Overview: In the first episode of Season Two of Cyber Focus, host Frank Cilluffo welcomes Matt Hayden, former Assistant Secretary at DHS, and RADM (Ret.) Mark Montgomery, former Executive Director of the Cyberspace Solarium Commission. Together, they discuss the evolving cyber landscape under the incoming Trump administration. The conversation covers critical cybersecurity challenges, including regulatory reform, military mobility infrastructure, the separation of Cyber Command and NSA, and strategies to counter adversarial cyber threats. Hayden and Montgomery provide insight into potential policy shifts and the role of public-private partnerships in safeguarding national security.

Main Topics Covered:

• Cybersecurity priorities and regulatory reform under the Trump administration
• Strengthening critical infrastructure through public-private partnerships
• Enhancing military mobility and addressing state-sponsored cyber threats
• Cyber workforce development and innovation in response strategies

Key Quotes:

"The president and his team have a list of priorities. And the good news for folks that are interested in cyber is cyber touches everything." — Matt Hayden

"I do think there's going to be a push for a Cyber Force." — Mark Montgomery

"We're never simply going to firewall our way out of this problem." — Frank Cilluffo

"The current force generation model isn't working. We're not recruiting the right people. We're not training them. We're not maintaining them. We're not retaining them." — Mark Montgomery

""I think that [CISA has] an opportunity to actually explain what they do a little better... Knowing what CISA actually does day to day, especially on the congressional side, is tough." — Matt Hayden

Relevant Links and Resources:

• McCrary Institute Presidential Transition Taskforce report

Guest Bios:

• Matt Hayden: Former Assistant Secretary for Cyber, Infrastructure, Risk, and Resilience at DHS, now a Senior Fellow at the McCrary Institute.
• RADM (Ret.) Mark Montgomery: CCTI Senior Director at the Foundation for Defense of Democracies and former Executive Director of the Cyberspace Solarium Commission.

In this episode of Cyber Focus, host Frank Cilluffo speaks with Manny Cancel, Senior Vice President at NERC and CEO of the Electricity Information Sharing and Analysis Center (E-ISAC). The conversation explores the evolving threat landscape impacting grid security, including challenges posed by ransomware, physical attacks, and AI-driven cyber risks. Manny highlights the importance of public-private collaboration, resilience engineering, and supply chain security to mitigate nation-state and extremist threats. He also discusses the ISAC's role in information sharing, mutual aid programs, and exercises like GridEx to strengthen critical infrastructure defenses. The episode concludes with insights on emerging technologies, operational technology (OT) convergence, and preparing the next generation of cybersecurity leaders.

Main Topics Covered:

• The evolving threat landscape: cyber, physical, and AI-driven risks
• Public-private collaboration and lessons learned from global crises
• Enhancing grid resilience through mutual aid, GridEx exercises, and supply chain security
• The convergence of IT and OT systems in critical infrastructure
• Preparing the next generation of cybersecurity leaders and addressing resource gaps

Key Quotes:

"The threat has really become so much more complicated because of the geopolitical tensions... corporations were not designed to fight nation states." - Manny Cancel

"We curate products and services for the different audiences that we deal with. We don't dumb things down, but we make things more consumable and digestible and useable." - Manny Cancel

"It's not unreasonable to think that what we're seeing in other parts of the world could occur here." - Manny Cancel

"In a worst case scenario, at least, we hope we can bounce back. If not bounce forward." - Manny Cancel

“We’re seeing a proliferation of drones. I think the challenge with drones is that there are legitimate and then there are malicious [uses].” – Manny Cancel

Related Links:

• NERC
• GridEx VII Report 
• E-ISAC

Guest Bio: Manny Cancel is Senior Vice President at the North American Electric Reliability Corporation (NERC) and CEO of the Electricity ISAC. With over 40 years of experience, including serving as CIO of Con Edison, Manny is a recognized leader in grid security and resilience. He champions collaboration across industries, fostering partnerships to address cyber and physical threats to critical infrastructure.

For this episode of Cyber Focus, host Frank Cilluffo sits down with Eric Geller, a leading cybersecurity journalist who contributes to top outlets like Politico, Wired, and The Record. Together, they unpack Eric's reporting on expectations for changes in AI regulation and cybersecurity under the incoming Trump administration. They also discuss the vulnerabilities within critical infrastructure sectors like agriculture and telecom. Geller offers insights into systemic challenges, the evolving threat environment, and the need for innovation in tackling cybersecurity policy and governance.

