career. I think what you just described is a universal kind of good leader. When I had leaders like that, I wanted to follow them Anymore. I wanted to follow them more and more and I wanted to emulate them and be a leader like that. And you remind me of one other story. I was Navy. I was, ever since I was an ensign in the Navy, there had been a lot of rivalry and good natured joking about the Air Force guys. And then finally I'm on deployment. We're at Kadena Air Force Base, driving around, we go to the Officers Club and there's a big welcome.

Excuse me.

And the welcome mat at the Officers Club said, you can't fly and fight unless you take care of your people. I thought, wow, you know, that's well put. That's very well put. And I think that's part of that ethos of the Air Force leadership approach.

Well, you know, one of the things that I, I feel is one of the keys to success for me was just doing some of the basics that my mom and dad and your mom and dad probably did the same thing with you. I make a point of saying please and thank you. I find that most folks, they appreciate it when you genuinely mean please and thank you. As a technology leader, that is really critically important, particularly when we have a lot of folks that are individual contributors who are, who are behind the scenes and aren't necessarily seen out front with some of the superstars that glisten in the sunlight. The technology leaders in the cyber world are extremely hardworking and they warrant please and thank yous for everything they do. And that's really been something that I take great pride in, is the fact that I work with people on a daily basis who have pride in their work and really care. They have a passion for what they do and I think that's the hallmark of great technologists. And putting together great technical teams has been something I've been blessed to do.

Great. Would you also tell me your thoughts about how a technology leader should continue to educate himself or herself? Because it is a different, it's a different domain.

Well, I learned something new every day and I'm, I'm continually learning, literally asking some of the people that work for me, you know, tell me what you're doing and you know, help me understand this or that. I take continuing education courses like every other cissp, my Certified Information Security System Professional certification and my CISM from my soccer. I take my cpes, I go out there and invest time to keep up and try to leapfrog forward. And I find that with my peers, I try to encourage them to do the same. And then for my subordinates, I budget time and Resources to make sure that they in fact can get their continuing professional education so that they can stay current as well as leapfrog into the future.

Well, great, very helpful. I think that applies to technology leadership and especially to security technology leadership. It raises another question, something I've always pondered about the military, but also I think this applies in the corporate world. You have this discipline, let's say, like cybersecurity and you have folks in that career field, but all of a sudden the services, the army, the Navy, the Air Force will take a leader who excelled in a different domain and put them in charge of the cyber activity. And that can occur at very senior levels. The military response to that is usually, well, a good leader is a good leader. But I've always thought that a sub optimized leader, if it were true that a good leader is a good leader, then you could take a submarine officer and put them in charge of a fighter squadron, or you could take a good ship officer and put them in charge of an Air Force wing. There is something about having an intuitive feel about your domain and I wanted to get your thoughts on that.

Well, Bob, I wholeheartedly agree with you that while there is a credo out there that a great leader could lead in any dynamic, as you take a look at institutional excellence, you want to make sure that you have leaders who in fact do have a understanding and a mastery of the domains in which they're going to operate. You wouldn't want to necessarily take a great cyber leader and say, hey Greg, we're going to now make you the commander of the fifth Fleet just because you've spent some time over in this geographic area. No, there's dues that you have to pay and there's also the comprehensive knowledge of that domain. And Bob, you know that I'm a fan of Star Trek and there's a great example in the Star Trek movie Wrath of Khan where Admiral Kirk is asked by Kirstie Alley, you know, well, why? What were you doing here? And he said, lieutenant, it's important to understand how a starship works. And if you take somebody from a war fighting domain and put them into another war fighting domain and expect them to have that same expertise to understand and know how that domain works, just because they're a good leader, it's not the best fit and it's not the best return on investment for the nation when the military does that. I think it's time now for all the different services to as they're looking at making the best match for leadership within the cyber domain to invest really good time and effort to make sure that when it comes time for those leaders to go up to the most senior levels, that they've had a career of preparation as opposed to leapfrogging somebody else in from another domain which sub optimizes the capabilities as well as the war fighting efficiencies. So I'm a big believer in career development. And one of the things I've been disappointed in in the military is the fact that there has been a period in the past where we didn't necessarily invest in the the development of cyber leaders from within the cyber cadre to go to those most senior levels. I'm seeing that change though, and I'm heartened by some of the movement that's going on now under the current Air Force and other departmental leaderships.

Great. That all makes so much sense. And I wonder if you could also contextualize that lesson for business leaders because I mean, you spend a lot of time in industry and working with companies and you know what's going on there. And I know every business is different and every sector is different, but too frequently we will see a company realize that they need a professional cybersecurity program. So they will hire a CISO and then they will stick that CISO about five layers deep in the organization or they report to some strange place. Maybe it's the cfo, maybe it's the cio. And it seems like there's lessons from what you just said about the military that could apply in the commercial world as well.

