Hacker v. Hacker: A conversation between Ron Gula and Matt Devost

Hi there. It's Ron Gula from Gula Tech Adventures. Today we are interviewing cyber what ninja extraordinaire, the founder of Ooda Loop, one of the co founders of mission Lake, Matt DeVoe. Matt, how are you?

I'm doing well. Thanks for having me.

Thanks for coming up. Thanks for. I always like to talk a little bit about the. You know, we're in Maryland. You're from Virginia, I'm ex nsa. You might have done something with another federal agency, I don't know which. But thanks for making the trek up to the middle of Maryland.

How was it? My pleasure.

Good to see you today. So for, for folks who don't know your background, how'd you get here? What are you doing today? You know, you've done entrepreneurship, you didn't work for the government. What's, what's a quick synopsis of Matt DeVoe?

Yeah, I think the best synopsis is I was someone who early on discovered that this intersection between technology and national security was going to be important. I was actually still in undergrad and I was a hacker that was doing political science with a focus on national security studies and doing this hacking. You know, I was playing with systems coding things and I came to this realization that we were becoming increasingly dependent on technology. And then the national security guy in me said, well, wait a minute. If we're dependent, and I know that it's vulnerable because I'm a hacker and I'm seeing what other people are doing, then that's something that might be exploited by our adversaries. And that started me down a path of research and writing that attracted a ton of attention, had a lot of people that were paying attention to the work that I was doing, unbeknownst to me at the time. But in 1992, when I wrote my first paper on this topic, is when the TS Directive on Information Warfare came out. Of course, I didn't have a clearance at the time. I didn't know it existed. But in the US Government and in the intelligence community, they started asking, who's this kid up in Vermont who's saying all the same stuff, talking about all these same issues? And that resulted in me having some momentum to write my thesis on the topic. So I wrote a thesis called National Security in the Information Age, which really, unfortunately, over 25 years later, talks about a lot of the things that are still issues today. From there, I got pulled into work at a defense contractor, built and ran the first ever Red Team that was targeting DOD and some intel community systems, classified and unclassified that was great work because I was a small town Vermont guy and now all of a sudden throw a dart on a map of where you want to go and you can find a DoD entity nearby to go visit. So traveled around the world doing that, but was also getting pulled into a lot of these national security initiatives. The Information Warfare Defense Task Force for the Defense Science Board. I got pulled into the President's Commission on Critical Infrastructure Protection. Helped write some of the policy for the Department of Navy with just all these interesting things happening. So I was able to do the technical as well as policy level and continued to bleed the 2 in. It was during the PSIP days when we were coming out with the idea of information sharing and analysis centers, that I talked to an individual who was a journalist and some other technologists, and we said, if the government thinks there's sufficient demand to mandate this in a coming Presidential Decision Directive, there's probably a commercial opportunity. So we decided to create iDefense, which was the first commercial cyber threat intelligence company. And to put it into context, our first customer was the only person that I knew of at the time that actually had the title ciso. So still early days. And then I, over the next 20 years, spent a lot of time building companies. I built a company called the Terrorism Research center that, despite the name, did a lot more than just counterterrorism. I helped John Waters build Eyesight Partners. I was the COO there, and then most recently had built a company called Fusion X that did very advanced red teaming. I call my kind of back to the future company. Went back and recaptured some of the stuff I was doing in the mid-90s and started applying it to new methodologies and approaches for commercial companies. Sold that to Accenture and became the head of Accenture's global cyber defense practice and then left to do consulting and investing. And that's where we are with OODA today.

There's a lot to unpack there. So that's really, really good overview. Let's start with some of the red teaming. So when you were doing the first red teaming for the DOD and I did a bit of this when I was at the nsa, you can't just say, well, one day I was hacking this aircraft carrier and it had a name with N or something like that. But what did you learn doing red teaming and penetration testing for the DoD that you could bring to commercial world? Like, if we have a commercial person listening now, what did you do then that's relevant to them today?

Yeah, there are a couple aspects. One was to bring A realistic threat perspective. That was kind of why I reinvigorated 20 years later some of the red teaming that we're doing, because I felt like we had lost the perspective of the threat, which are human beings that have goals and they have decisions that they make, and being able to emulate that. So that perspective was important. I think the ability to communicate cybersecurity to people in decision making positions or speaking truth to power, that was probably one of the most valuable things I developed in those early hacking days because it was so new and everything was vulnerable. I mean, you know that from your time as well, we were breaking in everything, including aircraft carriers and nuclear submarines. And. And I would be put in a position where it would be me and the head of SOCOM across a table like this. And I'm briefing him on, on why cybersecurity is important and why they should be changing not only their organizational behavior, but actually his personal behavior. In this instance, he had a one character password, so he's trying to talk him out.

Is it a complex character?