Main Topics Covered:

• Changes in cybersecurity priorities under different U.S. administrations
• Insights into major incidents like Salt Typhoon and their implications for telecom security
• The Biden administration's AI executive order vs. potential Trump-era policies
• Cybersecurity vulnerabilities in agriculture and critical infrastructure
• The challenges of implementing software liability and establishing duty-of-care standards

Key Quotes:

"[Salt Typhoon is] one of the broadest campaigns that the U.S. government has ever seen." - Eric Geller

"Congress would have to step in and say, we are declaring software to be a product, which unlocks some legal avenues for further work [on software liability]." - Eric Geller

"Trump changed the rules a little bit to make it easier for the military to launch some of these [cyber] attacks. And Biden did not reverse that." - Eric Geller

"The tech industry really needs to figure out where it stands on how much regulation it wants." - Eric Geller

"All these things could be hacked. And right now, it's almost just a matter of luck that some of them haven't been." - Eric Geller

Relevant Links:

https://www.wired.com/story/trump-administration-cybersecurity-policy-reversals/

https://www.wired.com/story/donald-trump-ai-safety-regulation/

https://therecord.media/government-is-not-ready-for-food-agriculture-cybersecurity-usda

https://therecord.media/cybersecurity-software-liability-standards-white-house-struggle

Guest Bio: Eric Geller is a seasoned cybersecurity journalist, recognized for his in-depth analysis of pressing cyber issues. He has written for Politico, Wired, The Record, and Cipher Brief, focusing on policy, governance, and the intersection of technology and national security.

In this episode of Cyber Focus, host Frank Cilluffo interviews Mark Green, Chairman of the House Homeland Security Committee. Congressman Green, a combat veteran and healthcare entrepreneur, discusses key cybersecurity challenges, including workforce shortages, bureaucratic inefficiencies, and economic models that incentivize cybercrime. The conversation highlights the importance of initiatives like the Cyber Pivot Act, designed to address critical workforce gaps, and the need for harmonizing regulatory requirements. Green also explores strategies for protecting critical infrastructure, enhancing state-level cybersecurity, and leveraging public-private partnerships to bolster national resilience.

Main Topics Covered:

• Addressing the cybersecurity workforce gap through the Cyber Pivot Act
• Harmonizing federal regulations to reduce bureaucratic inefficiencies
• Strengthening cybersecurity for critical infrastructure at all levels of government
• Tackling economic incentives that enable cybercrime and vulnerabilities
• Advancing public-private partnerships and state-level cybersecurity initiatives

Key Quotes:

"We have a 500,000 person shortage in cybersecurity jobs in this in this country, empty spaces with nobody to put in them." - Mark Green

"If a company is spending more time complying than they are actually securing themselves, then... government is doing harm." - Mark Green

"I have a strong belief that we have to as a country own the fact that these businesses can't protect themselves against nation states. And we have an obligation." - Mark Green

"At the end of the day, the first to respond and the last to leave in a local incident are still going to be at [the] state level." - Frank Cilluffo

"We've got to figure out as a country how to put pressure on people, to enforce laws, to extradite when someone breaks our laws." - Mark Green

Relevant Links:
https://homeland.house.gov/2024/09/24/chairman-green-introduces-cyber-pivott-act-to-tackle-government-cyber-workforce-shortage-create-pathways-for-10000-new-professionals/

Guest Bio:

Mark Green is the Chairman of the House Homeland Security Committee, where he spearheads efforts to address cybersecurity, border security, and national resilience. A West Point graduate, Green served as a combat veteran and special operations physician in the Army’s renowned 160th Special Operations Aviation Regiment, known as the Night Stalkers. After his military service, he became a successful entrepreneur in the healthcare sector. Green has brought his leadership skills to Congress, focusing on critical issues like cybersecurity workforce development, regulatory harmonization, and protecting critical infrastructure. He is also the author of We Before Me, a book reflecting his philosophy of putting collective success above individual gain.

Overview: In this episode, host Frank Cilluffo sits down with Cheri Caddy, former Deputy Assistant National Cyber Director at the White House and senior technical advisor at the Department of Energy. They discuss the cybersecurity challenges surrounding connected vehicles, examining how modern cars are effectively "computers on wheels" and the broader implications for privacy, data security, and national security. Cheri highlights the convergence of IT and OT systems in vehicles, the need for cyber-informed engineering, and the importance of regulatory harmonization in addressing these challenges.

Main Topics Covered:

• Convergence of IT/OT systems in connected vehicles
• Cybersecurity and privacy risks of modern cars
• Global supply chain implications for vehicle data security
• Regulatory harmonization across sectors impacting connected vehicles
• Future of automation and autonomous vehicles in the cybersecurity landscape
• Managing cybersecurity at an enterprise level for government and corporate vehicle fleets

Key Quotes:

"Your car has always been something in your environment, but now it's a computer. It's software-defined, and you have to treat it with all of the cyber implications of being a computer." – Cheri Caddy

"There's no cyber problem that's a single sector anymore." – Cheri Caddy

"Vehicles are giant sensor platforms recording everything. What are the security implications of taking a connected vehicle on to a sensitive facility? ...I think that is very much an open question.– Cheri Caddy

