The Future of Cybersecurity

Right, TGIF. Welcome back to another episode of In Case You Missed It This Week in GovTech. Now we've got a special episode planned for you today. Because we know the number one priority for state and local government officials across the country with technology is cybersecurity. We've seen agencies across the country hit with ransomware, social engineering attacks, all kinds of new things. Now we've got killware. And so we have brought in an internationally recognized cybersecurity leader, technologist, keynote speaker, blogger, author, senior fellow, and more to break down what he has seen in this landscape He's also the Field Chief Information Security Officer for Public Sector at Presidio, but he's most recently co-authored a new book called Cyber Mayday and the Day After: A Leader's Guide to Preparing, Managing, and Recovering from Inevitable Business Disruptions. And he previously led Michigan's government cybersecurity and technology infrastructure teams from 2002 to 2014, was a Governing Magazine Public Official of the Year and Computerworld Premier 100 Leader. I'd like to invite to the stage Dan Lohrmann.

Hi, Dustin.

Dan, thanks so much for carving some time out to join us today.

Thanks, Dustin. It's great to be with you and Joe. It's great to be here, and thanks so much for having me.

Yeah, so let's start first just with your background because you are, you know, a very seasoned cybersecurity expert in the industry, but how did you end up becoming the government cybersecurity guru?

Yeah, thanks. I mean, I, you know, it's— I have a blessed career. It started at NSA, so back in the late '80s, you know, during the Reagan years. was in England with Lockheed and Mantec. So I was in the intelligence community in my early days and it was doing networks, but security is our middle name at NSA, right? So it's like everything was cybersecurity. But then joined Michigan government in the late '90s and we did a lot of Y2K during those years and I was agency CIO, did help build Michigan.gov. E-government was huge and And then 9/11 hit. And in Michigan, as you guys know, we had a big centralization back in those years. And Governor Engler at the time brought all the different agency IT groups into one shop. And it was pretty clear we needed a CISO, right? So I was a guy with NSA with a background, and I became Michigan's first CISO. I think the first CISO for all 50 states, state governments, SLED governments. But that was '02. So really kind of the rest is history. Been really working with cybersecurity my whole career, but in government really since '02.

That's great, Dan. Thanks for joining us. Dustin mentioned off the top some of the threats that we're seeing across state and local government. What are you seeing out there in the cyber landscape for states and localities? Any new threats, bad actors that leaders should be aware of?

Yeah, Joe, I know it's interesting. I just read a report that came out from congressional testimony. It just boggled my mind earlier this week. It said that the ransomware attacks, and you guys know this, but the numbers blew me away. The ransomware attacks this year alone are more than the last 10 years combined. And I mean, when you think about that, I mean, in 2019 was pretty bad. You guys know I blog for Government Technology Magazine, and I thought 2019 was the year ransomware hit state and local governments. So, and then 2020 was way worse than 2019, and now 2021 is even worse. So, I mean, you got to kind of start, you know, the whole conversation with ransomware. It's probably worse than we're actually even hearing about. So there's all different types of that, of course, you know, different angles on that. We could talk a lot about different ways that, you know, people are not just, you know, asking extortion for the money, but they're reselling, you making money 2 and 3 ways out of it, selling the data anyway, threatening if you don't pay, they're going to release it on the dark web. I think those are still the top stories for this year. New threats are just hitting each and every day, and I have to say, it's accelerating. So I don't see this slowing down as we head into '22. Lots of different specifics we could talk about. about that. But yeah, the threat environment continues to worsen. I think the only other thing I would mention, and you guys I know have talked about this on your show in the past, but I just— I talk to CISOs and CIOs all over the country and government every week like you guys do, and the shortage of staff is really, really a huge issue. Doing lunch with CISOs out at NASIO conference, different people, Everybody is just really— they've lost a lot of staff this year. Some have lost— I know some CISOs that have lost 50% of their staff, and it's to the point of crippling. I mean, they just can't get work done. They have a priority, they have a plan, but they can't execute it because they can't keep people. So the cyber talent issue, I think it's becoming a crisis for state and local governments.

