Phil Reitinger, CEO Global Cyber Alliance, On Reducing Cyber Risk Through Leadership

Informing your decisions with intelligence analysis and insight. Brought to you by the team@ooda loop.com.

Today on the Oodacast we welcome my friend and long term associate Phil Rettinger from the Global Cyber Alliance. Phil, how you doing?

I'm doing well, Bob. It's good to see you.

Yeah, good seeing you and it's great seeing that you guys are continuing and just accelerating your great work even during this crisis time. And I want to say thanks for that.

Well, thank you, Bob. It's the challenges are just growing even faster because of the pandemic. You know, the things that we were seeing before, the growth we were seeing are in cybercrime. It's just really been put into a whole new light. So it's been an accelerant for what we expected to happen anyway. Right.

Okay. Well, Phil, I know a lot of people in the community, know you, but I want to give my context on what I think of your background and who you are. And then of course, if I get any of that wrong, I'm going to give you a chance to correct the record. But you've been in cybersecurity for quite a while. In the late 90s, you were in the Department of Justice, you were in the U.S. attorney's office. And that's when the Department of Justice was really starting to learn about this cyber stuff and to realize things were changing. There had already been a law passed in 1984, the Communications Privacy act or whatever. I know that you guys and prosecutors and attorneys were already very familiar with cyber, but it was like an entrepreneurial time when you were there. And then if I understand right, at the Department of Justice, you were the executive director of their Cyber Crimes Division. And then you move to the Department of Defense where you headed up the DC3. The defense, what is it? Cyber.

DOD Cybercrime Center.

Yeah, DOD Cybercrime center, which back then as today is still regarded as like the most professional forensics crime detection center in cybercrime. You just really world class, best smart, smart folks. From there you went to Microsoft where you were an executive for several years and then were pulled back into government service at the Department of Homeland Security where you, that was there too, I guess you'd call them halcyon days at Department of Homeland Security as people were wondering what missions should DHS have in cyber? And there was a lot of internal, I remember these days, parochial bureaucratic fights as different agencies were saying, no, that's mine. You know, you can't do that. I'm doing this or I won't trust you. And, you know, but, you know, tough days. And I want to talk a little bit more about that. But after dhs, you then went and took over responsibilities for cybersecurity for Sony, the corporation, for three years. And since then you have been, in a very entrepreneurial way, creating a nonprofit alliance, the Global Cyber alliance, where you're working globally with law enforcement, governments, big industry volunteer networks and others to make a difference in cybersecurity. Now, that's my kind of short off the cuff bio, is that. Did I hit the high points?

You hit it pretty well, Bob. A couple of additions, I'd say. I was actually the Executive Director, the first Executive director of the DoD Cybercrime Center. My title at justice when I left was Deputy Chief. So I was always. I didn't. I never had the computer crime and intellectual property section. I had the distinct honor of working for two of the smartest and best prosecutors ever in this space. Scott Charney, who stood up the unit, or the, I should say the section originally and then later moved to PricewaterhouseCoopers and has now been at Microsoft for many, many years. And Marty Stancil, gam, who was the chief after Scott. I was the number six prosecutor. So I was the number six centralized prosecutor dealing exclusively with computer crime and intellectual property at the Justice Department. And those were the halcyon days, because we were making it up as we went along. Dhs just a little different. I don't know if I'd call that the halcyon days. It was critically important mission, but that was tough work. That was very tough work, as you said, trying to build out a capability in a space where the. The jurisdictional roles and responsibilities had not been fully defined. And there was still a lot of growth and necessary growth happening in the overall Department of Homeland Security.

