Cybersecurity Trends, Funding and Future

All right, welcome to In Case You Missed It, GovTech's weekly government technology News Roundup, where we're going to take a look at the biggest GovTech news from the past week and give you our thoughts on what it means to the market, residents, and to government overall. I'm Joe Morris, joined by Jed Presgrove. Dustin's out this week taking some much-deserved time off. This episode is brought to you by Fortinet. State and local governments are big targets for cybercriminals, and Fortinet has a variety of holistic integrated security and cybersecurity solutions to help prepare and protect the public sector from attacks. For more info, go to www.fortinet.com. Today we're joined by Fortinet Chief Information Security Officer Jim Richburg. Before Fortinet, Jim spent 20 years at the CIA and served as senior advisor to the Director of National Intelligence on cyber issues. He'll join us in just a moment. But first, let's talk about what caught our eyes this week. First up, our own Dan Lorman wrote this week about cyber insurance and how it's getting more expensive. He cites an article from the Harvard Business Review that says, though cyber insurance is a must-have for businesses and the public sector nowadays, it's becoming an increasingly unattractive business venture for these insurance companies. Ransomware attacks are not only increasing, but they're becoming increasingly expensive. Jed, what are your thoughts?

You know, I sort of wonder whether this situation with the, the cyber insurance market is going to make more people start to look at the advice of some cyber experts who say that you should never pay the ransom. You know, this reminds me of a story that I read not too long ago about Florida. This story came out last month, actually, and there were a number of lawmakers in the Florida House of Representatives that wanted to institute a policy that would basically make it impossible for state and local governments to negotiate with hackers, including paying a ransomware amount. So that, you know, I kind of wonder if that's going to be something that more governments are going to look at, like that sort of policy, if the insurance rates go up way too high. The other thing that I'm thinking about too is that this should make organizations and government basically raise their cyber standards across the board. Now, of course, this is something that's already on a lot of people's minds, but we still probably have some people that, you know, haven't gotten the wake-up call. And so as they look at the cyber insurance market, the time is now. I mean, the time has always been ready to up your cyber standards, but the time is definitely now with this news about the cyber insurance market.

You know, what's interesting too is a couple years ago, I saw the first references to these large financial firms, the Moodys and the like, that kind of, you know, work with governments to give them their credit ratings, right? So they can borrow money. They said, hey, if you don't get your cyber house in order, We're going to ding your credit rating, which is going to impact your ability to borrow money. And that also helps kind of push the market forward. But yeah, I think we are hearing a lot from the CIO community, from the CISO community on this changing landscape around cyber insurance, the difficulties now to get the insurance, the difficulty of the vendors to provide it, and how effective is it overall anyways in terms of actually keeping you more secure, having that peace of mind. I'm sure our guest will share some, some insight on that a little bit later.

So another story that caught my eye, and we're staying on the subject of cyber threats and security here. This week, President Joe Biden signed into law a federal cyberattack reporting requirement. The requirement, which is part of the Strengthening American Cybersecurity Act, requires companies that run critical infrastructure— so we're talking places like banks and utilities— to share information with CISA about incidents within 72 hours. This law would also require ransomware payments to be reported within 24 hours of making them. It's also important to note that right now nobody knows how many companies get hit with cyberattacks and ransomware. This legislation may help fill that reporting gap. You know, this is something that has been in the talks for a long time. Joe, I'm just curious, what are your thoughts on this one?

You know, I think All in, we've seen over the last 11, 12 months the White House taking a heavier hand when it comes to cybersecurity, and that's through efforts like this. There's efforts now with the FCC in terms of trying to make sure that the telcos have the proper security measures in place. Making sure that significant breaches are reported goes a long way in helping others in the public sector understand the threats that may be out there and what they need to do to keep their keep their communities safe, keep their organizations safe. I think this is a sign of more efforts to come. And obviously we've talked a lot in past episodes about cybersecurity, but even in the area of data privacy, I think there's going to be a lot more legislative and mandate activity coming from the federal government. So, you know, with that, that said, I want to bring in our guest, Jim, the CISO of Fortinet. We've got questions for Jim, but maybe he can also, you know, shed some insight into our stories, Jed. But before that, Jim, it's super nice to have you on this week's episode.