"We need to get [vehicle engineers] to think about cybersecurity at the design phase. Because dealing with bolting on cyber after the fact is, is just not practical.– Cheri Caddy

This is just such an interesting area of converging, of all of the exciting cyber things, from supply chain to applied machine learning to data standards and integration. – Cheri Caddy

Relevant Links:

National Cyber Informed Engineering Strategy

Information on vehicle data privacy and cybersecurity from the National Highway Traffic Safety Administration (NHTSA)

• https://www.nhtsa.gov/research/vehicle-cybersecurity
• https://www.nhtsa.gov/press-releases/nhtsa-updates-cybersecurity-best-practices-new-vehicles

Guest Bio: Cheri Caddy is a cybersecurity leader with over 30 years of experience in national security, intelligence, and technical advisory roles. She has served as the Deputy Assistant National Cyber Director at the White House, as well as a senior advisor at the Department of Energy. Caddy's expertise lies in bridging policy and technical innovation, particularly in IT/OT convergence and secure-by-design engineering for critical infrastructure.

In this episode of Cyber Focus, host Frank Cilluffo interviews Kiersten Todt, president of Wondros, a creative firm focused on social and policy change. Todt, who previously served as Chief of Staff at the Cybersecurity and Infrastructure Security Agency (CISA) and as a senior advisor on the Senate Homeland Security Committee, shares insights on the challenges and advancements in cybersecurity workforce development, public-private collaboration, and the critical role of community involvement in cybersecurity initiatives.

Main Topics Covered:

• Cybersecurity workforce development, with a focus on neurodiversity and inclusivity
• Public-private partnerships and CISA's role in regional engagement
• The importance of community-level cybersecurity initiatives
• Cybersecurity supply chain issues and the need for inclusive small business support
• Cybersecurity awareness through campaigns, education, and human-centered design

Key Quotes:

"I think we as a nation will be so much better if we create inclusive workforces that represent and acknowledge and honor the aptitudes of individuals that we may not define as being... typical." – Kiersten Todt

"If we're truly looking at securing [critical infrastructure sectors], we have to look with a cross-sector approach." – Kiersten Todt

"[Cyber incident response] starts in the community, it starts at the local level. And so being able to engage those individuals is critical." – Kiersten Todt

"The applied side is what attracts most of these kids [to cybersecurity]. It's not sitting behind a computer and just the zeros and ones. It's actually seeing the fruit of their work and actually getting involved." - Frank Cilluffo

"Creating more of an activist culture in cybersecurity, as well as some of these other issues, really helps to turn the tide and to create change." – Kiersten Todt

Relevant Links and Resources:

• https://pausetake9.org/
• https://cyberreadinessinstitute.org/
• https://wondros.com/about/

Guest Bio: Kiersten Todt is the president of Wondros, a firm dedicated to social and policy change. She previously served as Chief of Staff at CISA and has held senior advisory roles on the Senate Homeland Security Committee. Her work focuses on building inclusive cybersecurity solutions, workforce development, and fostering partnerships across public and private sectors.

In this episode of Cyber Focus, host Frank Cilluffo interviews Patrick Wright, the Chief Information Security Officer and Chief Privacy Officer for the State of Nebraska. The discussion centers around the challenges and opportunities of implementing artificial intelligence (AI) and cybersecurity strategies at the state and local levels. Patrick shares insights on leveraging AI to bolster cybersecurity, managing privacy implications, and building strategic public-private partnerships. The conversation also highlights initiatives like Cyber Tatanka, a unique cybersecurity exercise involving military, government, and private entities, and addresses the importance of cooperation with federal agencies.

Main Topics Covered:

• State-level implementation of AI and its role in improving government services
• Leveraging AI for cybersecurity: challenges, use cases, and privacy considerations
• Cyber Tatanka: A collaborative cybersecurity exercise with the National Guard
• Strategic partnerships with private sector and federal agencies
• Resource allocation and logistical challenges in disaster management using AI

Key Quotes:

"We're leveraging cybersecurity and AI to bolster our defenses against the national and global threats that we face." – Patrick Wright

"We can talk about cyber security from a strategic perspective all day long... But where the rubber meets the road is in providing the the critical capabilities for cyber down to the SLT level." – Patrick Wright

"Being proactive in not only what we're doing from a cybersecurity awareness perspective, but from an emerging technology perspective, from a policy perspective, from a best practices perspective." – Patrick Wright

"When you start talking about targeting the power grid, not only are you disrupting power supply generation for constituents across the state or region, but you're also, impacting power for other critical infrastructure like like health care and banking." – Patrick Wright

"We tend to look at the world through our boxes and org charts. The bad guys don't. They act. In fact, they very intentionally exploit the seams in our defenses. –  Frank Cilluffo

Relevant Links and Resources:
National Association of State Technology Directors (NASTD)
NASTD AI Survey
Multi-State Information Sharing and Analysis Center (MS-ISAC)

Guest Bio: Patrick Wright is Nebraska’s Chief Information Security and Privacy Officer, responsible for statewide cybersecurity initiatives, incident response, and compliance. With experience in both public and private sectors, he holds degrees in IT and public policy, and chairs multiple cybersecurity committees. He also serves on CIS’s Multi-State Information Sharing and Analysis Center Executive Committee (MS-ISAC).

