Industry sign banking nebraska claim secure
welcome to the day's webinar hackers in the human factor securing government and education I'm your moderator James Baker the public sector technology exchange I want to thank everyone from all over America for joining us to what I believe is going to be a very riveting discussion for those of you who aren't familiar with the public sector technology exchange we are an independent forum that discusses the technology challenges impacting government industry and education you can learn more about us on the web or in your favorite social media venue before we get started with today's forum I want to go over a few housekeeping items this webinar will be recorded and we'll send a link out to all registrants your questions are very important to us over the last month we have received a multitude of questions coming in from all over America we're going to try to get to as many as we can when the webinar concludes we're going to kindly ask you to take a few minutes and fill out our survey I'd like to give thanks to our sponsors without them today's forum would not be possible I'd like to thank Proofpoint I encourage everyone listening in to download a copy of human factor report the lengths on your screen I'd also encourage you to get in touch with proof points team about your security needs I'd also like to thank palo alto networks for being a sponsor today if you would like to get ahold of power out those team members their information is on your screen as well it is now my pleasure to welcome our esteemed panel we have some really great leaders joining us from all over America and I'm going to ask them to introduce themselves we're going to go ahead and start with Tong Tong if you could introduce yourself that would be be great in there again we've got your slides going on great James and thank you for having me today good afternoon everyone or good morning depending on my name is Holmes Olsen on the Assistant Under Secretary of Homeland Security for the common of massachusetts and i also focus on anti-terrorism cybersecurity measures here in the Commonwealth as well I've been with the Commonwealth for just over two years now and prior to that I was a the interim CEO of a small start-up company in the energy sector and before that was working for the department defense in the intelligence community thank you thank you Mohammed Malky is working to get on getting is having some technical difficulty so hopefully he'll join us here in a few minutes I'd like to go now over we're going to head over to the great state of Utah dr. Eric Carly probably introduce yourself hello everybody I'm glad to be here in in this brave world of the public sector technology with all of you we all probably suffer suffer a little bit from public sector technology disorder just one letter off from the name of this Orem so it's good good to have a community MSCI the CIO here at the Utah State University we've got about 30,000 students in higher education I like to say we've been bringing your own device and since 1886 the year we were here we were founded so it's a distribution technology decentralization and in securing is a is a battle that we all work on together in the public sector and so I'm glad to be glad to be among you and to listen to listen to peers and to participate in this forum and community thank you Eric candidate kindly introduce yourself thanks James and hello to all I am the chief information security officer at Princeton University or I have security responsibilities for architecture engineering risk analysis disaster recovery and training and awareness and summary my job is really to protect Princeton from the world but some days it actually feels like I'm protecting the world from Princeton happy visas all of you today we are glad to have you we're going to leave New Jersey and we're going to head over to Oregon can we introduce yourself hi my name's Joe Boyer I'm the chief information security officer territory Alton Science University I've been in this capacity for the last 30 days prior to that I was the chief information security officer for the city of San Francisco and I'm excited about this forum as well there's a lot of great exchange of ideas and I think as we get into it you'll hear a little bit about my philosophy and why I'm excited about this forum thank you very much Joe next we're going to head back to California with Jennifer Jennifer coming introduce yourself hi folks and thank you for having me part of this esteemed panel my name is Jennifer Chang I'm the director of cyber security solutions at Proofpoint I've been with Proofpoint for the past two years most be working with a lot of our advanced threat protection products including as well as working with our threat intelligence team and operationalizing a lot of information that we see in our products and working with and hearing from many of our customers is more of a consultative capacity and seeing you know what are the threats that are affecting them and how can they discuss them so excited for the panel all right well Jennifer we aren't you glad to have you now we're going to head over to Matt Morton Matt kindly introduce yourself hi welcome everybody welcome from the home of the college world series where we recently crown you for support as champions hi I'm the chief information security officer and assistant CIO for the University of Nebraska Omaha I've been working in security for many years and also on the sidelines security for many years as well I participated a lot of board activities in the area and trying to promote a better secure security around the Midwest and I'm glad to be here today it's going to be an interesting discussion thank you Matt I'm going to now head to Los Angeles Jorge kindly introduce yourself and good morning and good afternoon to everyone so my name is Jorge Matta and you read through my bio you'll realize that I'm also product community colleges so I'm the chief information officer for the Los Angeles Community College District I'd like to say that we're the best Community College District and we serve the top 100 percent in the nation we are composed of nine different colleges over the Greater Los Angeles area one of our big initiatives is basically reconstructing more than half of our infrastructure so we've this bio says six billion but since then we've actually gotten another 3.3 billion dollar bond pass so we got close to ten billion dollars with the construction going on and it helped us touch everything but it also makes us cognizant of the challenges in securing all these new high tech buildings so anyway welcome everyone thank you or hey Rick can we introduce yourself hey guys I'm Rick Howard I'm the chief security officer or Palo Alto Networks and you think you have a challenge try being a security officer for a company that is mostly security engineers because they all have an opinion let me start over I'm overall in charge of security for the company we do have a seaso and a physical security person they do all the hard work I just take credit for it we do have I am in charge of the company's threat intelligence team called unit 42 and thank you for having me here today Rick I am glad to have you on the call and actually like you to stay click the first question up for today's forum I'd like to ask you and this is one that actually came in from several people around the country so many government and education organizations manage a ton of