And having served not only as a senior executive in the business world, but also as a board member and for some for profit companies out there, I've seen a wide variety of things as far as organizational structures, leadership applications, et cetera. Ultimately, when it comes to organizing, training and equipping a business, that's the job of the CEO with the oversight and governance of boards. And as you take a look at organizations that go and hire somebody to be their chief information security officer, for example, it's not lost on the troops, the people who are doing the work in the security organization, as well as the peers within the company. Where you see organizational placement where that chief information security officer is not being treated like a C suite or a major contributor to the leadership team, I will say also that companies who do that these days, the really good chief information security officers move on quickly. The average on station time for a CISO in today's market is about 18 months. And companies who do not place their CISOs organizationally at par with their peers in the organizational structure and don't give them the non tan or, you know, non fiduciary compensation, you know, the organizational authorities and such, they will lose. That individual and likely key members of the cybersecurity leadership team, they will lose rather quickly. So it behooves companies to make sure that the individuals that are protecting the corporate assets that are most valuable, which are all digitized in most businesses, they need to be very sensitive to how they organizationally will plug in their cyber organization into their leadership team.

Great. Thanks, Greg. Another topic I wanted to ask you about is the threat, because we face a very dynamic threat and you've observed it for decades and I wanted to ask.

Still do.

Well, tell me about the threat today and how you see it evolving.

Well, interestingly, we get target fixation on the bright shiny thing, the latest thing that's highlighted on the front page in the newspaper. Above the fold, nation state actors and cyber criminal groups, they get all the press, they get all of the attention. But if you take a look at the statistics that are out there, the vast majority of cyber incidents and cyber incidents can follow the traditional security triad of interrupting availability, interrupting confidentiality, where people get access to information they're not supposed to be, or even where information is tampered. We call that integrity. The vast majority of incidents typically fall into within that security triad, the availability and access, where you have somebody who's misconfigured something and I just can't get to that data, or my emails are down, systems down. You get some folks that input wrong data or code a system improperly, so it's got some vulnerabilities, or even I inadvertently send somebody an email with an attachment that shouldn't have gone outside my organization. All of those are human issues. We get so enamored with the technology. We look at hardware and software, but we don't really take a look at threats from wetware, the human beings. The data clearly shows that the vast majority, and I would contend that it's over 90% of all cyber incidents, are caused by what I call the confused and confounded, the ignorant. Or it's within your own organization, where we either don't train them well, we provide them with two complex tools, we confound them with all different things. Ultimately, it is the insider that is the biggest threat, and it's not a malicious insider. It's the confused or the confounded, the ignorant or the negligent. Those are the biggest threats statistically. Ultimately, as a ciso, you got to Factor in all those threats, the spies, the saboteurs, the burglars, the nation state actors, the confounded and confused negligent, all of those come in in various proportions and good CISOs understand the risks. They also understand the vulnerabilities and they make a measured approach to their security that's feasible, acceptable, suitable and affordable to the environment in which they operate.

Yeah, I think that's very well put and very helpful because if we can't take care of this baseline level of security and have a good, well informed workforce, those adversaries that are thinking and creative and innovative are going to get through so much faster and remain undetected for so much longer. But it raises another point that worries me just as much or maybe more, and that is a lot of companies can't afford any serious IT program of their own there. You know, you can have a mid sized company that's bringing in billions in revenue and only have three or four or five IT people. Maybe the security person is a part time collateral duty of one of those five IT people. And it's just the further down you get in terms of company size, the less informed and less secure program they have. And that's where most of our workforce is, is in these small businesses. Do you have any advice there? What should the nation do about this?

I think the market is actually helping with a lot of that. There are Organizations called MSSPs or Managed Security Service Providers that have actually started their own businesses and saying, hey, you're a small medium business, you don't have enough firepower from a cyber perspective. But that's what we specialize in. So what we'll do is we'll provide you a managed security service using our expertise. And oh, by the way, we're doing it for all these other companies over here and we'll help knock down your risk level to an acceptable level based upon your risk appetite and the resources you have as well as your assets that are potentially at risk. So that marketplace for managed security service providers has actually increased quite a bit. And we have all sorts of companies that are doing that both in multiple clouds as well as on site. So there are options now for small and medium businesses that include the MSSPs, but also as you take a look, a really discerning company can go out there and take a look at their tool sets as well. We've seen rapid proliferation of tools. I used to be the CISO for the federal government where we arguably had bought every single product known to man in the information technology space out there. But as you take a look at what you really need, every organization ought to be taking a look at first. What data do I have and what's its value? Do I need to protect everything equally? Frederick the Great said, he who defends everything, defends nothing. Make sure that you have a proportionate defense of strategy for your data. You don't necessarily have to pay for all the big industrial, military grade cyber protections for data that is disposable that you probably don't need to do. So understand your data, protect according to your risk and your value and don't be afraid to ask for help when you need it. Most folks will find that within the cyber community there's lots of folks who can and are willing to help and most of them will offer advice for next to nothing. Right?