Yeah, it was very complex, yeah. Right in the center of the keyboard. So that understanding of being able to contextualize cybersecurity for decision makers translated very well to contextualizing cybersecurity for boards of directors and CEOs and other executives.

So one of the great debates that goes on in our industry is the difference between perhaps a vulnerability scan, a vulnerability audit, and an actual penetration test. So what's the difference between those two? And why does knowing who your threat is matter in that context?

Yeah, so with the vulnerability scanning, you want to capture kind of the totality of your exposure, right? You want to leave no system untouched and understand what those systems are running. If there are any vulnerabilities that exist, come up with a game plan for remediating those vulnerabilities, hopefully prioritizing. You know that very well. Based on the fact that you built the tool.

I'm asking the question.

And even, even back then, when I was doing stuff in DoD, we were using the tools that existed at the time to support that. We were using. When it came out, the ISS scanner, we were using the Ballista tool out of Canada. Right. Like we were using these different tools. So that is very valuable from that perspective of being able to manage your enterprise and the security exposure. The penetration testing or the red teaming is a little bit more nuanced where you're coming at it from the perspective of I am an adversary that wants to achieve a particular objective. And that is the brand of red Teaming that we did at Fusion X, we would say we don't want to emulate the totality of attackers. Let's look at who is most likely to come after you and based on who's most likely to come after you, what are the ttps, the tactics, techniques and procedures that they use? Let's emulate that, including at the time the development of zero day exploits and running covert infrastructure, doing all those things. But then most importantly, if they're targeting you, what would they be trying to accomplish? And understanding what they would try to accomplish determines the decisions that they're going to make, the systems that they exploit, how noisy they are. So being to emulate that and then accomplishing that objective to the extent that it was feasible, obviously you might want to emulate an attacker trying to take out the power grid, but you don't want to take out the power grid. If we're emulating an attacker trying to steal millions of dollars from a bank, the banks would actually let us steal the dollars. They would let us oper operationalize the attack. So it was very meaningful to be able to go in and articulate to the management team. And I've done this both ways where you can say, well we scan the network and we have 100 high level vulnerabilities and 200 medium and 300 low. And they're like great. And there's some metrics there that you can associate with that. But when you go in and articulate from a red teaming, we say Russian sophisticated organized crime is the attacker we emulated. Here's the attack surface that presented itself, here's how we exploited it, here's what we were able to accomplish, and here's the impact to your business. And that actually drives a lot of security dollars with regards to investments in security posture improvement as opposed to just managing the security of the enterprise.

So you did ISIGHT Partners, you did Fusion X and then after those, Mitre created the Mitre ATT and CK framework.

Yes.

How would Mitre ATT and CK have changed your business back then? And what should listeners today be doing with MITRE attck?

Yeah, Mitre ATT and CK is basically providing a framework for exactly what we were doing. So they are automating the process around saying I want to emulate this particular attacker, this particular apt. And they will tell you what the TTP are, they will tell you what they target, how they move, and you can go and create an attack that emulates. You can create a red team that emulates that Mitre ATTCK is Also dual use in that I can also look at my control coverage. So I can look and say this particular attack or will target me in this way and it's not perfect, but it's valuable. And I can look and say, well what controls exist and if I have critical systems along that pathway, do I need to have duplicates of controls? Or maybe there's non critical pathways. We've seen this where you've got five or six duplications of controls and now here's an opportunity for them to optimize a security program. Now they can go in and say, well we can reduce budget or reduce coverage or do something that makes us a little bit more efficient and effective. So mitre ATT and CK is incredibly valuable as a tool to be able to understand the framework by which your technology environment is going to be targeted, backed by historical data of how those attackers have actually targeted those environments.

I gave a keynote once and I dropped a reference of mine. That's a CISO I know who claims he has 100% visibility into MITRE ATT and CK activity from all of his instrumentation across his entire organization. I had a CISO stand up after me and said I don't know who that guy is, but he does not have the budget that I have because I can't do that. So what do you say to mitre ATT and CK and is it, is it. If you, if you can't answer that question with mitre ATT and ck, do you have blind spots in your organization?

You'll have blind spots. And of course adversaries are able to innovate and adjust their, the way that they attack as well. But I think the most valuable thing from a Mitre ATT and CK perspective is that it gives me a starting point. I understand what controls are going to be critical in my environment, what elements of the technology stack I need to apply additional protection to or additional monitoring towards. So we often will advise companies, you know, look at mitre ATT and CK from the perspective of here are the adversaries that are going to target you, here's how they're going to attack you. The controls that help you mitigate the potential for them attacking down those pathways are your first priority controls and then build depth in your coverage afterwards based on other potential adversaries based on adversary innovation. I used to say at Fusion X, our number one job because our company didn't just come in and do the one and done red team, we actually worked on a retainer basis over a long term basis. So Some of our customers at the time that we sold to Accenture, we'd been working with for four or five years. And you're talking about four or five years, one of them with a quarterly red team. One, we were doing 12 a year. So it was a lot of activity. And we would say our job is to out innovate the attacker. You are secure right now based on their current ttp. If we know that they're going to continue to target you, where are there opportunities for them to innovate? And we'll go innovate first and attack you that way, and then you can build those protections in. So we're always trying to help our customers out innovate the attackers that we're targeting them.

