Bobbie Stempfley on improving enterprise cybersecurity and reducing risk through engineering

Informing your decisions with intelligence analysis and insight brought to you by the team@ooda loop.com.

Hello and welcome to the Oodacast. Bobby, how you doing today?

I'm doing well and you doing well.

And Bobby, I am very happy to be able to introduce you to some of our members, those who don't know you yet. Roberta Stimfli. I have worked with you since December 1998. So here's my outline of what I think your bio is. At the time you were heading up Department of Defense activities when it comes to computer emergency response. There was a Department of Defense computer emergency response team and you were in charge of those firefighters that do incident response for the entire Department of Defense. And that was in 98. You went on to lead many efforts in Department of Defense, rising to become the CIO of disa. You then were instrumental in kickstarting Department of Homeland Security and their cybersecurity efforts in the Department of Homeland Security. From there you led several organizations, including a large cadre of people at mitre. And then now you're at the Carnegie Mellon University Software Engineering Institute where you are leading a team that does CERT type activities, but also longer term research into cybersecurity. Now, did I get the outlines of that about right, Bobbi?

Roughly, yeah. So today I run a group of applied researchers at the Software Engineering Institute. We no longer do response. We used to be the US National Response Function. We transitioned that. I mean we were the first response ELE formed to respond to the Morris worm 30 years ago. So before you and I met. But we transferred that knowledge and that capacity to individuals all over the world. So in the United States, that is now the US CERT at dhs, which I, when I was at DHS had the privilege of overseeing. And we help other nations stand up their response functions and companies establish their product response functions as well. And then we do a breadth of research in everything from threat research to econometrics applied to security data to resilience. You know, what is that emergent property that is resilience to security of artificial intelligence and machine learning applied. So it's, it's really a great hotbed of innovative capabilities at the number one computer science college in the nation.

Awesome.

So it's a great team. It's a really great team.

And Bobby, I want to ask more about some other aspects of your career, but first I want to ask your foundational story. How did you get started in this business of computers and computer security?

Oh, gosh. Well, I think like everybody else, I Got started as a kid with a computer. And I wish I could say that I had a really cool Mac at home, but when I grew up, computers weren't in homes. As a matter of fact, when I went to college, a computer wasn't a requirement for your engineering degree. You were supposed to bring a typewriter and if you, if you wanted to, you could bring a computer. So I'm not young, I'm not old either. But. My dad, however, bought us a computer when I was a kid and I got started with that. When I think about my professional life, though, I got started in security and assurance because it was the only job I could find out of college. And I sort of went back and forth in that application of technology to mission needs. And recognizing that trust and assure was going to be pivotal as people were depending more and more on tech.

You nailed it. It is still so critical. You know, trust is what it's all about.

That's right. And it's trusted at interpersonal level between two people. It's trust between compute of the user to the device. It's trust between the devices. It's human machine teaming. And trust, I think is growing even more important as we think about how much we're automating and where the humans are in that, to use your phrase, in that OODA loop.

Bobbi, what was your first job out of college?

I wrote software. Wrote test harness software for digital phone systems at Port Huachuca, Arizona. And then I had the opportunity to start as a project engineer in the department of the arm.

Oh, cool.

Yeah, it was fun. I tried. I graduated from high school in southeastern Arizona and thought, I'm gonna go to college, I'm gonna get an engineering degree, and I'm gonna get a job somewhere else in the world. And my first job was in the same town that I graduated from high school from.

Yeah. You know, Bobby, another thing that I remember from the old days and consistently through the years, you're also a great personal mentor and a teacher. You've never been. You know, you've always answered questions. You're a good leader and a mentor that way, including to me personally. I remember some of the early things you were teaching me when you were at DOD Cert and we were standing up the JTF cnd, like how to use a command line and how to.

That was a long time ago.

Yeah. Yeah. And it's good seeing you now lead a group of researchers who are tackling these very tough, tough issues. And I want to start asking you some questions about these tough issues.

Including, yes, absolutely.

You know, we're in this crisis right now, this pandemic, where a lot of us have had to go through change. And it's frankly, a lot of it's an uncertain environment. And I wanted to ask if you had any thoughts on how, as individuals or leaders, we can adjust our thinking to optimize our own decisions in this uncertain environment.