Yeah. You know, I want to mention something I remember based on my observation of you in those days, I think it was a great leadership approach that you had. I'd like you to comment on that. It's as if when you're given an impossible mission, some things you're in charge of and in control of. You have some budget, some people work for you in the agency. But your charter requires collaboration across the entire government. And even when in theory you have some influence there, it's very natural for government agencies to kind of give you the Heisman or if you don't say, I don't work for you, I work for this guy. So that's tough. And then you're also expected to improve the security posture of the entire nation. And you're definitely not in command of the nation. And what I saw of you from afar was you took what you had. You built a place where you could bring representatives together and share a common visualization of the threat and a common visualization of infrastructure as common as possible. So you could get everybody in one room, the N kick. And even though you weren't in command of everybody in that room, by giving them a common visualization, you could move them in the right direction. And I always saw that as a great master move in leadership, was creating that place where everybody comes together. Comments on that?

I guess so, Bob. I'd say I don't want to take the credit for that. My management and leadership philosophy has always been hire the best people possible, people smarter than you, and have them tell you what to do. So I was blessed at DHS with an amazing group of people to work with, including Rand Beers, the counterterrorism advisor and the undersecretary for what was in the National Protection and Programs Directorate. Mike Brown, Navy Admiral, came out of nsa, ran a lot of the key initiatives. Greg Schaefer, the assistant secretary for cybersecurity and communications, now runs governance, risk and compliance for Walmart. Bobby Stimfli, who came out of disa. I know you know Bobby very well. Yeah, she's gone on and she, she leads the efforts at the Software Engineering Institute for CERTCC at Carnegie Mellon. I mean, it was just an amazing group of people. Jenny Mena, who is an executive at US bank now. So all these people have gone on and done great things. I will say on you that I like to quote Jim Lewis on sort of authority in government. Jim Lewis at CSIS says there are three sources of, of power, if you will, in government. One is resources, the second is authorities, and the third is access to the President. And when I got to dhs, we were kind of deficient in all three. We had resources, but we needed a lot more on authorities. I used to tell people that DHS had great coordination authorities, so if there was a crisis, we could coordinate the heck out of it. But that was really all we could do. The rest of it was all soft power and convincing. And in terms of access to the president, you know, back then, certainly maybe less so now. But back then the access to the president of the Secretary of Homeland Security was not what, for example, the Secretary of Defense was. So, you know, you're fighting a battle not with both hands tied behind your back, but you're, you're the new kid on the block. You don't have the authorities of DoD or the Justice Department, and you're still lacking in resources. So it was a lot about building a coalition of the willing, about exercising soft power and building a team, building people like Bobby and Greg and Mike and Jenny, whose goal was to make the world a better place, cared a lot less about credit and a lot more about getting things done. And, you know, we were blessed. Besides Rand Beers, who's one of the greatest government leaders I've ever had a chance to work with with, you know, Janet Napolitano, a good, great Secretary of Homeland Security, and Jane Hollude is the deputy secretary for DHS, or S1 and S2, as they are called in DHS. It was a great group of people.

That's cool. Thanks, Phil. And as a way to transition into what you're doing now, I mean, would you briefly. I mean, you were also a CISO at one of the world's largest corporations. Would you say it's a similar kind of power structure there for a senior security professional? It's authority, budget, and access to the leadership.

It's not. The differences between the public sector and the private sector are far less than you would think it is. In some cases, it's easier to be more agile in the private sector and pull levers quickly, but in some ways, it's more difficult, so you just have to work in the environment you've got. In all cases, I found that the ability to convince people and influence people is a lot more powerful than the ability to direct people.

Cool. Fascinating. And now that brings us to the Global Cyber alliance, which I've watched as you pulled that together. And that's another one where, man, it seems like an impossible task, but if anybody could do it, you could do it. And next thing you know, you're really making a difference in the world. And my hat's off to you for that. But I wanted to ask a couple simple questions. One, what is the Global Cyber Alliance?