security products and you know I'm guesstimating here but small organizations may manage 15 to 20 products midsize can be anywhere at 50 to 70 products and larger organizations can be anywhere from 100 to 150 products so the question is how do organizations integrate maintain and take their staff trained on all the security products that they manage that's a great question and it's a trend in the industry that you so when I started doing this back in the 90s the security model that we all paid attention to was something called defense-in-depth and when we explained it to our bosses we was very complicated system of overlapping circles of security but really what we only all had was three tools we had an antivirus system we had an intrusion detection system we had a firewall and we called that defense in depth and it worked for a while but it didn't work for the advanced abbess area they matured mature adversaries could pretty much get around any of those as a system so but it's all we had some time around 2010 Lockheed Martin wrote a white paper about kill chains which completely disrupted the the industry because instead of just putting three controls out in your networks randomly and hoped that the bad guys would run into the kill chain paper from Lockheed Martin said we're going to put security controls precisely where the bad guy needs to go from delivery of the payload to the compromised of the machine to establishing command and control back their home base to moving lateral within the victims networks to finding the data they want to destroy or steal and that they wanted to steal the data how would they X will trade it out so we all thought that was going to solve all of our problems in a might of but the problem is what you just mentioned is that we have this explosion of tools then we're all trying to manage even if you're a small organization you have too many that you can't already manage and the dirty secret in the security industry is that we make you guys manage that we make the network defenders manage that we don't do it for you and the other dirty secret is your staffs didn't get any bigger so it's become very hard to do all that work it's my experience as you know you pay for a point product we call those products point product they don't talk to each other you pay for a point product like you know three or four times you got to buy the box you got to buy someone who can maintain it you know keep the blinky lights going you need someone who understands the data coming off of it and then you probably need someone back in your sock who can stitch all 15 to 20 tools to other and build some sort of comprehensive adversary threat picture which nobody has the resources to get that done so we've made it too hard to accomplish this now the vendor community realizes this and what the latest movement is is something called automatic orchestration where the single vendors are trying to do most of the work for you so you don't have to do it and that the work that they don't do they're trying to integrate that with the other security vendors so that the network defenders don't have to do that themselves so that's the trend right and so the hard part about this though and this is why this group can I'd like to hear you guys weigh in this is a difficult problem for old timer Network defenders to get their heads around because it goes against all the best practices that you learned in your career the best practices we learned in the 90s where bender and death never by a single vendor to do anything and well that's the main okay and so what we're telling you now is you're going to have to trust a single vendor to do most of the work but if you do there's all these benefits that happen automatic updates to everything that needs to be protected you're going to get a deal on the price tag all those kinds of things so it is absolutely the right thing you're going to want to do going forward but for old timers like most of us on this panel okay it's hard to use your hands around that and all this pause and see if you guys have any questions about it yeah and I also chime in I'd like our other panelists to weigh in but you know Rick we had a multitude of questions that came in with just that you know I'm under budget under staff what I might it is so when anyone else on the panel like to weigh in on that question that I asked Rick which was really how the organization's integrate maintain and keep their staff trained on the security products that they manage so I can comment a little bit on that this is such a month I think Rick's addressing you know that dirty secret did is it really there's no way to keep up with this even the organizations that are trying it they're going to have brain drain as people move on to other organizations and they're going to come they have gaps and it does run contrary to our philosophy that we were brought up with that you know you don't you don't give someone all your money all your love you know you can't just trust with it that that and lock in but on the other hand if you look at the trends in technology right now cloud it's it's a game changer because before locking into a particular vendor without cloud without this automation meant that you are locked in forever now things plug in and frankly if that product doesn't work you can plug in the next one so I think we have to reevaluate kind of our traditional thoughts the the risk is still there right of the lock in but the capability to move to different platforms is much greater now so I think that that should be weighted in our decision-making okay glad you said that because you know that it is a risk question all right so is the risk of choosing a single vendor or a small set of vendors greater than the security that you might get it went automate a system that you were describing right so yeah and we have to weigh all that and and it is what you said is absolutely correct the only way to get through this is to automate everything and to make it as simple as you can so I believe it's the future you know I like to chime in on that yeah yeah this is Matt you know Erik Therese you're absolutely right that it is a risk calculation one of the things that I would say to Rick you know is that you know orchestration is what we need to be doing but we need to also make sure we've got the transparency and the open standards behind that right that's how you build that trust so that you reduce that conversation about the risk of going with a single vendor that is absolutely true yet the true I mean we're talking about establishing a partnership with that vendor okay not a not a he sale stuff to me kind of relationship this is somebody a truck right someone you're going to be with them for a long time and and you're going to benefit when they succeed so it's kind of a mutual thing so you're right all that has to be very transparent all right acts discussion on anyone else before we move on to the next question this is Erica I'll just type in the on on talent acquisition I compare this trend to trusting more of the automation business intelligence and the advanced products compare that a little bit to programming and as an if we hadn't developed in the way in assembly and we were doing shift registers we'd be slow we'd never keep it up but as the products developed become more automated become easier to use I think that's what we have to keep in mind that it becomes easier to assemble and use these as platforms and you let the