Well, Joe, it's great to be with you and Jed. Thank you for having me here today. And I'm the CISO for the public sector, not for all of Fortinet. We're a big global company. We've got folks who specialize in different parts of the market. You know, after 34 years in the federal government, they figured I speak that language. Let me do that one.

Jim, welcome to the show. So, you know, the first thing we were curious about, these stories, these news stories that we just talked about, do you have any thoughts about these news stories?

Yeah, I do, Jed. And, you know, I've been doing cybersecurity or looking at threat actors in cybersecurity for over 30 years. And we always talk about cybersecurity as a mix of people, process, and technology, which is holding us back the most at any moment. But I think the biggest problem in cybersecurity is actually this boring thing called metrics. We have a lot of trouble figuring out if we do this, what is going to be the outcome? And part of this is both of these stories were about ransomware. On a scale of 1 through 5, is the occurrence of ransomware in the U.S. 1 or 5? We're doing a lot of guessing. We're making big national decisions. Organizations are spending lots of money on the basis of really imperfect data. So this idea of the mandatory breach reporting, which is. Only of significant incidents, only by companies that are parts of critical infrastructure, is a way to say, let's get beyond this analysis and policymaking by anecdote and put some data behind it. There was a proposal in the Solarium Report, which was that bipartisan public-private sector idea of coming up with innovative ideas on cyber. One of them was on a Bureau of Cyber Statistics, literally something that could help Both the insurance industry figure out actuarially what's happening, but also allow companies to be able to say what works, what doesn't work. And part of that is how much threat activity is actually going on. Incident reporting helps solve that.

And Jim, one quick follow-up question. So of course, this requirement would only cover the critical infrastructure organizations. Do you think it should be broader than that?

You know, I always believed when I was in government, crawl, walk, run. Let's start with something that's modest like that. Jed, you think you're the one who raised, should this be linked to the idea of banning ransomware payments? I'd be leery of an absolute prohibition, just like law enforcement can recommend that you not pay a kidnapper ransom. They can't tell you flat out, don't pay it. You want your loved one back alive. So I think it's reasonable to say, a company should be required to look for alternatives. So there's a consortium out there that actually has a lot of the ransomware keys, and it's amazing to find how often these criminals are reusing things. And wait a minute, the key is in the public source. So here you can get it decrypted. Fine to say, look for alternatives by requirement. I'd be really leery of saying, guess what, your Colonial Pipeline, your data is toast. That's it, it's never coming back.

Yeah, I think it's this, you know, federal effort is how do we become aware of a Colonial Pipeline attack? Because the last go-round, that wasn't the case, at least not quickly enough. So, Jimmy, you know, I briefly introduced you on the start of the show, but maybe you could tell us a little bit more about yourself and your work at Fortinet.

Okay, well, sure, Joe. So I joined Fortinet 3 years ago after over 30 years in the federal government, which I euphemistically say, yes, you said I was with the intelligence community. I spent 20 years at CIA. I helped build and then run the big whole-of-government cybersecurity programs under Presidents Bush and Obama. I was the National Intelligence Manager under several Directors of National Intelligence. So I was basically setting the strategy, coordinating threat priorities across 17 departments and agencies. And again, then I spent my first 20 years at CIA, which is not just a job, it was an adventure. I did everything from that classic desk analysis, which is not Jack Ryan, to help develop mission-impossible technologies and help bring war criminals to justice. And during my 34-year career, cyber was always the center of gravity. So when I was retiring, I knew I wanted to keep going in cyber. And I was looking around the private sector, and I discovered that, lo and behold, unknown to me, industry had developed these capabilities that Gartner's new term for it is cybersecurity mesh architecture that are really, really powerful in terms of enabling cybersecurity capabilities. And I said, wow, why didn't I know about that when I was in government? So my mission when I joined and started working in the private sector was to help my colleagues and my successors be better informed, if not smarter than I was, about what the private sector was doing in cybersecurity. And since I've joined Fortinet, I did a lot of work on election security. I helped early in COVID organizations, especially in the public sector, figure out how to cope with the expansion of the need to have citizen services go online while the employees were working remotely. I was on the cutting edge of talking about that new thing called hybrid, which has now become, you know, a meme. It's like, yeah, yeah, get over it. We're beyond that. I do a lot of work with public-private sector partnerships. I'm on the council that Advises the federal government on what we should do, the World Economic Forum. You know, a lot of work really in the space of public-private partnership in shaping cyber policy.