So, Timmy, I've spent a lot of time over the years thinking about what the evolution of decision making is going to be as we automate more and more. Right. Perhaps it comes from this idea of expert systems and the idea of application of. Of AI to problem spaces where we keep thinking that we can get enough data that we can reduce the risk in making any given decision. What I've actually been doing a lot of thinking about now is how much power there is in uncertainty and how this pandemic has had to accelerate a whole range of things for us. And one of those things that I think it's accelerating is as leaders, as mentors, as decisions, decision makers, at any level, we have to recognize and understand how uncertainty can be something that can be used to our advantage as much as we have long since seen it as being used to our disadvantage. So, as a specific example, in the security context, perhaps we strive at a computing level to create an environment of certainty for a configuration for something to run and as much uncertainty as possible for the adversary who's trying to get access to our system. That's been sort of the core principle behind all kinds of architectural realities today. We should and can grow that at higher and higher levels of abstraction to the point where we become much more comfortable with how to use this uncertainty as a power dynamic for our advantage, I think. And so what that's going to look like means we've got to get much more comfortable with being uncomfortable.

Yeah. And I can see, Bobbi, how that applies totally in the security world, in that dynamic, and totally in the business world. CEOs, in this current environment, maybe you're used to having a long forecast for your market that would say, here's the pipeline of future business that goes out a year, maybe two years, and here's how to tackle it. Maybe you're not going to have that certainty anymore. It's going to be a very uncertain, dynamic environment. And same with assessing your competitors. Maybe you used to have a list of your top five competitors and you assessed their capabilities to give you some certainty in your decision making, and you're not going to have that anymore.

That's right. Well, so we've long, since we've long talked about the Black Swan events and how, you know, you can't predict those Black Swan events and you've got to find ways to be ready for them. And I think that's. That's right. But I think that we need to, we need to also recognize that we need to be ready for smaller events as well and be constantly monitoring the environment and getting the data that we need and then trusting that data, but recognizing it only goes so far. Right. When you get to data driven decision making, which I'm a huge fan of, you might overextend that data into supporting a decision that it actually doesn't because you want more certainty or you might not move, make a move because you think that there's data out there that you need to collect in order to support that move. And so finding that balance is going to be really important and I think going to be the, going to help us determine how people come through this moment.

Right. Well, Bobby, what you're saying resonates with me. As you know, Matt Deveau and I named our company as an homage to a decision making model, the OODA Loop, which is that kind of dynamic, kind of competitive decision making process in a chaotic, uncertain environment. So what you're saying certainly resonates with me.

Yeah. One of the things I've been spending a lot of time looking at is how, what are the different frameworks of power, how people get influenced to make a decision one way or another and how this idea of uncertainty in those models is changing the dynamics of power. Because in a security context it's, you know, does the, does the attacker or the defender have the power? What is that dynamic? In the ecosystem context, it's does the producer or the supplier have, have that power and influence? And how do you change those dynamics at a national security context, It's Right, so these, this thing is an ever. It's a series of recursive circles that you've got to work your way through and keep from winding yourself into knots. But it's been really exciting to see that this is really something that a number of people are starting to recognize.

It's fascinating and I want to keep reading about that. So if you have any tips or guidance links you can send me, please do and put them in the description of this video. Can I ask some other questions on some related topics?

Absolutely.

Prior to the pandemic, you and I were talking a lot about artificial intelligence and security of AI. We attended a couple conferences together, AI World Gov and then AI World up in Boston, we talked more about artificial intelligence and how of course it needs traditional security, but it has its own challenges. It needs some special protections. For example, it's easier to deceive AI. It can be. Or it can be easier to manipulate the training data and cause problems, or you need to protect the algorithms and you need to have a human in the loop as it's underway, or it may self corrupt itself, those kind of things. Well, that was all before the pandemic. Is this stuff still front of mind or should we still, I mean, how much attention do we need to put on this security of AI, I guess, is the big question.

Yeah, I think it's absolutely still front of mind. And the reason it's still front of mind is that one of the things that has been really true about the pandemic is how computationally heavy our responses to this have been. Right. If you're watching the news, there's all of these conversations about models and which model is right and what are the models say. And there's all the computation going on in the genetic analysis and in the assessments. And this, all of this computation, all of this data begs for more and more automation. And so I think we're really going to see a speeding up of the application of a number of these concepts into some of this, into this domain space. And the innovation here will grow in any other. And I think one of the things we've seen over the last year, you and I have seen over the last year, is that the biomedical market has been that vertical, has been an adopter of a number of these technologies already. And so the need for good security principles around the implementation of these algorithms, good security foundations for the systems that are going to have this added component in it, good data stewardship and provenance for the training data and the execution, good drift monitoring so that you can watch how the algorithms, how or whether the algorithms might be shifting. Right. All of this, I think, is just going to become more important at a faster pace than perhaps it had been before.