brains of the automated system do that work and so I'm always looking for for products technologies and solutions that push us up the layer staff stack so I don't need to maintain that that deep assembly you know level of level of knowledge and so I appreciate that products that are heading that direction thank you point all right I really like that the I think the best practice that emerges though after we get hit we jettison vendor and depths okay the one that he merges now in this modern age is you should seek vendors who integrate who subscribe to the automatic orchestration philosophy and integrate with other products as a matter of course so that would be the new best practice great cleanly just take a moment I put up on the screen for our audience all over America to look at you very interesting white paper that I think is worth mentioning and just kind of take a quick moment to tell our audience about that and I have to link there on the screen so I encourage everyone to look that up well thanks I wrote this innovation how we got to where we are so it's sort of a little bit of a history lesson there to figure out how we went from defense and depth to kill chain to automatic orchestration to this partnership and even a different kind of a security consumption model it's kind of where we're going now I just
ell you one short story here right I was trying figure out who invented the term defense-in-depth and everybody claimed ownership of that and I couldn't find anybody that would actually justify that they get credit for it I put it out on social media and all the military people came out so yeah we invented defense and death back in the 2000s I realized that's way too late I finally found the guy by the name of prick Cohen he wrote a couple of papers in 1991 he didn't say he invented the phrase but he mentioned that everybody was using defense and depth in their enterprise philosophy so I called him I said hey Fred are you the guy that invented the term defense and death for all Network defenders he goes no I didn't invent it but I was probably the first guy that wrote it down so we're going to give the title to Fred for being the first guy to write defense and death down in a white paper so there you go oh right that was just this Joe boy I think I have to claim credit for that educated up there get a quick Jill on the paper next to he's playing in a ditch actually yeah I want to switch gears now and this is this is also a question I came in a great deal huh the Greater Boston area is home to over 45 education institutes can you comment on the future talent pool for cybersecurity yeah great question so that is a very large initiative for our governor Debra Baker here in the Commonwealth is to expand that talent pool wind the funnel if you will and to generate um talent at all levels not just a four-year degree but we're looking for PhDs and for people coming out of high school and and people come out of community colleges with differing levels of sub security techniques and savviness if you will and to really make Boston a a hub we have a hub city ecosystem for for companies to come in essentially plant seeds here and create you know really robust cyber security companies here in the United States so working with a number of this tuitions a lot of school for stupid cybersecurity programs one now will mention because I'm affiliated with it I teach at Boston College that's double Masters of Science in cybersecurity focused on policy and governance so it's not just the technical aspects that we're looking for but the surrounding ecosystem if you will that goes along with cybersecurity excellent you know interesting enough I want to I want to open this up to the panel but I also want to ping Joe and Rick on this one you know Joe if you could just comment real quick you know as we talk about this you know cyber recruiting what are some of the strategies for training team building and recruiting that you it's just implementing to our audience now might be my formal role as CIO for city San Francisco they obviously know no shortage of terrific talent sitting there in the bay area but we found that we have great success when we were recruiting for diversity and so when we were putting up postings and initially we just weren't getting the the type of quality of candidates that we were looking for mostly because of the some of the language that we were using in our in our job postings and we weren't leveraging the full capabilities of social media to get that so it's very very difficult in getting you know your stereotypical government agencies you know right the job description you know post it onto your own website and I don't do any social media outreach wait for them to come to you and we really felt it to grow our program and increase the talent level of our employees that we had to actively go out and recruit folks so we can create a guerrilla campaign around reaching out through our own personal social networks and our professional networks and so for me to go out and grab people and what we found was that when we were leveraging those platforms and specifically targeting underrepresented groups within our organization that we found some amazing talent you know I'd love to tell personal stories for all the folks that I recruited in in San Francisco but one in particular was a lady that I recorded from an underrepresented group and in cyber is very rare to find women working in this I mean IKEA is definitely male-dominated cybersecurity even more so but we found an amazing talent and she bring it she brought in capability to our organization that had been lacking for ever and it was just an amazing effort and so I encourage groups to one look if you're looking around you and you see a lot of the same flavor look for a different flavor and see what that brings to your turkey and then you know don't forget that you're competing against a lot of innovative tech companies who can provide pinball machines and popcorn and open bars and all those types of things and you typically don't have that in your organization as education in government so you really have to think outside the box to find that at that talent well in speaking of the box I want to talk about the cookie box one of my favorite things with Girl Scouts up one of the neat things Palo Alto Networks actually did a really neat and I've got a question here for Rick but I want to preface it with a little story I mean Eagle Scout and back when I was in Boy Scouts in the 80s we had a friend of our truth John Witt that took all us kids into Honeywell and you know and we all remember where computers were in the 80s and how they worked in the 90s but it absolutely matters so you know this is just an announcement I saw on the PAL out his website but Rick talked a little bit about this what's going on with the girls scouts and now you know most of us know for the cinnamon cookies but you all are definitely ratcheted up quite a bit so can we talk about now I'll just piggyback on what we're saying before the shortage of women in our industry is just ridiculously stupid right for every magazine said last year that there's only 11 percent of women in the cyber security workforce and if you add a minority on top of that if you have a black woman or AA spanic woman or any other kind of minority that percentage drops to under 1% and you all know how how much the shortage of qualified cyber security personnel there are there's over a million jobs