So as you've seen this sort of maturation of mitre, ATT and CK and trying to instrument our networks, I've also kind of seen a reliance more on what I'll call intrusion detection than prevention. So late 90s, I was doing network IDS right around the beginning of 2000. Gartner said, IDS is dead and long live intrusion prevention. If you know about something, stop it. And then that's kind of what we were doing with malware. But that didn't work. So now we had the rise of edr, these endpoint systems that collected all this telemetry, so you can go hunt that. But very rarely are we actually stopping these attackers. We have to hunt them manually. So what do you think the current state of the art is in detecting evil Russian wipers in our banking industry that might be lurking now as we record this in April of 2022, which.

Probably are lurking capacity. You know, it's. It's about having a complete view. I mean, the EDR environment obviously adds a ton of value. Being able to engage in the scanning of your environment, having good threat intelligence, having the other telemetry that's available to you off the other, tooling, feeding your threat intelligence into that so that you're operationalizing it and then engaging in the threat hunting. I think that's an important element that often gets overlooked, is that the attackers are not always going to reveal themselves to you easily. You also need to use that almost adversary mindset and say, if I were an attacker, where would I be hiding in this environment? And then go and look in those environments, do a little bit of digging to see if there are anomalies or indicators of attack that exist that aren't a signature or didn't trigger an ed. We spend a lot of time even today with Some of the red teaming that we do on EDR evasion, right? I mean, it is possible. You pull these tools into a lab and you find ways to operate without triggering them, and then they learn based on a discovered attack and then you figure out a new way to do it. So you have to have a holistic, kind of complete view to how you manage security in these enterprises.

So one of the things you do is a good pivot here. Uda. You guys do some investing? We do some investing. We have a couple common investees. A company called Scythe. CEO Bryson Bort started sort of out of the same kind of red teaming, you know, vulnerability assessment, you know, sort of background. But they basically automate a lot of the stuff that we're talking about. So how do you look at Scythe? How would something like Scythe change your game, you know, if you were still running? Well, you kind of do some red teaming still, right?

Yeah, yeah.

So how would Scythe change things for you?

Yeah, no, Scythe is valuable. When I made that investment, a lot of people reached out and they're like, wait, Matt, you're the human red teamer, right? Like the value of human echo expertise. But we need to remember that these problems that we're trying to solve are scaling at a rate in which we can't scale the human expertise to match. So I'm always looking for things that bring a little bit of augmentation to the human beings that are engaging in the red teaming. And what I loved about Scythe was it does the platform automation. I can sit down as a red teamer and the stuff that used to take me quite a bit of time in order to do it, I can now automate that and I can build elements, pull different pieces of malware into my attack infrastructure. I can emulate command and control over stuff in AWS or over Google Docs or whatever the attackers are using, or over Twitter. I really like the value proposition of being able to augment the humans in that very advanced red teaming. But we also need to remember a couple of different elements of the market. One is that when I'm targeting the top 10 banks in the world, having a human based red team, even with a tool like Scythe is going to be valuable. But when we start to go down the chain, do they really need someone with my level of expertise or somebody on the team's level of expertise, or can we enable them through a tool like SCYTHE to do 90% of what we do? And for them, that 90% is 100% is going to be good enough, because they're never going to be targeted with the TTP of that top 10% or the tool will evolve before they get targeted. So there's a tremendous amount of value there. So now we're at with Scythe kind of value proposition number two. The third value proposition that I saw there was for human teams to automate retesting. It used to drive our customers crazy. When we would go in, we would show an attack surface pathway and then they would go and patch it and we would have to do a whole new red team in order to replicate it. With Scythe, you can automate that. The engineers can at the time say, here's the way I made it in. I'm automating that in a Scythe module. And when you're ready to retest, you execute this and it'll tell you whether that pathway is clear or not. So that one was valuable as well. And then the last one is, we've come to the recognition in the industry over the past five or six years that we have the red teamers and we have the blue team responsible for defense, that we weren't talking to each other enough. There is a certain amount of collaboration that needs to take place to get the blue team to understand what the red team is doing, how it's impacting their systems in real time, what's triggering, what's not triggering. And Scythe is a great tool from a purple team perspective is what we talk about when you combine the red and the blue. Let's create an attack scenario that's driven by red teamers. It's in the Scythe tool, but execute it in cooperation with the blue team. And see, did the EDR trigger, did we catch the outbound egress to the command and control? Let's work hand in hand. And where we didn't, let's hit pause and let's go and fix that. And then let's start again and then let's go back and look at the next red team scenario. So incredible amount of value. And that's what I loved about Scythe. And also I'm a big fan of Bryson. So, as you know, part of it is you're investing in the technology, part of it is you are investing in the entrepreneur as well.