Right.

So the real lesson is going to be how do we take it out of this domain and learn it across all of the domains.

Yeah. And Bobby, two key reasons why that is so critically important. One is human error, human mistakes, artificial intelligence being coded wrong, coded with biases. So that's one category. The, you know, just, you know, the way software works and it can change itself and drift. And another is there's bad people out there, we're all coming to realize.

And that's right.

Another key lesson if we look at, since we've been doing the cybersecurity together, the bad guys just continue to innovate and surprise. And, you know, as soon as you patch one vulnerability, they find another or they come up with creative methods to get to their objective. And now we're in this pandemic and it's even worse. These bad guys are so despicable. The kind of things they're doing. They're conducting fraud, they're using cyber attacks for financial advantage. Some of them are conducting DDoS attacks against organizations that are trying to work on vaccines. And that is a big signal that the bad guys are going to be with us forever. And now when we think of, all right, AI is going to be more and more and more important and the bad guys have shown their despicable side. I have a feeling that security of AI is going to be extremely important going forward. Oh, maybe it's just kind of.

There we go, we're being recorded again. You were talking about bad guys. Yes.

So let me start over right there, Bobby. One thing that has been made very clear through decades of our work is the bad guys will continue to surprise us. The people on the other end are thinking creative humans who have objectives and they're going to work towards those objectives. And now I think about everything you just said about artificial intelligence and the kind of things we're seeing there. We have to assume the bad guys are going to ramp up their attacks against any AI that we field. So I think it just underscores how important what you just said is that we are going to have to work in protections for AI in every area.

I think that's right. And I think that one of the things that we need to always remember is that adversaries are not only looking for some vulnerability or flaw in our development practice, they're also looking for, are not understanding how the technology we're using, all the possible ways that it could be used. So I think about it in terms of do we have enough imagination in our test case. In our TAOS right now is because when you think about adversarial AI, that rapid change in adaptation is just going to shift the way threat modeling needs to be done. And instead of threat modeling being bounded by what we understand the system to be able to do, it now has to be bounded by what our imagination thinks the adversary is might want. That will become easier to happen as systems evolve in these rapid manners. And so it's the time to get this right.

Yeah. And Bobby, you mentioned a couple things I want to follow up on there one is imagination. I want to come back to that later because I think it is so very important that we, the good guys, have good creativity and good imagination ourselves. But before getting there, I wanted to ask if you have any recommendations or advice for decision makers today in any leadership role on good sources of information that they should track. What do you use to stay current?

So that's a great question because that's really a rough thing to do. There is so much out there of a range of quality. Obviously, UDA has been a source and really it's been a source because CTO Vision and so much of your early. Of your early products became such an important source for me to understand what the tech landscape was looking like and where all of that was coming from. Thank you, Bobby.

I appreciate it.

I'm a real fan of that. I find that finding a few trusted partners and then building from my network to who they're looking to and listening to is always helpful. I mean, I think the whole world reads Krebs on security. So we all read Krebs on security and to know what's going on there, there are a number of new ones that are particularly helpful. Right. Dark reading and others that help me keep current in that way. I'm gonna brag on my guys a little bit. I love reading the research that we do at the sci. We have a constant line of blogs that come out that are really accessible and some hard technical reports as well. And so it's. I find that that helps me. Helps me keep. Keep current.

Let me ask about that, Bobbi. And maybe this is an unfair question because it's kind of like asking, you know, who you love the most, but like, which is there any that research you would recommend to us? What's very top of mind right now? And because. Or should we just hit the website and look over at all of it?