unfilled right now so clearly if we have any hope of closing that gap we're going to have to hire a bucketload of women to come in and help us do this so we've known about this problem for the last 5-10 years we've been admiring it for a long time at Palo Alto Networks we decided to do something about it so we partnered with the Girl Scouts to build the curriculum for a teen cyber security merit badges for their almost 2 million girls in their program K 5 through 12 all right and it's going to be roughly divided between two buckets of instruction the online safety and then just general purpose Network defender kinds of things and this is us stepping up and saying we think that there's this is a problem we can solve we have to inject these kinds of leadership roles and technology roles for women and minorities in our industry and we can definitely influence it by going right to the Girl Scouts the girls guys have a phenomenal program on if you guys have never paid attention to a name of fantastic infrastructure for developing content instructional content rolling it out in pieces as a testbed and then rolling it out to all the Girl Scout troops leaders so they can train their their troops and get the merit badges it's really phenomenal and so excited that I've worked with a company like Palo Alto Networks who can invest in something because as a long-term game I'm very excited thank you Rick you know one thing I wanted to comment on bill Britain has been a speaker on our panel in the past and he's the CIO over at California Polytechnic University or Cal Poly and I had a chance to go observe their cybersecurity training center and they actually run a program for high school students and one of the things they look at they're not looking for the kid that to get the quickest answer or fix whatever the glitches they're looking for the kid that can problem solve whatever an unknown problem could be in the future and they just had two weeks ago did a huge event down there on the Central Coast of California but we're seeing a lot of things and like I said my hats off to what Palo Alto is doing I really like some of the Joe's comments on that as well if there are any other so Germany as the only woman on the panel a woman and I were security I did want to comment and say that you know I I'm going to make it a little personal here in saying that in my journey here is our security mentorship has been tremendously important and for those of you who are fathers out there who have daughters who like puzzles and solving problems and have a keen interest in math and building building up and cultivating that in them and that sense of curiosity is incredibly important and plays a tremendous role in you know women thinking that it's possible for them to be successful there so I you know hats off to all of you and all the efforts that are being made to engage more women in the community but you know of course community in that personal touch and building relationships is extremely important thank you for that thank you for that I am going to shift gears now my next question is for Eric Eric recently your university was compromised by a hacker going after credentials for employees payroll direct deposit can you talk to us a little bit about what happened and how you all were able to remedy that situation you bet III think that most of us are discovering either either through bad experience or other ways is quite frankly the username and the password is debt we have to find ways to get beyond that and with the title of this presentation which is a you know the the human factors involved people really get involved in the security when it impacts them directly and it hits you pretty directly if your paycheck doesn't show up in your account very simply I classic phishing email practices click on them give them your your username and password of course in in enterprise we tell people well don't share your password anywhere else well at the same time we're enabling single sign-on like there's no tomorrow taking arrows taking ourselves in our foot so I get a username and password login electronically change a direct deposit entry inside the HR system the the hacker then uses that same username and password to get into email because of course we're using single sign-on deletes the notification just watches for that coming from the system so when does the user notice that something is wrong when the money is gone and then by the time they contact us that money is international and in gone three steps and as as usual how do we traditionally find out about about hacks and compromises after the damage has been done thank you on that and I tell you if it's not just happening Utah we did a live of it here in Sacramento about a year ago and dr. Larry Gilbert who recently retired from Sac State commented where they had someone going in after there were seven people that had check authority and they were able to get on their account just doing small things so made a message to someone scheduled appointment at the last hour they call them so and again many times that is the hard part you know people get in your network and then they move all around I wanted to talk to you and I'm also going to ask Mohammed to comment on this too though your University recently completed an implementation for dual factor authentication for your employees what I want you to talk about not only why you did that but many times we have a thorough dances they I'd say about 80 to 90 percent of them are either a government organization K through 12 or higher education and typically when you try to present an idea to government there's an information review board a board of directors sometimes the university system so I'd like you to talk a little bit about I've got a couple slides off here but about how you got you know I believe there eight schools in the Utah University System how you decided to do this and how you how you got everyone in not on board with it right well you know the start of a twelve step program is recognized you have a program recognized you have a problem you know uh when we talk about the you know the hacking of the payroll direct deposit we regret those hacks but there's nothing better than real experience to drag that along to get people interested and paying attention so we knew user name and passwords were dead and we loved to present data to folks help them understand that you people understood the problem because people understand phishing and because of the direct deposit things they understood the need to do something about it now the question is what do we do so so we started presenting a lot of data we joined together as a group of eight CIOs here in the System of Higher Education in Utah and and we zoom we zoomed in on some data out of the 2015 Verizon data breach investigation reports that that evaluated eighty thousand security incidents across deewan countries and as they as they categorized these they they mapped a lot of the compromises to the sands top 20 the the CSC security controls that the top compensating security controls James if you flip to if you flip to that slide that were the one right after that right after this one so there we go so from top to bottom they allocated a hundred points to the ones that if they had been in place which one that would have been most effective at preventing that particular compromise on the top to blowing every every other control out of the water was dual factor authentication and