So. So I really like how you describe that, especially that last point where you're kind of testing almost like a QA point of view. It's not so much did the red team get caught by the blue team or show off the blue team. It's More like, look, we got nine layers of technology, all going into splunk and a soar and threat filtering. And there's still a perl script from 15 years ago that kicks off when a certain DNS lookup happens. How do you know if it works? And it's just as important as flying an airplane. And first thing you do before you take off an airplane is you test everything, make sure it works and it's a good thing. So that's good.

Absolutely.

So tell us about ooda. Who's your partners that work there? We probably should talk about what OODA means. And then what do you guys do? You invest, you're involved in a lot of things.

Let's go into that. Yeah, yeah. We're an eclectic business. So first off, OODA was started with my partner Bob Gourley, who's a former CTO at dia, a longtime practitioner in the space. Bob and I met, I think in 1996 when National Defense University used to run a contest called the Art of Information Warfare. And I won it in 1996 and he won it in 1997. So we kind of had back to back essays and that was the infamous Toaster paper that I wrote with Neil Pollard and Brian Houghton and then continued to collaborate when.

I have not read the infamous Toaster paper.

You have not read the infrastructure? No, no. What is the infamous Toaster? Yeah. So we wrote a paper in 1996, it was basically information terrorism, can you trust your Toaster? In which we a get a lot of credit for talking about IoT before there was IoT but the recognition that everything would be connected to the Internet. But then also looking at in what scenarios would it make sense for a terrorist to attack critical infrastructure and providing some frameworks for how do we think about protecting that. So it won that award. It ended up getting published in Terrorism and Political Violence Journal out of St. Andrews and became somewhat infamous because it had a great title. So it often get introduced as the Toaster guy. And when we open our new office, there may be a toaster or two involved, you know, on display.

That's phenomenal.

Thanks. So that was our background. We named the company OODA after John Boyd's OODA Loop, which some people be familiar with, but some might not be. Colonel John Boyd, Air Force fighter pilot who had fought in Korea, but also had been engaged in. They didn't call it Top Gun then, but you know, the kind of the, the dog fights against your fellow Air Force pilots. And he kept winning and not only did he win, but he would put himself in a position of disadvantage, and he would reverse it to a position of advantage in 40 seconds. They called him 42nd Boyd. And this attracted the attention of the Pentagon. And they brought him to D.C. and made him sit in a room and said, a, we want you to help us build our next generation of fighter aircraft, because you obviously are able to get behavior, performance out of these aircraft that we're not expecting, but we want to know what makes you tick. And he came up with this concept that is a decision cycle that he referred to as uda that was Observe, Orient, Decide, Act. And that became a basis for thinking about decision cycles, not just in war fighting, but in business and cybersecurity and lots of other areas. When I first came to dc, I got pulled into the Pentagon, a group that was called the Disciples of Boyd. So Boyd had since been gone, but there were people there that had been disciples of his. They used to meet for beers and talk. They ran a conference every year at Quantico called Boyd and Beyond. So I got pulled in there and became enamored with the value of the OODA loop. And when we decided to launch the company, decided that that would be a great homage to what we were trying to do, which is inform intelligent decisions in the enterprise, in government, whatever that may be, for cybersecurity or other geopolitical risk. I mean, we will apply it to business opportunities, business risks, cyber risk. You can apply it to supply chain. So it has a lot of applicability in other domains. And even though there's no copyright associated with it, he was working with the government at the time that he conceived it. I did reach out to the family. I had become friends with his daughter, who actually used to come to these Boyd and Beyond conferences with a box of paper and say, I found these in the attic. Is anybody interested in reading them? And it would uncover additional archives of Boyd's. And they said, absolutely, we love it. We're 100% supportive. So we decided to name the company UDA because it is the ethos for how we think about the world and also an homage to the value that John Boyd provided.

I think that's phenomenal. That's my word of the day, apparently, is phenomenal. But when you think about ooda, I'm imagining the fighter pilot sitting in the jet, looking around, going through that process. How applicable is it for a bureaucratic organization? Or maybe it's very. Because they're not looking around and orientating. Right?

Yeah. So we have to think about decisions when you're A fighter pilot, you're in a very, very quick decision loop. Right. If I'm running a business, my decision loop is not equivalent to that of a fighter pilot, but it is still a decision loop. I am gathering information around the world, I am orienting myself to how I should be making decisions. I'm making the decisions and then I'm executing against it. And there's great value in business to going through that cycle at a more rapid pace than your competitors. So maybe it takes your competitors two years and it takes you six months. So the applicability outside of kind of direct tactical decision making is huge as well. It also makes sure because it's a loop that you're going through this kind of self learning cycle. Right. So you make your actions, you're able to observe kind of what happens based on those actions. You're able to develop new orientations, make new decisions. So it, it implies a lot of agility. And in today's world, which is incredibly dynamic and things are changing, technology is changing, threats are changing, being able to engage in dynamic decision making is incredibly valuable.