So we're a bit of a unique animal in cybersecurity. There are a lot of nonprofits in this space, and a good chunk of them are sort of of the think tank variety. You know, people who study problems and write reports and recommendations. And I'm not denigrating those guys at all. They do great work, but that's a. That's a. That's a pretty full space. There's great people doing great work. There are entities that do information sharing and analysis and operational coordination. You know, both the ISACs and the ISAOs. Great. Partners we've got like the Cyber Threat alliance or the Cyber Defense alliance in the uk. They, they do great work there. There are, there are other groups, people, you know, nonprofits that work in particular spaces. Like they're focused exclusively on small business cybersecurity. What we, the group of us that put this together. And I, you know, I joined GCA actually two months after it was founded. The founders were the Manhattan District Attorney, Cy Vance, the City of London Police, and the center for Internet Security. And the guy whose brainchild this was was Will Pellgren, another person, you know, who originally stood up the Ms. ISAC and then ran CIS for years. So again, I don't want to take credit. I did come in as the first CEO and I was again blessed with the opportunity to have some resources and say what really needs to be done. What really needed to be done was some entity that wasn't focused on a particular target set or a particular sector, but looked globally and said, where do we have solutions? What can we operationalize that's not being operationalized? Where are there places where we could make a real effect? But both government and industry are not really able to address the problem. There are market failures or other issues. And it really takes a community approach. And so that's what we are. We're a little like Doctors Without Borders for cyber. So we don't do reports and recommendations. What we try to do is find places where we can actively bring a partnership of entities together. We've got about 270 partners around the world to implement a concrete solution and make a real difference with a measurable result. So, I mean, a good example is trying to drive global deployment of dmarc, a protocol that stops the most virulent type of phishing. But when we started, this was, you know, a very limited deployment. So we said, this is a solution, it's out there, but not enough people are taking it up. How can we make a difference either by building technology or by driving targeted awareness or working with government agencies to implement policy. Any of those things.

Right.

Cool.

And that's a perfect example. I wanted to talk about DMARC and also the work you've done with DNS, your toolkit. And DMARC to me is something where if you are running a small business, you need to know about it to get it configured and you need some expert help. You need it like a tutorial and then you get it configured and it's pretty much on autopilot. If you do it right, it's going to work. But you need that expert to walk you through it. And I see that as a benefit of what you've put online. You can start from scratch with no real knowledge of dmarc, follow the steps you've provided there, and next thing you know, your email is being, you know, it's much more anti spoofable and the email that's coming to you, there's less chance of that being a spoof or a spam email.

Right. So that's, I think, exactly right, Bob. DMARC is not only the best, it's really the almost the only way to effectively prevent d direct domain spoofing. And what it does is it allows an entity that owns the domain to say who can send email from that domain using another protocol called spf, how it's going to be signed, and then with dmarc, what to do with email, that fails it. So, for example, if you're Microsoft and you've deployed DMARC and Microsoft has, then they can issue a policy that says if you get an email that says it's from us, but it's really not, I want you to let it through. But tell me about it. Mark it as spam or send it to the BitBucket, trash it. Never let it go through. So what it does is it for a bank, for example, it prevents email that appears to be from the bank but isn't. And it's really the only effective way to do that. There are lots of threats, it stops and it not only protects you, it protects your reputation, it protects your customers. So for example, I've often said if I really wanted to get into a secure entity, you know what I do? I'd find out who their lawyers were and I'd see if their lawyers had deployed dmarc. And if their lawyers hadn't deployed dmarc, I'd take a real legal document from some case they were involved in, I'd weaponize it probably as a PDF and I'd spoof an email with that as an attachment and I'd send it to the executive assistant of the general counsel or somebody in the general counsel's office. I bet you I get a higher success rate in doing that than almost any other attack vector. And it'll work. It'll work the vast majority of the time unless that law firm has deployed dmarc. So it's super important we built a wizard. We're the Global Cyber Alliance. It's available in 18 different languages, including Latvian and Azerbaijani. To help people deploy dmarc, we've got a Lot of training, and we built it in. You mentioned the toolkits. We built those tools into the toolkits to make it even easier for small businesses to deploy dmarc.