on the back end keeping your web services patched and so at this point all it took was telling us story we'd go to administration we go to folks and say hey username and password is dead so if we do dual factor authentication why is that so effective look if I give my username and password out to the entire country of Russia and I've got dual factor authentication in place my Apple watch will be my phone will beep if that wasn't me trying to log in I can hit the red button and denied immediately I can stop the damage right there and now suddenly I am reminded well maybe my credentials are compromised I better go change my password but I've stopped the damage and and and I'm notified instantly the that that some compromise has occurred and that story resonated with a lot of people and so what we eventually got got a member a mentor memorandum out of those stories from our State Board of Regents using data using stories together and it takes data and stories because people aren't convinced by facts alone they've got to have some emotion and some personal involvement the combination of those two produce the statement you see on there where where under the the requirement to do that and and off we went thank you Eric that's excellent I do I want to come back to this topic and I just want to put a pin in it real quick one of our guests David Terry from Princeton University has to leave a little bit early and I wanted to get a question to him when we have them on there David I had a question for you and there's a great deal of conversation on security awareness and training for the position you support but and your opinion what do you think a security leader should really be responsible for hmm thanks for that question James and you're right there's always a great deal of chatter in the security community on the cost and effectiveness of security awareness training efforts throughout the community there's also a lot of research that one can find I think to support whichever position one subscribes to both positive and negative I for one believe in the value of a strong security awareness program it's actually embedded in my groups mission statement which includes a pillar that charges us with an expansive and continuous security awareness program I also have a staff member dedicated to this full-time which I believe is the key if awareness and training is to be done with excellence and I've seen a constant increase in interest in our programs with a measurable impact on our risk and our security benchmarks I believe that our user population really are all breach detectors you know you c
n build the best architecture and have all the best solutions but if an end user gets tricked I can't recognize abnormal behavior on their technology they use and then all the technical work is for naught so it's our goal to make security or cultural mindset and we can't do that without a strong awareness mindset and focusing program and I vote yes for security mission do you uh want to ask you one other quick question and I appreciate you making that time for us can you tell our audience an example one interesting solution you have used as dramatically impacted security awareness on your campus and the positive impacts you've seen from it hmm yeah absolutely James at the beginning of this year we implemented what we call the fishbowl that's fish with a pH obviously the universities under Khan stream of phishing attacks and the scammers are making the email attacks look more and more credible many of them looking like they're coming right from a Princeton account one with a Princeton website in addition to our focused awareness and training sessions on phishing to teach people about this the fishbowl was created and the premise is simple when a member of the community receives an email that's a possible phishing attempt they check the fishbowl website that's linked off the information security page if the message is listed in the fishbowl then the user simply deletes it if it's not they send it to a fishbowl email address and we review it and add it to the website very quickly usually in under 10 minutes 24/7 and we've seen a decrease in the number of clicks on phishing attempts because of this as well as a dramatic number and then amount of compromised accounts on campus and our website analytics show us that the fishbowl page is one of the most frequented by our entire community so I'm all about training a population on knowing what's normal giving them a quick and easy way to report when something doesn't feel right in the fishbowl fits this formula has been a great success to my mission in Princeton overall thanks David I appreciate that I want to I want to switch gears we I have a few more questions for the for the panelists and I want to jump back to this kind of dual factor authentication Mohammed I know on May 27 2016 the state of Colorado's governor the chief of staff and all the cabinet members got on board with the governor's office of IP plan to proceed with implementing two-factor authentication for your email service can you please comment on that thank you James for having me yes it took the governor office and chief of staff and all the cameras member to see the value of enabling to fact on vacation for the emails my first request being with the state for over almost over 18 years I had a request for implementing the two fact on vacation on one of the major systems on 2007 and all that time I was not successful to convince the the state to spend the money and abdomen to factor on vacation but one we had too many too many and huge increase in a phishing attacks and on state emails and we have seen user actually clicking and we have some significant impact then at that time it became obvious that we have to do something about it so 2015 we start the planning to implemented two-factor on vacation and are a little bit over a year down the road how is that help actually we have a hundred percent enforcement without whining from the end users having twenty six thousand plus users and I really have I mean being able to change the behavior of the users by providing second factor with all other challenges that the the parents there are a world by providing a variety of options of consuming the two factor notification we have hundred-percent enforcement and we are not stopping at the email service actually we started a year ago on having a program for a two-factor on vacation where we are putting in place the platform and then adding the critical system being in promise or in the cloud to be consuming the two-factor authentication thank you for that I appreciate that before we move also but I have a few more questions for you know Jennifer Matt and Jorge before you've involved with dual factor authentication anyone else want to comment all right we're going to switch gears Joe I have a question for you I've actually heard you say that this is kind of ism you you're hearing for the first time here on the PSTN but I've heard you say that cybersecurity is like the children's storybook Stone Soup by marcia brown can you share a little bit for sulfur those that don't know about Stone Soup can you give us just a quick you know little tidbit on that and then tell us how cyber security is like this children's book yeah it actually has multiple origins all over Europe all over Asia so I don't think we're going to to any one person that opiates ever been directly attributed to a single author um the basic concept of story