Yeah. So you guys have clients who do this workforce.

Yeah.

But you also have what I call a following or groups that participate with you.

Yeah.

What is that?

Yeah. So we run something that we call the OODA Network of Experts that is related to our OODA Loop site. So if we reverse a little bit, we've got OODA llc which is our consulting company. We do consulting work helping companies make decisions. We do cybersecurity work, we do M and A advisory type work, we do buy side advisory, due diligence, kind of those fun things. And then we built this community that is a combination of a couple of things. One, it is an expert content portal from the perspective of let's provide insight and analysis that allows people to make better decisions about the world. So we track disruptive technologies, we track cybersecurity issues, we track other technology advancements as well as geopolitical risk. So we have researchers and analysts that we pay, that build content. And when you are accessing that content, it is not some journalist who doesn't understand the topic and is being overly sensational because they need to drive traffic for advertising dollars. It is not a pay to play portal where there's some vendor that says, oh, I want to talk about AI and cybersecurity. And IBM's AI cybersecurity practice is the best. It's practitioner based access to information that should inform your decision making. With that, we created this expert network that are the decision Makers that are accessing that content, but wanted more than just getting access to the content. They wanted to interact with each other and interact with our experts. So we bring in our analysts, we bring in outside experts that have tremendously varying expertise, some of whom are former CEOs of some of the largest, most successful technology companies in the world, as well as national security analysts, cyber threat experts. And then we bring in these executives, the CEOs, the CISOs, the CTOs, and we have a dialogue around what is important to them and what type of information they're looking to make decisions based on. And that will guide our research agenda. But then they also get a ton of value in being able to interact with each other, interact with our experts. Just by nature of example, I mean, we do a monthly meeting so all the network can get together over Zoom. Right now we do salons that are. We bring an expert in, they provide a presentation. The. The act, I call them Zalons because they're Zoom. Right, right. And they can ask questions. You know, we produce all of this content as well. And then we run what we call Strata games, which was the politically correct term for war gaming, looking at critical issues. So for example, we just did a Strata game on scenarios for the global computer chip supply chain issue where we said, let's project out to 2030. Let's develop four scenarios based on where we see the world going. Let's talk about in those scenarios what it's like to live and operate a business. And then let's look at with the expert network and we had 25 experts with legitimate supply chain expertise as well. Look at those scenarios, the potential impacts. But then let's think about solutions. If there are scenarios that we want to avoid or scenarios, because not all scenarios are bad. So we had some positive ones. So scenarios that we want to achieve, what decisions do we need to be making now? And then what threats aren't we thinking about? And that provides tremendous value for that network as well.

That's excellent. So you guys invest, you have the network, you have the direct engagement with the consulting, which is excellent. And I think you also volunteer a good bit.

Yeah, we try to be very active in the community. So, you know, I'm involved in the Black Hat board, have been since inception to try and make sure that that stays. As a practitioner based event, I'm involved in nonprofits. For example, we interact at Mission Link, which is a D.C. nonprofit, D.C. based, but we're now actually global with regards to the types of companies that we attract. That is to introduce Innovative companies to US Government mission sets they might not be exposed to. Provide them with access to expertise around those mission sets, but then also allow them to collaborate with each other and with the experts that we assemble. So it runs on a cohort basis where the companies come in and we meet over a period of six meetings with guest speakers, with heavy networking folks like yourselves. You know, it's pretty valuable for an entrepreneur who's got a cybersecurity startup of 20 people to be able to sit at a table and talk to Ron Gula and say, you know, tell me about how you grew your business. Tell me about how it might have addressed some of the government mission sets, things of that sort.

A lot of people I think, in our position want to give back and do that. So what's the application process to Mission Link? And you guys kind of changed. It's now Mission Link Next Mission.