Dan, I'd like to go back to, to the new book and repeat the title in case someone missed it. Cyber Mayday and the Day After: A Leader's Guide to Preparing, Managing, and Recovering from the Inevitable. I was just wondering if you could share more about why you decided to write the book and who the book is for.

Yeah, thanks, Jed. Appreciate that. And appreciate you guys letting me talk about this. It started really— I'm going to go back a couple of years. During COVID especially, but even before that, I've been working with a number of people around the world actually who I met through LinkedIn. My co-author, Shemaine Tan, is a real cyber superstar in Australia. She actually comes from Singapore, but she's been in Sydney, Australia now for over 10 years. And she started something called Cyber Meetups, which they have meetings in like 5 Australian cities. They meet in in Japan, in Tokyo. They meet in Singapore and some other Asian countries. And she's getting huge attendance at her events before COVID I was actually going to go over and be in Sydney for a wedding. I was going to speak at one of their events. Of course, COVID, 2 times, canceled my trip to Australia. So, probably like a lot of other listeners, my travel plans changed because of COVID But basically, Charmaine reached out to me in August of '20. and said, you know, I'd helped her write a chapter in one of her books, her first book on cyber leadership, cybersecurity leadership for CISOs. And she said, you know, let's write a book together. And so we've been working on this for about 15 months. The interesting thing was we talked about this topic, what should we write about? We talked about ransomware, cyber incidents, emergency incidents. This was before SolarWinds, before Colonial Pipeline hit, before before JBS Foods and all the hospitals and all the destruction in 2021. We were pretty much done writing it back in February, handed in our manuscript back around the 1st of May, and then Colonial Pipeline hit, then JBS Meats and the Ireland Health Service all went down. So we were able to include those in those 35 stories. So what we thought was missing and how we came up with this topic was really there's so many great checklists out there and we referenced them from NIST, the Cybersecurity Framework. There's a lot of great private sector checklists from around the world. Other governments have those checklists. We have those references in the book. So we cover those. What we thought was missing in the market, we think this fills that niche, is true stories. People want to hear what happened when you were hit. I was there in '03. when the blackout happened, but all the way through to emergencies in 2021. What did you do? How did you do it? Who was involved? Who called who? Basically, the nuts and bolts of what happens during a cyber emergency. And so really covering that and really covering true stories with practical tips. And the audience really is for not just technology and security pros, but business leaders, small businesses. There's a lot of stories in here from state governments. I've got Nancy Reyna-Sec in there from Texas and Kevin Ford, North Dakota. He's now gone to the private sector, as Maria Thompson has in North Carolina, but stories from all over the country. Cities and counties are in there, but also lots of hospitals, lots of large Fortune 500 companies and global companies. You know, really true stories, what happened. And so the audience is CXOs, leaders. I think technology and security pros certainly will benefit from this. But really, you know, cyber emergencies are business problems. And we're going to talk about that for all levels of leadership. It's not just for the security and technology people. It's business risk. And so we really want that audience to hear this leadership really across the board in business.

So for those that are listening in right now that, you know, think cybersecurity is just a CIO, CTO, CISO kind of function, you know, what would you tell them? I mean, you know, this book is really targeting, as you said, that full palette of leadership, business leaders that are out there. Why is it something that everyone needs to wake up to in the organization?

Yeah, great question, Dustin. And I think if you really look at What happened with Colonial Pipeline earlier this year, that I think really, for a lot more people, changed the conversation because they saw the impact of ransomware and you had gas lines that were 3, 4 hours long in the Southeast part of the United States. I mean, it's a business issue. Businesses shut down. I think in governments, we saw Baltimore, Philadelphia, we go through the laundry list, Atlanta, throughout Texas, government shut down, the business of government shut down, and you can't do tax returns. There are challenges that people are facing across state and local governments, private sector, which really hit people and disabled business. And so emergencies, and we talk about this in the book as well, a lot of people talk, even before this last couple of years, people talked about all hazards and whether you're brought down by a thunderstorm or a hurricane or flood or fire or tornado or cyberattack, if the power goes out, it affects the entire business. So I mean, it really— this is really something. I think blended threats, we talk about this in the book, blended threats are another challenge is that when you have a major issue, the attackers, and the stories of this even the last couple weeks, kind of doubling down and piling on, if you will. Okay, you've got an outage, you've got a problem because of some natural disaster. Can I take advantage of this while everyone's looking left and I can come in on the right? And so it really is a business risk issue, and it really infects all levels of government, it affects all leaders, and the impact really of about recovering from that affects all of us.