and there's different versions of it is that a beggar comes to town it's hard times and they go to the door and ask someone for food and they go door to door to door everyone is holding on to their own resources they're very you know it's hard times so in an attempt to just said they go to the town square they find a little cauldron they fill with some snow and and buy a fire and it's basically just boiling water at this point and then they're sipping it and before serious wisest person boiling boiling this water right comes it comes to them it takes out a magic stone or the stone and puts it into the water and it said oh you know what this the soup is very very good but it could use some carrots some of disappearance and open the crowd runs and grab scattered Springs back and then the process repeats a can use a little salt to get use a little potato to use a little meat and everyone's pulling the resources is basically having so this whole community even though there are all very impoverished when they come together they can create another store soup and nourish everyone and everyone's better for it and and that's kind of the status I'm assuming you made regards especially in the in the public sector is is we have a lot of great tools I love David's fish bowl story there I took quick notes because I think that's something that we could use here when we pull those ideas with cooler resources of coal or intelligence together then we can we can actually become better point and stronger and so I'm a big advocate when I was at the city of San Francisco we were 55 different departments United only in name you know we did not coordinate efforts from a technology standpoint or cyber security standpoint and so I used the Stone Soup philosophy to try and get those 55 departments to start trusting each other and sharing the good ideas that they had individually within an IP in cybersecurity and what I was able to achieve within my tenure there was that we broke down a lot of walls really quick we started deploying things centrally with a decentralized execution so that people could still use these powerful tools that use them in the way that they wanted because of the ways we were all individually procuring and in a vendors you know don't they love this all 255 times but it's a lot better when you know you can buy maybe something on an economy of scale and get some of the bigger the bigger toys you know the more capable toys rather than the entry level model if you can only afford with your your limited departmental budget so we started to do a lot of that work and some areas we were very successful in other areas you know we still had a lot of room to grow but this can be done in anything from training efforts to you know procurement of tools to policies to just you know simply great ideas on how to approach training and awareness so I kind of encouraged folks that's why I would get excited of these type of report with these forums because it is an opportunity to learn from each other take great ideas away and then potentially contribute your own ideas and successes to the group so that everyone grows from them so that's my Stone Soup philosophy and why I try and advance that in the communities that I happen to work in live in thank you Joe and for our audience looking in all over America we're right we right about the tip of the hour we're going to try to run things another 15 minutes I have some questions for Jennifer Matt okay so as we move off of I love the Stone Soup philosophy and I too love the fishbowl item you can't see me a virtual or but I've been taking a lot of notes to this information is excellent Jennifer you know one of the things I want to talk to you about is threat intelligence has become a buzzword among many vendors but what does it really mean to an organization what is the real significance of having some kind of threat intelligence and what does it really matter to you know government higher education K through 12 please comment on that sure so first of all let's English the difference between threat data and cert intelligence and Beiser intelligence what I would say is true threat intelligence is where the data is been qualified likely by a threat researcher or an actual human being looking at this information the second piece being that it's representative of your organization that as you're looking to operate you can operationalize that and that's really sort of that third point this information can be acted upon right meaning that you can use it to create a signature rule configuration or whatever it may be to stop that future threat from the same campaign using the same indicators compromise - ahead of time right so really not all security vendors have a rigorous practice of qualifying their cert research and most of that threat research doesn't even necessarily make it back into the products that they provide but you know as Rick mentioned earlier in terms of automatic orchestration a lot of that is an effort to you know what can we do to operationalize threat intelligence threat research or data and information but it is always at the end of the day up to the organization to make that applicable to you and ultimately you know what is relevant to your user community so I'd say that the this is really significant in gov it because you know the technical nature of threats are really no different than other industries but the dynamics of your user community the open infrastructure the types of data that you need protected need protecting is really what sets you apart from other industries and having sort of that additional context to be able to operationalize that information is really key and - you know one of the things that we do well two point one of the things that we're doing is you know as we look at the landscape broadly speaking you know how do we segment that data to make it more meaningful for our audience and our customers in looking across industries or geographies and so this is actually one of the great areas where you know you can partner with your vendors or solution providers because while we may have that information there we are often you know we have we often have conversations about how to best derive the data to apply to your tools based on how you want to ingest that information and apply that to your organization so the analogy that you know has been shared with me by our research team was actually you know when you think about for intelligence provided by either feeds or other sources you can think about it as asking a home cook to cater a wedding right Oh while it's not impossible for you internally or your internal team to do some of this research yourself and derive the intelligence or the threat data it's difficult and so most of your vendors and the teams that we have in terms of providing start researching information you know we are really taking this and trying to operate at scale and being able to apply you know may and make recommendations - this is how you can actually apply this information in your environment thank you for that it's Jennifer one of the overwhelming questions we got in just about everybody I mean everybody in the world uses Microsoft you know we got a lot of people about how to you know what do I do with office 365 and cyber security just take a quick moment to respond to that and like I said we had several questions from all over the country comment on that sure so we actually hear this across all industry is impossible