That's great. And then along those lines, I also want to talk about DNS, the domain name service. You and I have talked DNS for decades, and people in the cybersecurity world know DNS very well. But if you're just an Internet user, you don't have to know that. You just turn on your computer or your phone and. And the stuff just magically works. So the average user and probably 99% of businesses out there don't mess with their DNS. It just works. Their ISP gets that information to and from where it's supposed to go. But with a little bit of knowledge on what DNS is, you can configure that in ways that dramatically reduce your risk on the Internet. But you just need kind of like dmarc. You need somebody to help explain what it is you need to change and what the good is. That's one thing about DNS, and I know you guys are doing that well. And then Another thing about DNS, if you use a smart service like Quad9, you can have something like a firewall in the Internet that makes it harder for malicious code to communicate from your organization out. Did I capture the essence of what you're doing in DNS there?

Right, so that's exactly right. The. You know, the thing about DNS, Bob, as you point out, is it's. It's fundamental to almost everything that happens on the Internet. So I like to tell people it's the phone book of the Internet. So, you know, if I. DNS, for those of your listeners who may not know this, it's like for ooda.com, right, if I. If I type odoo.com into my browser, what does a computer know from that? DNS is the service that says, where is odoo.com really? It returns the numeric address that says where that server really is. And it's fundamental to everything that happens in your browser. And oddly enough, even stuff that's not in your browser, like if you've got malware on your system, it's probably using DNS to find out which. Where to go to get command and control about what to do. So here's the cool thing, as you suggested about DNS, it's a background service. It's always there. Once you set it up or change it, you don't have to worry about it at all. And the super cool part is there's this thing called protective DNS or a DNS firewall. You talked about a firewall. Same thing. If you take this DNS service, the domain name system, the domain name service, and you put threat data into it, then the service can transparently stop you from going to places that are known to be bad, right? So if you click for example on a link in a phishing email and it's going to take you to a site that the DNS service knows is bad, it can just tell you that site doesn't exist. So you don't go there. You get like a, a 404 error or site does not exist message or whatever it is depending on the app you're using. So you don't have to worry about that at all. You just don't go to that place. You can get enterprise class security protection through blacklisting of all of these sites with literally taking a minute to two minutes of work. And that's why we at the Global Cyber alliance, along with our partners, the Packet clearinghouse and then IBM built Quad 9. So Quad 9 is one of those protective DNS services. It's free, it's available around the world, it's fast, it's high performing everywhere. And the biggest thing that we did, let's see, the two biggest things that we did that are different about it is it doesn't rely just on one threat provider. It's a community approach. So it uses threat data from almost 20 different threat providers up to that many. And it's designed to be GDPR compliant and privacy protective from the start. So it doesn't keep track of what you as an individual do, it just keeps track of what happens in your city. And so you don't need to worry about somebody afterwards going back and figuring out what you did or knowing that you may have a problem on your system. It just stops that. And so it's super effective, it's broadly available and it's free of charge. There are also other good services that are out there. You know, open DNS from Cisco provides some of these services and Cloudflare is now offering a service that also offers protective DNS capability. So we've started a Work from home campaign and the three things we're urging everybody to do right away is patch your systems, use multi factor authentication and use a protective DNS service. There's videos available on our website or on the Quad9 website. It's quad9.net quad the number9.net and it will literally, I'M quite serious. You can do it on your computer in two minutes or you can change it on your router at home and it'll take a little bit longer, but it'll protect everybody in your house.

Yes. We'll include links with that too on our site as we push this video out on our podcast too. I agree with you. This is something that is so easy and quick to do, and after you do it, it adds in so much protection, reduces your risk in a lot of ways. I want to mention another thing that you've been doing to help reduce risk. You already talked a little bit about the toolkit. You pulled together the toolkit. Is this designed for small businesses?