So I love all my researchers equally. No, seriously, I do. They're all amazing. If you're into. If what. One of the things you're focusing on is insider threat. We have a whole body of work that's around insider threat and some really transformative ways of thinking about it. We were there at the beginning and have some real data sets that have helped us frame how to think about insider threat programs there. So that's really a wonderful body of work. As I said, we do a lot of work in helping organizations stand up CSERTs and PCERTs. And so there's a rich body of activity that's there. We've Been doing a lot of work on an area that I'm personally really interested in and passionate about, and that's in metrics. And what are, you know, measurement has really been the, the thing we have, we still have to solve in security. How much is enough? And is this best practice really the right thing to do? Does the data support it? So we've been doing a lot of work on that from a range of different places. One of our researchers, a group of our researchers, has done some work on looking at vulnerability scoring. And how does vulnerability scoring drive behavior and is it driving the right behaviors? There's a body of work around coordinated vulnerability disclosure. So I can't possibly list it all. There's a whole bunch around supply chain that's there. Like I said, I can't possibly list it all. But I really enjoy reading it all because the team works really hard to make it accessible and useful. And so that's, I think one of the things that's most important because security is, can be difficult for people to penetrate. And the ability to find some place to start and then evolve from is really important.

Well, Bobby, I think that's a very good point. And I think you guys are covering so many great topic areas and I really appreciate that. And it kind of leads to my next question. You have all these researchers that are helping produce this stuff, and I think they're all pretty lucky because they can come to you and get the mentorship and advice from a real practitioner who's built real stuff. I mean, you have really done things in DoD and around DoD and in the government. You've helped enterprises around the globe. You're a great mentor. Now, what about for those who are listening who are not on your staff? I wanted to ask kind of final thoughts, mentorship advice you might have. Let's say it's for a young person asking you for career advice. What can I do to get into the cybersecurity field and move into leadership positions? Any advice there?

I have two pieces of advice, and these are true, no matter what domain you're looking to get into. But I would say that we all know that in the security field.

There.

Are some extra burdens that you have. Right? You are a first responder. You are pivotal to a whole range of business needs. You're always fighting for what you know the right thing to do is right. Every day is. Every day is. Is a fight in a number of instances. And so the. One of the things I learned early and I try to tell people often, is that it is up to you to shape the world you're in. It's not up to somebody else to shape it for you. And so if you accept what someone else has handed you, it is now your world. And so it means that you've got to spend a lot of time understanding what motivates you and how to, how you want the world to be and navigating yourself to that point. And so that's I think important. I'm a bloom where you're planted kind of person. But recognize that at some point you might not be planted in the best place and you know, you're either pot bound or it's toxic. Figure out what to do in that activities. And so if you can shape the world, that's important. And then the second piece of advice is know what motivates you. I know none of these are technical. Right. It's not the go learn X, A, B or C, you should go learn and always be learning. Absolutely. That sort of table stakes in this domain. But if you know what motivates you, then you will be able to withstand the daily grind that is always having something new to do, something next to do. Because you're always fighting an adversary or you're always engaged in some discussion about what and why.

Right? Bobby, that's great advice. And I just have kind of a follow up question because in this world of cybersecurity and security, there's a lot of technical subjects. But throughout this conversation you talked about leadership and thinking and creativity. You mentioned the word imagination. And I really think that's important too. And with that in mind, if you're advising a young person on a career path or maybe just in general, what do you think the nation needs more of? Computer scientists or musicians? Or is that a binary choice?

That is so not a binary choice. And you picked a wonderful combination. My son going to college for a dual degree in mathematics and music. You need both, right? It's very rarely have I met a deeply technical individual that doesn't also have an outlet that is something artistic. Now that artist, artist, artistry may be something we recognize as a music or sewing or drawing or something, but it may also be something that's, you know, artistic to them in their own way. I think we, we lose if we don't think about these problems as multidisciplinary and interdisciplinary. Because in the security landscape, I think you and I have talked about this a lot. We're not going to engineer our way out of this. We need to engineer our way, but we also need to strategize our way out, and we need to human engage our way out, and we need to. Right. There's a whole range of issues that all are related. And we need people who can think in that multidisciplinary, interdisciplinary way.

Right. Great advice, Bobbi. I really appreciate the time you spent with us today, and it's very, very helpful.

It's always fun. I love the conversations, Bob.

All right, great. Well, let's do this again sometime.

Yes, absolutely. I think it'll be interesting for us to see what the world is like six months from now and see whether any of these insights prove out.

Right. Right. Well, thanks, Bobbi.

All right, Bob, thank you. Thanks for listening to this OODA Loop production. For the latest analysis on cybersecurity, technology and global risks, please visit www.ooda loop. Do.