I want to dig into your book a little bit. The book's divided into several major sections, and I want to talk about your hypothesis for the first section. And that's focused on what leaders should do to prepare for the inevitable. So what's some of that advice in terms of what leaders should be focused on?

Yeah, so this is a picture of the book here. I mean, there's so many different stories. What we try and do, I can just give you a couple of them from the beginning in chapter 1, but we start off with really in the intro, we cover from the Biden administration to the Prime Minister of Australia to leadership, Federal Reserve interviews about how this is now front and center and the kinds of attacks that could really disable not just individual organizations or small businesses or governments, but bring down the financial system. So lots of quotes around that. So, you know, really get an understanding of what is the impact of this and what are the challenges we face. And we start right out to give you a couple of quick tips from the beginning. And chapter 1 is we start off with, you know, do you even want to know what the problems are? Because a lot of leaders are like, if I put my hands over my ears, And I don't, because if I know about this, now I got to go fix it. The auditors are going to get involved, but they don't want to know. But there's true stories right out of the gate, like from an airport where they found literally on open servers globally in multiple countries, detailed security diagrams around all different types of templates to get into the airport, badges, signed documents, things that could be used to really cause a terrorist attack, and those all wide open available on public platforms. So true stories like that, how did they respond? What did they do? And basically, the first chapter is about, if I had a time machine, what would I do differently? So if I could go back and any of us, we could do this about any area of life, I know, but with cybersecurity, middle of an emergency, what would I change? What would I change? What would I do differently? How would I do it differently? And what point in time, what 1 or 2 or 3 things would I do differently? And so we end that, we go through stories, true stories. I'll just give you 5 quick tips from the end of chapter 1. We talked about the world will never be immune from cyberattacks. And these are tips directly from CISOs around the world. That's from Singapore Airport. That this is getting worse, it's continuing, that we can't just imagine this is gonna go away because it's not. It's gonna continue and we need to know that cybersecurity is a business risk issue. It's not just what we talked about. It's not just a technology or security issue, it's a business risk issue. Double-edged sword of zero trust talks about so many organizations where zero trust is now the mantra. Everybody wants to go to zero trust model. I'm a big supporter of zero trust. I've blogged and written about that. But in an emergency, sometimes you have to accept and apply patches. You have to apply other things that maybe, quite frankly, you know, you may not be able to follow all the principles of zero trust. So how do you really apply zero trust in a cyber emergency? And how does that work? And that whole discussion and stories around that. 4th tip real quick I'll mention, pick the right person to lead the effort. Mark Weatherford, who is a senior fellow at Center for Digital Government, and you all know he's led a lot of different organizations, Colorado CISO, California CISO, was undersecretary in DHS, and has other great leadership roles. He tells a story in California government about— I don't know if I have time to tell the whole story, Dustin, or not, if I can actually tell it. We have time to go? I'll tell you one quick story.

Go for it.

So he was CISO in California. And the tip is this, pick the right person to lead this because he was CISO over the whole state, did not have authority over each individual agency, but a very large agency. He had negotiated that he was going to be involved in all of those decisions in hiring and interviewing and that kind of thing. Well, someone was selected that he didn't know about. He came in after the fact. He said the person was really nice. The person was very kind, professional, but something seemed wrong. The person did not seem qualified. The person, there's a lot of issues. He said, I saw a lot of red flags. Lo and behold, about a month later, he finds out the person, they had not done a background check. They had not really looked at resume or they didn't really know this guy's background. Turns out he had just been released from prison. And had no experience and had been hired to lead this role. And I won't go into— read the story in the book, but Mark talks about how you need to do these kinds of vetting. Who are you hiring? Background checks, those kinds of things are important. And then last but not least—

That sounds like a cyber mayday right there.