Yes. So as we looked at the environment, you know, there's a lot of focus on critical infrastructure, there's a lot of focus on the cloud, but there are a lot of small businesses that run, you know, their own little IT systems, have their own computers and they don't know what to do. In fact, they don't have the capability or the resources to even figure out what to do. There's really good guidance out there for them. But what good does guidance do? You know, a small restaurant franchise who's going to read a 10 page guidance document about what to do? So what we did was we said, this is a problem. So we built a cybersecurity toolkit for small business. And it's designed, we try to focus on operationalizing things, making things real. So we took the guidance and we brought together some of our own and some other people's free tools. So you've got essentially a set of step by step instructions to go through and take a series of steps, like using a protective DNS service, turning on Multi Factor authentication on your service, on services, on your systems, so that you can achieve a much higher, greater security without spending a dime. It'll take a little human effort, but all of these things are free. And we launched that a little over a year ago, in February of last year. Since then, we've been gathering a lot of feedback. We're in the process now of doing a revision to make the toolkit even easier to use with more embedded video training and make it easier to flow. And perhaps most important, we've continued to internationalize that toolkit. So if any of your listeners are outside the United States, the toolkit is now available natively in English, French, Spanish and German. And there will be more languages to come. So if you speak natively, one of those languages you can go through, the videos are all in that language. The instructions are all in that language. And it's. It's a great way to take some key steps to make yourself more secure. Cool.

Hey, Phil, I want to ask you some thoughts about the future, too, at least a little bit. And first, I want to try a thesis out on you because I think this is an indicator of where the future is going. Right now we're in this major global crisis, and one of the great things about this is it seems like humanity is all in this together. We're fighting a common enemy. There's so much collaboration and coordination and entities around the globe trying to fight this virus. So incredible coordination and collaboration and people working together across multiple countries. On the other hand, there's also bad guys out there, and they're collaborating against us. They're still attacking, and it's really despicable. They're committing, of course, the same levels of fraud, but on top of that, I've seen a business email compromise against medical facilities. I've seen denial of service attacks, distributed denial of service attacks against research facilities. So an entity trying to work on a vaccine, and they're getting clobbered by a DDoS attack. We've seen heightened fraud against organizations that are impacting the ability to get personal protective equipment to the medical community. This is despicable stuff. And to me, it's an indicator that, you know, even on something so bad as this global pandemic, the bad guys are going to attack and they're going to keep coming and keep coming. So to me, what that says about the future is, expect the bad guys will be in our future, whatever the future is. And I would like your view on that thesis and any indicators of what you think is in our future and what we should do to mitigate the worst of it.

Sure. So our mutual friend Mike Tangy likes to say, hackers gonna hack. Right? And that's kind of what it is. Right. So I think the word despicable describes it pretty accurately. I've started advocating publicly for prosecutors around the world to say that if somebody dies as a result of a hack on a medical facility, that they'll pursue something like felony murder charges against hackers. It's just, you know, I don't really believe in the death penalty, but I might change my mind on this one. It is pretty bad out there right now. The FBI reported, I think, yesterday that the Internet Crime Complaint center has seen a three to four times increase in Internet fraud complaints in the last month or so. So the bad guys are definitely attacking. You know, they've had Lots of time to prepare for this. Natural disasters, et cetera. They've always resulted in upticks of fraud associated and attacks associated with, with that natural disaster. And so that infrastructure and that ability has been built. What's different now is that we're in a much more vulnerable environment. Cause everybody's working from home and they don't have the face to face contact. And that means that they're remote, they're outside the corporate perimeter. So they've got a greater attack surface area, weakened protections to some extent, and a really, really aggressive attacker community. And that's scary. That is a real problem. But to look on the bright side, right, you're absolutely right. There are people pulling together and this puts a strain on folks. So I mentioned before the work from home advice we've given. Do immediately patch your systems, use multifactor authentication and use a protective DNS service for that site. It's workfromhome.globalcyberalliance.org we came up with that advice, we started talking to other nonprofits and they said, yeah, we agree with that. So we've already built a coalition of 23, including US global nonprofits that are giving that same advice. They're doubling down on, here's what you want to do. Reducing noise, trying to provide advice to make things much more simple and much more effective. The other thing I hope we'll see is, I think, I hope we will see renewed government funding and focus on things and corporate funding and focus on things other than just critical infrastructure. Right. So this, we have a real opportunity here to bring not just national but global attention to a problem and really work to solve it. There are the big problem we've had historically about with cybercrime is the solutions we've had don't work at scale or with the complexity of the Internet. There are things that will work. We just have to change how we do things. And I'm happy to talk more about that, but I'm hoping that, you know, we start to see cisa, the NCSC in the uk, the CCCS in Canada and all these other entities say, you know, we got to really worry about small business, we got to worry about everybody. How do we tackle problems at scale?