Like next. Yeah. So one of the things that we realized, and for me, for Mission Link, I've had the full spectrum. I was not a founder of Mission Link, but I'm currently on the board directors of. Of the nonprofit. I came into MissionLink first as a speaker. So I came in to speak to the audience about being an entrepreneur in the cybersecurity market. I then got invited to be a cohort member. So I came in as a CEO, and I should mention that the cohort members are the executives running these companies. So it's the CEOs that are involved in these companies. Then I came in as a member of the advisory board, similar to the role that you play, and then took a position on the governing board, on the official board of directors. So I've seen the organization from every seat available in the house, and I know the value that it can bring. And the application for it is, you know, it might get posted on the LinkedIn, but we really rely on our network of the advisors and mentors to help surface these companies. I'm seeing hundreds of Year. You're seeing hundreds a year, Other people. Bob is seeing hundreds a year, other advisors into Mission Link, and they nominate companies into the process. And then the companies, once nominated, fill out an application. There's an application review board, and we pick. I think we have 70 companies in this cohort to participate in that cohort. If you didn't make it, maybe you apply again in a later cohort. But, you know, it's fairly labor intensive to make sure that we get the right mix of companies. And we rebranded it as Next for a couple of reasons. It used to be exclusively focused on just getting companies to understand that US Government mission set. So our objective was get smart entrepreneurs in with former and current government executives and talk about the mission. We realized that we were leaving a lot of important parties out. One is we are in an age where there's tremendous value associated with dual use technologies. So you want them to have a technology that can address not only a US government mission set, but also a commercial mission component. So we needed to have the customers from the commercial sector also represented. So who can we bring in that are CISOs, etc. And then a key part of this growth ecosystem and making sure that these companies get an opportunity to start and thrive is the investor ecosystem. So making sure that we now started inviting the investor ecosystem in, particularly ones who have invested in companies that meet this criteria of commercial and government applicability or a focus on disruptive solutions in that space. So we've now brought that group into the community so it improves even more value. Because now if I'm a CEO, I not only get to understand the government mission set, I'm not only meeting government potential government and commercial customers, but I'm also able to interact with people that might fund me through my next phase of growth.

What I think is really interesting about Mission Link and one of the reasons I like to volunteer is this particular area, this geographic, this Mid Atlantic D.C. area, you got civilian and government companies, you've got services and product companies. You've got people who just do dod, just CIA, just nsa. There's all types and they all speak a different language. And there's programs in Maryland that aren't in Virginia and vice versa. So when you have that room, you get so much experience. It's a lot different than when I go to Silicon Valley. Silicon Valley, you get 100 people who've done five startups. They're all on their third startup. And it's an amazing track, but it's almost like a paper cookie cutter. Whereas here it's like every company has got a completely different path.

Yeah, people always say here in D.C. we've got the opportunity to create the next Silicon Valley. I say screw that. I think we have a DNA that is unique, that Silicon Valley could never capture what they do. And there's obviously been tremendous innovation. There's a tremendous culture out there from a startup perspective that can be replicated though. And we have replicated that. I feel very well in the D.C. area. They've also replicated it in Miami and in Austin, in Boston, New York City, Boston, Atlanta. Yeah. So you can do that. But what is wholly unique to this region is the national security DNA of not only the companies, but the former government employees that come out of those mission areas that are highly technical, highly competent, understand what it means to operate in those types of environments that can become the next generation of founders, or understand solution sets that maybe we haven't thought through. So, you know, some of the truly disruptive technologies, I feel like, come out of this region.

So it's sort of a form of volunteerism. But I think you also have done. You got a movie career.

I wouldn't call it a career by any means.

You've interacted with Thor himself.

I have interacted, yes.

What's the story there?

That was one where I was asked to advise on the movie Black Hat. So I got to work with Michael Mann, who I was a huge fan of. That was the key incentive for me and Chris Hemsworth, who I knew. But, you know, it wasn't as big a deal. Michael Mann on providing some technical advising to the movie. I will say that, you know, I've participated in other projects over the years. It was a lot of fun to interact with them. They had a pretty fully developed script by the time that I got to them. And what they were looking for, where I could add value, was there were elements of the plot where they wanted technology to take the plot from point A to point B. So being able to brainstorm and propose some of the ways that that happened.

Hey, Matt, insert hacker tool here.

Yeah, insert hacker tool. But, you know, just. It was. It was that piece of it, or we want these two people to communicate with each other, but with no traffic going over the wires. So how do we do that? Right. So we're proposing the concept of, like, a virtual dead drop that was, you know, a local Bluetooth device that as long as they both walked by each day, they could exchange messages. But it never went over the cellular network. It never went over the Internet. So being able to advance the plot in those ways was kind of fascinating for me. So I spent some time with them, advising. I'd like to say that Chris Hemsworth is modeled on my physique as a hacker.

Oh, absolutely.

But I think maybe Dave Kennedy is more applicable now if you see the weights that he's putting up these days. So it was interesting. It was fun for me to participate in that process, for certain. And I got to get my name in the movie credits, which was kind of cool.

What other kind of movies do you see or even on TV media that you just kind of cringe A little bit. When you see them talking about hacking hackers, what the intelligence.

I think most of them are cringy. You know, I enjoyed. Now, I can't think of the name of it, the one with Rahm Amalek.

Mr.

Robot. Mr. Robot. So I enjoyed Mr. Robot because I felt like they had really good advisors, actual command lines. You had Mark Rogers and like, you know, it was. It was. There were folks like that that were advising it. I think that the issue that we have is that when you're trying to portray hacking for a television audience, especially a broad audience, what we do is not real sexy. Right. It is command line prompts.