Jim, thank you for that introduction about your work at Fortinet. So I'm just curious, what are some of the most exciting or even challenging things that you're working on right now in the public sector?

So, Jed, one of the challenges, and it's a perennial one in cyber, is We're always playing whack-a-mole. We're always driven by the threat of the day, the latest breach. So the challenge is how to be strategic between fighting the fires. When you come charging out of the firehouse to put out that brush fire and then you come back to your center of gravity, are you still moving consistently in a given direction? You know, we've talked about geopolitical tensions and what's going on in Ukraine. For the public sector, Advanced persistent threat actors, we use the acronym APT, preferentially tend to be nation-state and they tend to target public sector organizations. I have this joke when I talk to people in the private sector and say cybersecurity is important, you want good cybersecurity, but for many of your organizations, you don't have to have the best cybersecurity out there, you just have to be good enough. It's like the old joke about if you're out hiking and you run into the bear, you don't have to be able to run faster than the bear, just the hiker next to you. The criminal will go after the easier target if you're too hard. Well, that's not the case for these APT actors. If they've decided they want something you, a public sector organization, has, they'll keep trying until one of your employees makes a mistake, until they find that vulnerability. So the public sector has to worry about a different class of threat actors. And guess what? The criminals also want what the public sector has. 'Cause they have lots of money too. And one of— we talked about ransomware at the start of the show. Ransomware has actually, in my estimation, been one of the things that's fueled the rise in something that— it's like APT, advanced persistent threat. It's APC, advanced persistent crime. This steady source of revenue is causing criminal groups that used to come together, do something, and then disband and reform in this sort of fluid fashion to stay together because the money is always there. So you've got the same people writing code. They've got help desks, help desks when they license their software, help desks for organisations that say, what is this Bitcoin and how do I buy it? And they're also becoming faster at exploiting the kinds of threats that nation states have typically mounted. So this is a real hard problem. And the final thing I'd mention on something that I find exciting is I've always tried to bring a sort of out-of-the-box approach to problem solving. And one of the things that I find exciting to work on is not everything you do in cybersecurity has to be big or expensive to be impactful and make a difference. I chair a group that runs across the IT sector and advises the federal government, and I chair the one about how we can help state, local, tribal, territorial cybersecurity. And yes, send more money would be nice. But the reality is those governments spend a lot of money on IT products and in some cases even on cybersecurity. And let's start from the position that nobody sets out to be insecure. But if I'm in a small procurement office in a small city or a county, I don't know how to specify cybersecurity in what I'm buying. So who does a lot of that? The federal government, the Defense Department, GSA, the big organizations that actually buy a lot of stuff have got a a lot of contract language. So hey, let's make a library of existing contract language and make that available to state and local government. So if I'm going to buy endpoint stuff and I'm the clerk of a small town, I can look up something, I can throw that into my contract, and guess what? The vendor community that sells to the federal government says, oh, I know how to deliver that. So things where it's a matter of taking something that we've already done And repurposing it.

You know, I like that. I mean, the public sector is great at, you know, steal this idea. That's right. They don't compete with each other and they should collaborate more. So that's a phenomenal insight. And I think your other insight is interesting too, because, you know, it seemed like a decade ago we didn't have the ransomware at the same level. And we heard a lot more about hacktivism and maybe a particular police department might get attacked or elected official might say something. And then all of a sudden now there was a response and an attack. Now it doesn't matter, large, small, places you've never heard of. The attacks are coming everywhere. It doesn't matter, big budget or small budget. The ransomware is hitting everybody. And I think that probably is why cybersecurity is a frequent topic on our show. And I think over the last 15 years that I've been part of the Center for Digital Government, a decade of them, cybersecurity has been the number one priority on the CIO priority list. When you look at that, Jim, and you see cyber there every time, a lot of discussion on cyber, you know, cyber fatigue can also set in, but there's also underneath that like pertinent issues, timely trends, things that are impacting it. So a little bit further on your, the last question is what are the things that have your attention now or should have the CIO or CISO's attention now as they look into 2022?