especially in higher education where they're moving a lot to cloud platforms and this is also true of people who are moving to G suite so this is where you know cloud security really means more than just looking at the cloud application itself right and earlier I think it was mentioned where we're looking at our diversification of risk and you know putting all your eggs in one basket so to speak is not necessarily in the best interest of everyone in the organization so so you know really being able to determine you know the decision to move to office 365 is typically driven broadly by IT and for collaboration purposes but the question is whether or not the additional features security features that Microsoft is built into office 365 really serves the purpose of your security team and whether the information even the threat intelligence that's claimed there right is really operationalized in the way your team responds to incidents or or obtains visibility and what's going on in your environment right so you know even in terms of you know standard security practices you know we're hearing a lot lately about massive campaigns such as you know like want to cry and while these aren't necessarily relevant to office 365 specifically but you know this does kind of change the game in terms of how we're thinking about people being compromised so at the end of the day right that decision to move to office 365 does of course mean you know make sure that your IT team or your broader IT team is aware of your needs and what will can make you more effective and not only on the security side but on the compliance side and understanding you know what kind of visibility you can truly get whether you couldn't actually act on it Thank You Jennifer I have a couple questions for Jorge and Matt I know this hour is going really quick and I tell you for hey I could ask you about 20 questions if you all get a chance outside this event take a look at some of the unique things that the Los Angeles Community College District is doing they are innovative I will tell everyone this I'm here in the Sacramento area and there is an assembly no past and what's happening right now in California we have oh I think it's like 23 university systems that get all our funding and we're having trouble because so many people are applying to get in California is a big State and they started doing pilot projects at community colleges where they're going to be offering 4-year degrees and coordinated schools doing that and essentially this is going to blow your mind for anyone that has a kid in college like me you could - Jorge college and get a BA degree for under $10,000 and I I know there's a virtual shot that just went around the world why let me so or you might be getting some emails on that but what I wanted to talk to you about and before I do this I want to preface the demographics that you hand on it you have a driven story Los Angeles its massive the most Angeles Community College District has some unique demographics you have over 250,000 students 900 square miles of campuses through nine colleges and your team back in December had a cyber attack please tell me what happened cyber attack in this huge area tell us what happened and how you were able to remedy the situation well yeah so a couple of things one is there were I think there was a human element is that we were targeted you know somewhat understood that this attack happened during the holidays so going back to staffing that when are you going to be at your weakest right they know that injured by yourself but a lot of things that we had put in place kicked in and we were able to quickly execute our plan so I would say that something that was extremely disruptive did not turn into a tragedy I think that's a lesson learned in all security planning you know the board had me in front of their other committees they said can you assur
us that you can protect all our information I said no one can give you that I can assure you that we have a plan that we can improve that has been demonstrated to be successful the attack was a it was a ransomware but it was a very different type of ransomware typically it's someone who's clicked on a link this one had an element of brute force in it and one of the lessons we learned was compliance is not security so we passed the audits but the the threat agents are continued to improve and some things though it's kind of a low-level fever you can think of if you don't pay attention turn into something very traumatic and that's what this was it was someone taking advantage of something and getting into something and causing disruption now thankfully the fact that I'm still the CIO tells you that there was no future personal information which is good right we got all the we got a lot of it right there were a lot of tough moments a lot of tough questions but we had all the data and so the legal teams were evolved but it was very traumatic for the organization I would say but it was very helpful in you know what my peers and this this panel have been describing getting a very personal story to the board executing on those recommendations that we know our best practices you know so all these things about two factors those are doesn't already been vetted and execute them and then prioritize them there were a little surprised when I came back and I go how much money do you need and I go I have about six months of work that doesn't require any money it just requires you to charge me with that responsibility that kind of blew them away because I'm I would David you know this awareness embedding it into the DNA of our organization the automation I would say the security awareness is the defense and death and that's one of the things that saved us we had just completed an entire year of security awareness training so we didn't get caught with some of the things that others would have done so I think you know as we get such a diverse group of people here we have to protect all types of people and frankly you know the the more affluent you are you have more ability to recover from a cyber attack but we have a lot of very vulnerable groups that seek our help and education to them I mean losing a thousand dollars in their checking account could mean the end of their way of life right to someone else it may be you know you don't go to that vacation so we have I would say higher-level responsibilities and protecting all these it is I have 3.5 million identities online so it's something that I think about every day right well thank you for that up folks I want to take a quick pause to our national audience I want to be mindful of your time I know we have said this is a 60-minute webinar and we're pushing on it but I'm going to ask our panelists to stay with it's just another moment our audience that's come in through America has not but this is a riveting conversation I was a good one longer but one of the reasons I saved Matt Morgan here Georgianna business next part we're going to talk about a little bit different we've been talking about cybersecurity but we're going to talk about what happens when it goes after your buildings your infrastructure your irrigation system so I have one last question for Matt and if y'all could just stay with it's about ten more minutes we'll try to wrap the event up Matt um last year we saw the Moran botnet attack on Deutsche Telekom and Germany literally go in use the internet of things to attack the organizations as organizations