You know, I think that's a very good point. And a group I frequently refer to people to is the Global Cyber Alliance, Phil Reddinger and crew, which they provide just tons of great advice and helpful toolkits for small to mid sized businesses that I think is really making a positive difference. Another thing I do with small businesses is take advantage of the cloud, the great capabilities of Google and Microsoft and Amazon because they're putting thousands of engineers into their cloud capabilities to protect your email. So don't try to host your own email. Use a big cloud provider and configure it the way they recommend and it can mitigate your risk.

And I find that the marketplace does that. And you know, there's organizations like mine@cert.org where we post cybersecurity, leading best practices. We create tools that we share widely and there's, there's a lot of folks out there that can help. And as you take a look at your data and how to maximize its effect in the marketplace, you gotta be a good decision maker and a good consumer as well and ask around and compare. Don't buy from the first vendor that comes through your door. Get references.

One other thing we could use some thoughts on is you mentioned MSSPs and I think that's extremely important and they have a key role to play. There's also this wave of zero trust design and zero trust architectures. Do you have thoughts on how those two work together?

Yeah, absolutely. I've been studying and I'm a proponent of zero trust for about a decade now. And certainly I was aware of it back when the concept was promoted by my friend John Kinderwaget for Forster in 2010 when he coined the phrase. We've been wanting zero trust for literally Decades, but we didn't have the technology to do it until the last couple of years. And zero trust is a misunderstood term and the marketing folks have bludgeoned it into a buzz phrase, which kind of upsets me in a bit. Ultimately, zero trust is a security strategy. It's not something you buy as a product. It's a strategy where zero trust is the starting point, not the destination. And it gets a lot of folks get confused by that. Ultimately what you're trying to do, your objective with the zero trust security strategy is you're trying to make sure that Bob can only see the data that Bob is authorized to see. And under certain conditions and entitlements, that's the objective. So that you don't have anybody seeing stuff that they shouldn't be seeing. You set the conditions and the entitlements in which Bob has to verify that I'm Bob and I have a right and need to see this. That's what we've been trying to do for years now. We have the technology to do it. By zero trust, you're talking about your starting point. I don't trust anybody. I don't trust machines or people. To get to my high value assets, my data, you got to prove yourself along the path of getting access to that data. And there's some great products out there, there's some great technologies to help you implement your zero trust journey. And it is a journey, but at its heart it's really a strategic approach of making sure that you have least privilege by design. You only see what you're authorized to see and nothing else.

Thanks, Greg. Now it's okay with you. I'd like to talk a little bit about the certificate. And I want to tell you I first heard of the Carnegie Mellon University Software Engineering Institute CERT in 1998 when I was kind of thrust into this world of cybersecurity. I was part of this Department of Defense organization called the Joint Task Force for Computer Network Defense. We were co located with the Department of Defense CERT which was run by Bobby Stimfley at the time. And Bobby introduced us to the Carnegie Mellon University Software Engineering Institute cert. And at the time this was a bastion of knowledge on all incidents. And they had built a taxonomy that allowed us to discuss incidents in a a good common way. They coordinated with all other certs anywhere in government and outside of government and helped everybody understand best practices. So it was just absolutely of critical importance. I believe they were stood up after the Morris worm had taken down networks across government. But that was now 20 years ago. And I just. I know that you guys have been evolving, and I wanted to ask you about the circle of today and what you guys are and what you're doing.