That was a bit of a mayday. And it was, the person was fired and they were very, very, very apologetic about it. Mark talks about that. Act and adjust with resilience when cyber situation evolves. And that came from Deb Snyder, another senior fellow at Center for Digital Government. True stories from New York State government. She talks about how they had a team, they were responding to local ransomware attacks throughout New York. And but very quickly they got overcome by events and it started getting to the point where they could not support all the different requests they had from the counties that really were just kind of overwhelming them. And so they had to adjust. They had to bring in some private sector help. They had to make some changes and adjust their approach. They were able to be successful. And she'll tell you, they had a lot of great successes in New York. So, you know, kudos to them. They did a great job. But they had to really act and adjust. And then she talks about how they did that. So that's just some tips from chapter 1.

Dan, thanks a lot for sharing all those tips and stories. And so people watching, you definitely need to read the entire book so you can get everything. So I'd like to go to part 2 of the book, which is about what happens, quote, when the alarm goes off, end quote. What are the major tactics that agencies should be thinking of when they recognize that an event is taking place? Yeah.

And again, I just want to highlight here, Jed, you know, there's so many stories in the book that you need to read them. I'm just going to give you one from my own personal experience in real life that I talk about in there. And this goes all the way back to '03. So this is almost 20 years ago, 18 years ago. But I was the emergency management coordinator for Michigan Department of Information Technology during the '03 blackout. And many of the lessons that I learned there still apply today, as I mentioned. The first one, what is— and the main point I would say is it's all about communication. How do you communicate in an emergency? Who are you going to call? Are they going to be available? Where are you going to go? How are you going to do that? Basic lists like call lists and making sure they're updated. How are you going to contact people? There's so many assumptions. We say, oh, I'm just going to use my cell phone, right? Well, what if your cell phone's not available? What if the network is down? How How are you going to communicate in those kind of emergencies? What if people aren't available? The Michigan lead for emergency management happened to be on vacation in Mexico at the time. So Chris DiEttio, the Deputy Emergency Management Coordinator, actually ran that whole incident for about 5 days. We spent better part of 4 18-hour, 24-hour days, 18 to 24 hours in the emergency coordination center. And, um, it was just amazing to see how all the thing— all everything that happened during that emergency, you know, people, uh, really getting involved in, in communicating, uh, things you assumed you could do like update the website. We were hosting it in Boulder, Colorado at the time. We couldn't access the website. So a lot of things— we— good news is we had a really good plan. Um, we had just been through Y2K. We had just, you know, we, we had been through a lot of different tests. and we were ready, we did get out of it. In fact, I would say even one of the lessons was if you communicate well, and there are lots of stories, this is just one, you can actually come out of an emergency looking better as an organization. And I think that's what happened in the Michigan Department of Information Technology back in '03, '04, because we actually— so many agencies came to us after this and said, we're so glad you were there because we would not have been able to Do what you did. And so, you know, we had Terry Takai was actually in that emergency as well with me in the emergency coordination center. But I think that one, the number one area, there's lots of stories in there, but communication, it seems so easy to say, oh yeah, we're going to communicate. But there's so many assumptions built into that. And there's lots of stories of like, how do you improve communication? Do you have a plan? Do you have cyber playbooks? We didn't mention earlier, we talk a lot about, you know, certainly have you actually done tabletop exercises? Have you done full-scale exercises? Have you tested your plans? Do you really know? I mean, it's the stories of where I've worked with organizations that thought that they had a plan that was going to work, and then they discovered to do a restore from their backups was going to take like 3 weeks because they had terabytes of data or petabytes of data and And their lines were so slow. So, I mean, you know, really thinking through a lot of these communication issues and making sure that, you know, they're gonna work. So those are just some of the tips from part 2.