It is a bunch of dudes sitting.

In language, a lot of coding. It is, yeah. You know, drinking a lot of caffeine and, you know, spending long hours. And to make it accessible to a broader audience, they need to make it more fun.

Right.

Which is why you see the introduction of crazy graphics and crazy storylines. And so I don't fault Hollywood for that. It just makes it for the general audience, they enjoy it. But for people with our level of experience, you're cringing a bit.

So at the same time, though, that does make it hard to recruit people to this career field.

It does.

What are your thoughts on how can we make it look more sexy? Maybe we shouldn't talk about that. So we can attract more women.

Right.

Make it look more, I don't know, productive and defensive.

Yeah, I think focusing on the outcomes, I think focusing on the ingenuity and kind of the. I'll call it kind of, you know, and you've been in this environment as well, the satisfaction of being able to actually contribute to something that, you know, has. Has kinetic equivalence. We're not getting into shootout, but we're preventing something bad from happening or we're saving a child who's been abducted or somebody who's been kidnapped. Right. I've worked all of those different lines of business, and I've never pointed a gun at anybody in my career. But we've been able to do a lot from a cyber domain perspective. So being able to articulate that, I think a little bit better. So the satisfaction, the value of those positions, the opportunities for the intellectual growth, the curiosity is getting back to that original, what does it mean to be a hacker?

But what do you say to the one person, hey, Matt, what should I do to get into cybersecurity? What do you say to that person without knowing much about them?

Go watch the movie Sneakers. That's a favorite of mine, to kind of get Get a hint, especially from a red teaming perspective on kind of the value proposition there. I tell them to just go explore though. I tell them to sign up for Capture the flags to run.

I'm kind of thinking you're more of the teach yourself.

I am definitely in the teach yourself category. There's a lot of great academic programs out there. I do. I taught at Georgetown for 14 years. I'm teaching at Columbia University right now. There's a lot of value. But I will say the best hackers that I've met had a huge element of self taught.

It's a big difference between a career and a passion.

Yeah.

And a lot of folks who've gone through the steps you've gone through, they had the passion along the way and they made it into an amazing career. But I think a lot of people look at that and go, how do I do that? You know, can I learn that in a course? No, you can't learn that. I've been doing this for 30 years. Right. So it's, it's, it's kind of hard to have that.

You know, one thing I've done that I'm incredibly proud of is that years ago, it was actually 2010, I think, when we first started talking about it, the first DoD strategy came out. And I was a special government employee and I worked on that strategy with Jim Miller in his office. One of the things there was highlighting the fact and some of the work that came out of it that Jason Healy was actually doing was the workforce shortage issue that we still suffer from today. And I was out to coffee with a good friend and we were talking about the workforce shortage issue. And she looked at me and she's like, well, why don't you do something about it? Like you're on the board at Black Hat. I particularly mentioned that maybe we could get some of the veteran workforce into cybersecurity. So I started this grassroots cybersecurity scholarship program to bring veterans who had recently separated that were interested in cybersecurity out to Black Hat for free to attend training, attend the session, heavy networking with the hopes of starting their career in cybersecurity. And it was successful. That first year we only brought two people out, was kind of self funded. Then it started to expand and then Black Hat said, this is great. We're going to give you free passes like we want as part of your board duty. Let's manage a scholarship program. So last year I think we had 20 people out that were veterans transitioning out, but one that always sticks out for Me that exemplifies what we've been talking about is the first year I had quite a few applicants and picking who the two were going to be was really difficult. And I had one who was an Air Force weatherman and people question like, why would you bring an Air Force weatherman who's interested in the cybersecurity career? Like, what skill set does he have? And if you read deeper into his application and his history, part of being an Air Force weatherman was maintaining the systems that provided all of the sensor data and the analytics, which was Linux sysadmin. He had learned how to install tools, how to test his own systems. He was already a cybersecurity guy, but he had the title, the career track of being a weatherman in the Air Force. So I was incredibly proud to be able to recognize, to say like that curiosity that do it on your own, that manage your own systems, be a defender, attack your own stuff, that there was tremendous value in finding those gems that were in non traditional workforces and bringing them into the cybersecurity community and then using that as a catalyst for their career. I'm incredibly happy that I haven't kept track of the 20 from this year, but all of the ones that have been through the program in the past are gainfully employed in the cybersecurity field. So obviously we need to also think outside the box in how we recruit talent and how we get people energized that there is a potential opportunity for them in this field.

Yeah, I think that's just awesome. I think veterans, people don't think about them as a. It's not like they're usually listed the same breath they're listed minorities, women, African Americans, that sort of thing. But it's three distinct sets that we can do better as an industry to get more people involved. And like you said with the weatherman example, there's a lot of things people do in the military that. But they probably are doing more cyber stuff than they realize and it's good to do that.

Absolutely.