Right. Thanks. And you know, I have another thesis here and that is now I'm an optimist. And you know, the problem with optimists is sometimes we just get things flat wrong. But, and this could be one of those cases, I feel like the economy has been put on pause and it's like holding a big balloon underwater, and soon we're going to be freed up again and that balloon is going to be let go and it's going to take off like a rocket. And I thought about that. I thought, yeah, I'm being kind of naive. It isn't. Maybe it's not going to go that fast. But if we can't mitigate some of these cyber threats, especially in the small business world, the economy is going to have a much harder time. So it just underscores the point that to really get this recovery going again, we need to invest the right amount in cyber. And my friend Matt DeVos mentioned as we were talking about this, maybe we need a Cyber stimulus package. $4 trillion being spent to restart the economy. How about 25 billion to do cyber in a much better way at the same time?

Look, Bob, as a nonprofit entity that's always looking for funding to get things done, I'd absolutely love that. Another good marker. I tend to be a little bit. I'm both a pessimist and an optimist. I know it's weird, but I managed to work that. I think things are going to continue to get worse, but I always see potential to get things done. Just a couple of days ago, Microsoft announced that it was taking its High Order threat package that's available for Office365 and making it available free to medical institutions, public health institutions, and to humanitarian organizations. That's the kind of thing when a company of that size and that scale says, you know, we could try to make more money, but we're going to give this away free. That. Yeah, that's how you solve problems at scale. Yeah.

Yeah. Cool. Thanks, Phil. And Phil, I really appreciate the time today and the update on all of these issues. And I want to ask, any final thoughts?

I should have prepared something a little bit more about final thoughts. I think, you know, I'd say this. Things are going to, regardless of what happens, continue to get worse. And part of that is the scale and complexity problem I talked about before. We've always had a problem with not being able to solve cybersecurity problems at scale. And IoT has increased that challenge by an order of magnitude. Now, to go along with IoT, we've also got everybody remote, right, which makes, as I said before, makes us less secure and makes entire types of cybercrime, like you mentioned, business email compromise. How much easier it is to do business email compromise when you can't walk down the hall and see if the CEO really said, cut a check to this vendor. So we've got a brave new world in terms of scale, of threat and difficulty. But there is an approach that will work. We just have to think differently about cybersecurity. We've got to stop worrying about verticals and enterprises alone and think about getting building a global Internet that will defend itself. We've got to treat the Internet like the human body. So it's my prediction. I haven't seen anybody else predict this. I predict within 10 or 20 years, we're going to have as many computers on the Internet as we do cells in the human body. You know, roughly on the neighborhood of 35 trillion. Right now, people are saying 1 or 2 trillion. I bet we get to 35 trillion. And so the Internet is going to look as complicated as the human body, but each of those cells is going to be a computer. Right. Which itself is super complicated. Right. The only way we can defend that kind of environment, if we build the intelligence into the network to turn its size to the good. If we build, we reduce vulnerability at scale. So we make the Internet basically healthy, and we build an Internet immune system that automatically detects problems using these trillions of eyes that can detect bad behavior and respond and mitigate threats. It sounds like pie in the sky, but it absolutely isn't. It can be done. We just need the focus as a nation and a global economy to say we are going to make this happen and use all the levers of government power to make it happen. Awesome.

Thanks, Bill. I really appreciate that and I appreciate all your time today.

Thanks. Glad to talk with you, Bob. Thanks for listening to this. OODA Loop production For the latest analysis on cybersecurity technology and global risks, please visit www.ooda loop.com.