Yeah, I think communication is definitely paramount to, you know, responding to that. Now let's talk about part 3 is really about the day after, and that's, you know, the recovery from these cyber emergencies. You know, in your opinion, what are some of those tactics that agencies should consider along the way to recovery and, you know, building resilience long-term?

Absolutely. Well, and I think, you know, we cover— and I'm gonna read some of these to you, but chapter 11, you know, I think, you know, it's my favorite chapter in the book, although a lot of the stories are really fun too. But there's a lot of— it's really turning lemons into lemonade and allowing your organization to really be effective in taking what you learned during this whole crisis applying it back into your plan, improving, you know, just like you do week to week with a football team or anything else. You know, how do you take the lemons, if you will, the situation, and make lemonade out of it as an organization? So we really walk you through a lot of tips. We talk about excuses that organizations typically make, and then, you know, fact-finding questions and then tips to help. So some of those questions include things like, we did not have the time to properly prepare, we could not afford to defend. Our company is different, or our business, or our government is different than everybody else. The vendor told us that it was not necessary. We didn't trust our system vendor the way we should have. We didn't understand why it was necessary. It was too hard. These are 10 excuses why best practices are not implemented or why people weren't doing what they should have been doing. We tried this before and it didn't work. We were afraid, uh, what we might discover. We thought that we had a better way. And then, you know, there's really kind of fact-finding things you can do to say, are you really prepared? Are you really ready? Kind of asking why 5 times, but really going a little deeper. And then tips that can help you in each of these areas. And then we talk about some solutions. And one of them, I'll just mention one, there's lots of stories here again, but making failure real. I mean, what I've heard again and again and again from different cybersecurity pros, consultants, people in government and in the private sector is people who've been through a ransomware attack, they've been through a cyber emergency, and you walk in the room and the focus is there. It's like a laser focus. They're engaged. They really are listening. You can hear a pin drop in the room. They're really, really wanting to help and listen and apply things. If they haven't seen that before, it's maybe not real to them. And so many consultants, so many government people have told me the difference is like between night and day. It's where people are at. So how can you make failure real? How can you really help people understand the importance of exercises, of planning, of training, of really making your practice perfect, if you will? I mean, really perfecting your practice. Because the time is going to come when all of that's going to come into play. And the better you can do it at practice, the better you're going to do in the real thing. So, you know, asking those questions and then stories behind, you know, I wish I had known this, I wish I had known that, and then applying that. So those are just some of the tips. But really taking those lemons and making lemonade out of them is really the key.

All right. Well, your book's out now. So where should our audience go to grab themselves a copy?

Yeah, you mentioned Amazon here is great. You can go ahead and it's available really wherever books are sold. Um, you can go, um, you know, to wiley.com. It's at Barnes Noble. Um, it's, it's really available. We're really excited. It's, it's probably not going to be in Europe and, and Asia till after Christmas, but sadly, but, uh, it's supposed to be translated into 12 languages. So, it's gonna be a global book. Um, we're excited about, you know, it's not just about the US. This really is a global topic. And it's really hitting people all over the world. And certainly, hopefully make some good Christmas presents as well. So, but yeah, I'm happy to, to, you know, interact with people if they want to connect with me on LinkedIn and ask any questions. And, and I just really appreciate the opportunity to be with you guys.

Awesome. You want to quickly share your, your Twitter handle or LinkedIn?

Yeah, @GovCSO, @GovCSO. And I'm on LinkedIn, Dan Lohrmann, L-O-H-R-M-A-N-N. Feel free to reach out and talk to me. And just want to say to you guys, shout out to you. I mean, we just love your show and love what you guys do. It's so important to government and you guys get into the nitty-gritty of government and state and local level and just really appreciate that.

Well, we appreciate you taking time out of your day to share your insights with us. It was a phenomenal episode. So thanks for joining us on In Case You Missed It. And we're gonna take a quick break for the holidays and we'll be back at it after Thanksgiving. But you all have a wonderful weekend and have a— thanks again for joining us on this episode.

Thanks, everyone.