Well, you got it right. And all those things that you. You found in 1998. We still do. As a matter of fact, our. Our database of known vulnerabilities has grown to the point where we are getting close to tipping over 3 billion different vulnerabilities. And as of last week, we are, on average, we are ingesting through our partnership Networks as the CERT Coordination center for the global CEHRT community, about 132,000 new vulnerabilities discovered every day. Getting back to our history, though, in 1984, the Department of Defense realized that, hey, we're bringing in all sorts of new capabilities that were all automated. New weapon systems, the F15s, the new Abrams tank. Back in the day, they were all computers with wheels and wings. The ships the same thing, computers on a boat. The Department of Defense created a federally funded research and development center focused solely on software and software engineering. They placed it here at Carnegie Mellon University in Pittsburgh. And hence the Software Engineering Institute was founded. You're absolutely right about 1988. In 1988, not only was Internet Relay Chat created and the World Wide Web posited, but we had the Morris worm, which was the first worm that went around the world. And it was choking not only ARPANET and the net that was out there, but it was hopping out and interfering with command and control, military operations, and a lot of businesses that were starting to be affected. The Defense Department expanded the role of the Software Engineering Institute to include the first computer emergency response team. Since that time, we've evolved and we were cited by many as the birthplace of cybersecurity here at the Software Engineering Institute and cert. Now, though, with the evolution of all the different things that we've learned and what we are continuing to do, we're pivoting from that reactive computer emergency responder response that kind of was the hallmark of CERT to a more proactive cybersecurity engineering and resilience team. And if you think about it, what we're trying to do here at the Software Engineering Institute and within the CERT division is to proactively try to, first of all, advance cyber by design. We want folks to understand the best principles and the best ways of making systems, software, and people resilient by cyber by design. We want to make sure that we are building in resilience. Anybody who's had a brother knows you're going to get hit, but you got to keep on going after you get hit. In the cyber world, you need to have resilience built in so that in the event that you have an incident, it's not going to be a calamitous existential event for your company, your government organization, your business, etc. You need to make sure too that you share all of your knowledge that you gain. As a research and development organization chartered by the Department of Defense, we share our information so that we can help the market advance, so that there will be better products and we want our evidence based research to help the market get better with better products, more secure by design, and really better serve the US Government, but also the broader cyber ecosystem. Then finally, with the cutting edge research we're doing here at Carnegie Mellon, we look to advance the future as well. Doing pure and applied research here at Carnegie Mellon is phenomenal and it's one of the best universities in the world. And as we look to the future, we want folks to know that here in the cert it's all about engineering for cyber and cyber into engineering.

And let me ask this, you're part of sei, which also offers a lot of courses and design things. And is it. I know the things you do influences just about everything at sei, but now do you offer your own certifications? Like do I take a course through the CERT or am I taking a course through the SEI that the CERT has influenced?

Actually, we have several different partners across the university who run certification and accreditation programs and CERT members are often faculty members in an adjunct fashion. With those partners, I'll call out the Heinz College, which is one of the centerpiece parts of the university where we bring in folks from all around the world and all around the country for programs like the certification programs for CISOs, for CIO Chief Risk Officers, Health informatics and others. Where it's think of it as a executive education and certification granting program where the Heinz College takes the best from across the campus as far as the faculty as well as within industry as well, brings in the best in the subjects, incorporates some of the cutting edge research we're doing here at Carnegie Mellon so that our graduates understand not only the best practices and leading practices in the market today, but also they're better prepared for the future by the fusion of our application of the research that we are endeavoring in Carnegie Mellon every day.

Helpful, very helpful. So I appreciate that. And Greg, I have a final question. I've heard you speak before in ways that just really, really help convey complex topics in an easy to understand way. And one of my favorite stories from you was right out of Star Trek. You mentioned earlier you're a big fan, and this particular scene that you set up for us had to do with the lack of multi factor authentication in a Star Trek episode. And I just wanted to ask you to walk us through that.

Yeah. I'll go back to the Wrath of Khan movie, which came out in 1982, and we talk about multi factor authentication as an essential element of your security posture. And we certainly saw that this past week with the latest OMB directive out of the White House on making sure that all systems would have multi factor authentication, which I think is just a reiteration of what we started saying back in 2003. But in. In 1982, we knew that you needed to do things like have multifactor authentication, and you had to change the default password right out of the box. One of the oldest tricks in the book is to go scan the Internet looking for default passwords. And then, you know, it's like wearing a cyber kick me sign. But back in 82, you know, in the. In the movie Wrath of Khan, Kirk's old nemesis Kahn, played by Ricardo Montalban, stole the USS Reliant and used it to attack the Enterprise and severely damaged the Enterprise. It was grim for the crew of the Enterprise. Khan had the ability to kill him right away, but he wanted some data from Kirk, and he said, I'll give you 60 seconds to transfer the files, the data, or I'm going to kill you all. And Kirk looked at Spock and said, cut the mic. Go get me the command codes for the Reliance. And Spock said, well, he's probably changed him. He's very intelligent, intelligent person. And Kirk said, do it. It's all we've got. And sure enough, Spock went into the computers, looked up the default password for the Reliant, the stolen ship. It turned out it was 16309. Kahn came back on and said, all right, your time's up. And Kirk says, okay, here's the transmission. They plugged in the default password, dropped the shields of the stolen ship. Scotty and the crew fired the last two shots they had drove off the Reliant, and they lived to fight another day. It's important to understand how things work on a starship. Kirk did. He changes his password so that it doesn't happen to him. And you need to as well, Right?

Very good points. And I tell you, it's a reminder for all of us that all of the good guys should use multi factor authentication and good complex passwords. None of the bad guys should.

Well, and sadly, the bad guys are generally running with our playbook. They will follow the playbook very closely. The really bad guys out there, they're pretty tight on their cybersecurity. We need to be tighter.

Greg, thank you very much for this. I really appreciate it.

Thanks for having me. Bob, It's a pleasure to talk with you and your audience.

Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity technology and global risks, please visit www.oodaloop.com.