All right, so let's close out with some. April 2022, Putin seems to be pulling back from Kiev. We haven't seen a lot of cyber attacks. We've been talking about that. How do you feel right now how the nation is if we had to go into some sort of cyber conflict? I'm talking about the Russians destroying banks, maybe shutting down airports so that we can't get supplies over there. Not chemical, not nuclear, not physical attacks, only shutting down things to prevent us from supplying that could we stop that today?

We would have a hard time, I think, is my gut inclination. And I'm not intimate with the security of the airports that are supply routes in. But it is something that I looked at and have looked at over the years is this kind of supply chain and the systems that support the supply chain. And you have the cascading failure right where you can go after the kind of the underlying systems where there are critical dependencies. And the Russians are a skilled adversary, but we're also very skilled, and you're starting to hear more in the news. In fact, I think there's a story today that we saw on the Cyber Loop in the New York Times where the US Government was proactively going in and removing malware from systems that the Russians were trying to target.

If I may, The US Government, in cooperation with the vendor community, was doing that. So it's so complex to try to understand how cyber works. The vendors have a component, private industry has a component. I call it the Justice League of the Federal Government because everybody from the federal government is like a different superpower of what they can do in this fight. But it's amazingly complex.

So we've improved tremendously and continue to improve our ability to collaborate, not only within the government, but within the government and the private sector. So that is encouraging. And also recognizing the preemptive aspect of this. One thing that used to drive me crazy, I'm sure drove you crazy, is that we would be accused of being Cassandras because we could envision a future where some of this conflict took place, where some of these attacks would take place. We can envision, as you just outlined, a scenario in which the Russians could, without any impact on human safety, engage in an attack that impacts the outcome of conflict in the region. We now have folks in the Justice League that are working together, but are taking that perspective as well and recognizing that, oh, if they were to target us, classic red teaming, what would they do? What is the escalation path? Let's go and see. Are they targeting those resources? Let's do some threat hunting. Oh, look, working with private sector, we've found that there are some systems that are compromised. Let's go in and surgically repair those systems before they get an opportunity to actually execute the malware. So while we still live with a tremendous amount of vulnerability right now, there's a lot of encouraging things that are happening by way of our collective cyber defense capability. I agree.

I'm encouraged as well. But I'm going to put you on the spot and say of all the different cyber government components we have, which one's the Superman of this Justice League?

I'm not going to answer that question.

That's a good thing.

There's no way in Washington, D.C. you maintain friends. If you respond to that, we've been.

In the bubble too long then.

Right?

So that's good. I like to ask the guests on the show to just talk to maybe people who want to enter into the cyber security field. Give them one or two resources, plug a blog, plug whatever you want. But just how can people learn more? And of course, where can they find you at?

Yeah, absolutely. So you can find me@ooda.com that's real easy. Or ooda loop.com the writing that I do on these topics today is focused on ooda loop.com so that's a great resource, and I would encourage that as a resource that people should check out. We produce a free daily newsletter that talks about what's happening in those areas of disruptive technology, cybersecurity, and geopolitical risk. So it's an opportunity for people to educate themselves. So I would encourage that, and then I would encourage them to go and explore other resources that are available. If you are a high schooler, go play in the Cyber Patriot Games. If you are in college, go engage in the cyber Games, which just got a $2 million infusion from Jen Easterly at CISA to build our capability here. And oh, by the way, is doing a great job of taking a kind of an esports focus. I mean, esports is so popular in the U.S. we're sitting in esports chairs right now, right? And it's so popular, there's so many live streamers that they're actually saying to these, to these esporters, hey, here's another sport that is accessible. You know, that requires a lot of talent. It is in capture the flag. So come and play capture the flag from an esport perspective. And I thought Jennifer Gulick was. Was brilliant in having her MC for the US Cyber Games Challenge this year in Vegas. She hosted it in the Luxor Cyber Gaming facility. And she brought in a guy who is a very popular esports streamer to emcee it. So. Right. Appealing to that crowd and saying, like, hey, if you love esports, we've got a field for you, right? That has some of those same qualities. So explore that. And I always say, you know, I'm a big fan of tinkering technology now compared to when we grow up is so cheap, it's so accessible. You can build, you know, a lab equivalent to what I targeted in my first DoD assessment in your basement for $1,000. So download Linux, download the ATTCK tools, download the defense tools, configure them on your Linux box, you know, in virtual machines. Attack yourself, kind of go through that process where you can be self guided and there's no consequences, right? You're just attacking your own system. Back when the hackers of our generation were coming through, the only way to learn was to access somebody else's system, which created a hairy, hairy decade allegedly. So I do encourage that. Take advantage of the resources that are out there, get involved in some of the competition, but more importantly be motivated to self learn.

That's awesome. Matt Devoe, thank you very much for coming on.

My pleasure, thanks for having me.

Thanks for everybody watching and you can see more recordings and everything else at Gula Tech. Thank you very much.