look down the road where future attacks can happen please comment on the relationship between cyber security and physical systems that operate things like buildings and irrigation systems and thanks James uh you know I think there we can think of multiple large-scale breaches that began as an intrusion on one of the industrial control systems or a secondary system that was not the primary data repository right and I think we're seeing that now right I mean nobody's mentioned the word not yet yet but that's a rant that ransomware attack that's occurring in mostly in Europe but has hit the United States is coming into organizations on things like for example manufacturing plant force hospital entry points you know that have that are starting with systems that are not protected what we've done is we've started a research institute and that research is to look at this cyber issue when it crosses over to the physical world so things like like set buildings you know are in the building control systems that control the blinds for example - or the heat or any of the cooling are those exposed now of course your facilities folks always say that they're not connected the Internet but I think we know that sometimes that doesn't always work out that way and yeah even in our houses today our TVs fridges I mean there's so many you know area is the corollary stages integral is it is it is growing you know when they buy that equipment when you put up a building it's a twenty thirty year investment right and so if you put in the IT for that building and that is not going to be refreshed for another 20 years there's a lot to changes there right and so a lot of the ransomware and things that are happening you know they're targeting systems like XP with a 7 well we all have moved on from that except for in these control systems and I think that's you know evident you know Cadbury chocolate just released today that they were impacted in Australia by this and so that that kind of shows you interesting yeah so that kind of shows you the the risk there right and then it crosses over then into your people you know we've been talking a lot about hiring and how we we hire those those folks right you know building from within and working with those facilities folks the people that are electricians and and whatnot in teaching them in cybersecurity can help provide you a better spread into those areas that you get more eyes on what's going on perhaps maybe they'll bring things to you and and we're actually in our research looking at products and assisting people with the implementation of those products in their in their buildings that actually do many of the same things that you know both Proofpoint and allowed to do but maybe at a smaller scale like an irrigation system uh you know irrigate you know if you miss water or something maybe that's not that a big of a deal except for example if it's a large farm and those farms are providing the food for our country and I fertilize it kills those crops right so I mean there's there's a of crossover into our physical protection area and I thank you Matt on that folks I know our time is getting tight but I would like to give them we're going to wrap up here in just a moment and a few closing remarks but I'd like to give our panelists just an opportunity for a quick closing mark we'll go around the horn Hans if you just had some closing comments and then we'll go around everyone for just one last word before we wrap up to date on thank you very much this is a big wonderful discussion and thank you to all the listeners as well for me it's a couple things wrong it's yes technology is very important it's dragging our our day-to-day lives but the people are the most important thing underlying all of this and for us it's training education so how do we train and educate our workforce and for the generations are coming behind us to be proactive in using their material and technology in a safe and secure manner so that's our big area big area of focus right now is on training education of the workforce thank you hon Mohammed last word before we wrap up today thank you James thank you for having me I think if I want to share anything with a for our success here with the with the state of Colorado is shifting how we look at the users from the weakest link that we always like to call our users which we need this link we want to call them the human iPS and an idea basically be the one who will help us to uncover any suspicious activity and give them a mechanism to report that so we can take actions okay thank you Eric Stone Soup a Men and half women half I think a lot of us are still in Stone Soup after that stupid stupid fish boat were pretty pretty neat ideas there and I agree with that as I mentioned everyone to David had to leave for call so we'll jump to Joe and Joe laughs were there I just appreciated the opportunity to grill my my professional network here and a couple of great thought leaders in the industry I hope that everyone listening in has learned something or gotten something out of it that will help improve their the program incrementally and you safe out there Thank You Jennifer um you know as we are talked about threats are going after humans so the human touch is absolutely required for effectiveness so not only training your humans are really equipping the people on your team and hopefully that influences what skill sets are really required of security professionals in the future you know in terms of you know making the most of working with technology as well as really understanding what underlies that thank you Matt thanks gene so appreciated listening everybody to today it's been very enlightening I would just say you know focus on fundamentals right that's the the key thing there is building that operational excellence and working with your people and building them and grow in them so they not only state with you but if they do leave they at least contribute to the larger cost I appreciate that and I tell you you've got me intrigued we might be doing some future pft that's on physical building security ideas again it's a really riveting discussion jorge last word before we wrap up today i've to say that all the things that i've learned they are very compelling and the disguise point the point of automation and scaling and that this is kind of a continuing journey you know whatever you know right now be be ready to reevaluate periodically make sure it's not a special order that is for sure thanks for networking all right two quick things support your local Girl Scouts and seek vendors who integrate you are pursuing automatic orchestration as fast as you can right okay I want to thank you our audience for staying with us I know we went over a little bit Dutch but we have a great amount of people coming in from all over America I you can hear the virtual clapping but I want to thank for our standing panel you all were brilliant I want to thank our sponsors Proofpoint Palo Alto Networks we have some upcoming forms with the PFT e there on your screen will certainly notify you about this again if you'd like to get in touch with our sponsor proof point your team is on the screen right now as well as palo alto networks if you have an interest in being a panelist or sponsoring a future PFD forum please contact me james baker on behalf of the public sector technology exchange i want to thank you for joining us for hackers in the human factor I'm James Baker make it a great day