So, Joe, I'll try to keep that— again, I like to say I like to be strategic at looking at things. We always have an uphill battle on cybersecurity when it is exceptional, when it is different. We talk about mainstreaming cybersecurity, and I think we've actually got convergence working in our favor. Increasingly, networking and security are 2 sides of the same coin. We saw this when we all went to the direction of hybrid. Yes, we needed to enable people to work from home. But, you know, implicit in that conversation was it's got to be secure because especially for government services, this isn't going to work if I'm providing a connection that is absolutely exploitable. I talked about metrics. We could measure whether we succeeded in giving them the connection, certainly the box to use. We couldn't as directly measure whether we did it securely, and we watched ransomware go up 1,100% in the year after we started working from home because The home environment was that much less secure. So what's working in our favor is the idea that networking and security are now increasingly unified, that you're starting to see more and more devices and services. The idea of software-defined networking— if I'm not going to go back to the office and it's going to look the same way, I can define my network on the fly. It can include the person working out of the coffee shop, and the same device that enables that kind of software connectivity is also the security device. So I don't have to say network performance or security. They're both the same thing. So that works in our favor. And the second big trend that I think CIOs and CISOs need to keep in mind is within security, we increasingly have something called consolidation. Devices themselves under Moore's Law are not only getting more powerful, they're becoming more like Swiss Army knives. So you may say, I have to upgrade something in my cybersecurity stack. In my ecosystem and, oh, this will now do the functions of 10 or 11 things. I don't necessarily have to retire them now, but when I do, I don't have to buy replacements because that one thing will help. And it also avoids this chronic problem we've had in cybersecurity of we're really smart, creative people. There's a problem. Some smart people are going to go find a solution. If it becomes successful, it's going to be adopted. Rinse and repeat that cycle over 15 years and you may have a large organization that has over 50 different security products, all solving separate problems, all reporting into the SOC, and all requiring the human to do this manual interpretation and integration. That's crazy. So fewer things that are more powerful means you're getting that kind of integration as well. And I talked about this idea of mesh. You know, we always say, and I'm sure you've heard this phrase, I hate it, the attack surface, right? You know, that's one of the things we say is a complication in cybersecurity because our network surfaces, our connections are big, we don't understand them, they're complex. But if you instrument that surface, I'm saying this as somebody who worked in intelligence, and if I have instrumentation that can actually sense what's happening on it and I have artificial intelligence and machine learning at the back end, I'm actually turning my liability, size and volume, into an advantage because I can see somebody trying to do something and failing, which they normally do before they succeed. I can stop them where they're doing it, and I can actually block them everywhere. So that idea of consolidation is really powerful. And I think not that many people who are in IT or security recognize that. They look at, I'm upgrading one thing, and you want to say, look, it's part It's part of a broader ecosystem of capability that if you do this, it's actually gonna enable a whole lot of extra goodness to flow out of this.

Jim, earlier you said that there are a lot of things that people can do without spending a lot of money to improve cybersecurity, but I do wanna talk about funding some here. You know, right now states and localities are getting a lot of federal funding for cybersecurity. I'm just curious, What advice would you have for them to help maximize the impact of these dollars or just one-time funding in general?

Well, Jed, you really hit a hot button for me. I mean, we have that, you know, Infrastructure Investment and Jobs Act, and people look at it and go, yes, $2 billion for state and local cybersecurity, $2 billion out of $1.2 trillion. If that's all we spend on cybersecurity out of that, bad on us. That's going to be an epic fail. A couple of things to keep in mind. Infrastructure lasts a long time. We have cities in this country on the East Coast that are using water pipes that were laid down in the 1800s. We have traffic going over a bridge, commuter traffic that was built in 1697. So, you know, you build it, it's going to last longer than you actually envisioned. All of this infrastructure has a digital dimension. Bridges, we watched an interstate highway bridge collapse because pigeon poop built up on the girders and corroded them. Everything has sensors now, it has actuators on it. So Jim's digital field of dreams, connect them all. Can I tell you how I might want wastewater and bridges to talk to each other? No, but if you connect them, some smart person will find a way to leverage it. And people say, well, you're enabling the adversaries. Newsflash, we already see threat activity jump from sector to sector. So this infrastructure investment is an opportunity and a responsibility for state and local government. You have the opportunity to build the digital fields of dreams, but darn it, your minimum responsibility ought to be to architect in the ability to see threats moving from one to the other. Because I can guarantee you're going to be in this operations center for your county or your state and you're going to say, oh, I just watched the threat actor go from here to— well, I don't know where because they keep score differently. It's like when we threw a lot of money at first responders after 9/11, And we just discovered that left to their own devices, they would each do what made sense to them. And it took big things like a fire that required fire departments from multiple jurisdictions to say, guess what? They're on different radio frequencies. These are easy problems to address at the front end when you're setting out to spend the money. They're a whole lot harder to corral after you've made the investments. I'm not passionate about this or anything, guys.

Yeah, we can't tell. We can't tell that you care about this deeply. So, you know, some people say that funding is not necessarily the issue in government when it comes to cyber. You know, there's a lot of talk around capacity and expertise. So what can government agencies do to increase their capacity in order to manage risk and also combat any threats that they might have to deal with?

So, Jed, let me hit the workforce and skills gap as a perennial one. And yes, you can do training. Government You know, can help with STEM education. There are programs like apprenticeships. You can do rotations. There are a lot of things we can do to increase the size of the pipeline. And actually, the gap has been closing. If you look at the latest statistics, still, you know, multi, multi-million, but, you know, the numbers seem to suggest it's closing a bit. But the reality is the public sector is never going to hire its way out of the problem. Not only are there not enough people to go around, the public sector can't compete with the private sector's pay scale. So the thing I tell people in the public sector is you got to do a combination of this: modernize, automate, federate, and outsource if you have to. You're doing IT and security modernization anyway. You're going into more cloud-based services, more fill-in-the-blank as a service. I've already talked about convergence of networking and security. Use that tool. It's going to give you more capability for IT and more capability for security. Automate security automation. That artificial intelligence and machine learning I talked about that could make the attack surface become your friend and not your enemy applies across cybersecurity. We talk about ransomware, you need to respond to things. Automation, AI-driven is the way to do that. Federate, there are times when especially for local government, they are never going to hit critical mass in terms of experts or money to do something jurisdiction by jurisdiction. So they need to regionalize it. Maybe it's at the state level, maybe it's bigger than that. But there are times when pooling your need makes it possible to accomplish something. And then sometimes you just look at it and you go, I can't do this in-house. Some of these harder things on response, if I'm a small jurisdiction, I may just need to say I need to outsource it. And guess what? That doesn't have to mean to the private sector. Sometimes you simply say a partner in government on that sort of federated model may be a more efficient way to do this. than my doing it. But the idea that everybody in government has to do every function in security is just never going to work.

So, Jim, what's on the horizon for 2022 for Fortinet's public sector practice?

So it's IT and security modernization. You know, it's helping them with that hybrid of the new normal. It's operational technology. You talk to organizations that say, well, I'm not a utility. I don't have any of this operational technology. And I go, well, you do have smart buildings. Energy efficiency, public health monitoring, surveillance cameras. These things are all actually operational technology. So finding ways for them to secure operational technology as well as informational technology is important. Helping these organizations figure out how to make these smart decisions at the front end of their investment of the infrastructure dollars that will be rolling in over the next year from the federal government is important. And then, of course, We have mid-year elections. Elections are expensive to run. The rules are being changed in a number of jurisdictions, and all of these elections require private sector infrastructure. I mean, even the voting machines are made by the private sector, and almost all of it is conducted on general purpose IT that state and local government own. It's not like you say, let's take the election system out of the closet and use it. They're using the And that's the same network, the same devices they use for general purposes. So helping them recalibrate, reinstrument, resecure that with another election cycle, those are the kind of priorities that we're focusing on this year.

Great, thanks for sharing that. Where can our audience follow your work and plug into what Fortinet's doing?

Well, you, you can catch me certainly on LinkedIn, and for Fortinet, go to our website, fortinet.com. You can figure out what we're doing, and there's a search bar in the upper right corner. You can put me in and you'll also find some of my articles and blogs as well.

Great. We'll make sure to include that link in our show notes. But that's all the time that we have today. So thanks again, Jim, for joining us and the support of this episode by Fortinet. And for the folks watching, join us again next week, Friday, 12:00 Pacific, where we'll chat with Gary Cooper, the CEO of Replit. Have a great weekend and see you all next week.