In this episode of Cyber Focus, host Frank Cilluffo sits down with Sonya Proctor, Assistant Administrator for Surface Operations at TSA (Transportation Security Administration). Proctor discusses TSA's evolving role in securing pipelines and other surface transportation sectors, emphasizing the agency's expanded cybersecurity focus following the Colonial Pipeline ransomware attack. The conversation delves into TSA's partnerships with industry, other federal agencies, and state and local law enforcement to enhance critical infrastructure protection, as well as the challenges and opportunities in integrating physical and cyber security efforts.

Main Topics Covered:

• TSA's role in pipeline and surface transportation security
• The Colonial Pipeline ransomware attack and its impact
• Integration of physical and cyber security for critical infrastructure
• Collaborations with federal and industry partners
• Challenges with operational technology (OT)

Key Quotes:

"[The general public does] not typically think of TSA as having a role for pipeline security. And actually, TSA role in pipeline security goes back to the beginning of TSA." - Sonya Proctor

"I have no question that we are in this together. This is one fight. Because this threat is unlike anything they've ever seen before." - Sonya Proctor

"Our resources will grow along with the threat... They have to."- Sonya Proctor

"I was fortunate to have a relationship with [Colonial Pipeline] and to be able to communicate with them and to be able to get information from them that we were then able to share with other companies." - Sonya Proctor

"We have provided classified briefings to more operators than ever in the in the history of TSA... it was important for us to make sure that they understood the threat. - Sonya Proctor

Relevant Links and Resources:

• DHS 2025 Homeland Threat Assessment
• Recent cybersecurity advisories from TSA and DHS

Guest Bio: Sonya Proctor is the Assistant Administrator for Surface Operations at TSA, overseeing the security of pipelines, mass transit, freight rail, and highways. She previously served as Director of the Surface Division in Policy, Plans, and Engagement, and Deputy Federal Security Director at Ronald Reagan Washington National Airport. Proctor started her law enforcement career with the Washington, D.C. Metropolitan Police Department and also served as Chief of Police for the Amtrak Police Department.

In this episode of Cyber Focus, host Frank Cilluffo discusses cybersecurity priorities for the incoming administration with Mark Montgomery, co-author and leader of the Cyber Solarium 2.0 Commission, and George Barnes, former deputy director of the NSA. They delve into the McCrary Institute's new presidential transition report that presents a strategic roadmap to maintain the progress achieved in cybersecurity. The report highlights eight lines of effort, ranging from regulatory harmonization and collaboration to building workforce capacity and securing emerging technologies, with the ultimate goal of safeguarding national security and economic resilience.

Main Topics Covered:

• The purpose and composition of the transition report
• Maintaining cybersecurity momentum across administrations
• Eight lines of effort to ensure cybersecurity continuity
  • Unifying the regulatory landscape
  • Synergy in cybersecurity protection
  • Cost imposition and deterrence strategies
  • Resiliency through proactive risk reduction
  • Enhancing cyber statecraft and international collaboration
  • Building workforce capacity and volunteer support
  • Safeguarding critical and emerging technologies
  • Ensuring continuity of the economy

Key Quotes:

“Irrespective of who wins the presidency in November, cybersecurity is going to be a priority and must be elevated.” – Frank Cilluffo

“The most important thing in Washington is momentum, and to have momentum, you have to have ideas.” – Mark Montgomery

"Cyber transcends the air, land, sea space and the reality is this has implications and impact much broader from a national security and economic security perspective." – Frank Cilluffo

"You can't just sit there and defend. You actually have to put pressure and cost and position in the other direction." – George Barnes

"The one thing [autocracies] can't do well is partner. They're very transactional and domineering, as we know. And so partnerships really matter." – George Barnes

“[We] need to first achieve regulatory harmonization. You can't continue to pile requirement on requirement on the private sector without first ensuring that you're not asking them to do the same thing in five different manners.” – Mark Montgomery

Related Links:

The full report:
https://eng.auburn.edu/mccrary/pttf/

Guest Bios:

• Mark Montgomery is the leader of the Cyber Solarium 2.0 Commission, focusing on strategies to improve national cybersecurity and protect critical infrastructure, and a senior fellow at the McCrary Institute. 
• George Barnes is the former deputy director of the National Security Agency (NSA), a senior fellow at the McCrary Institute, and the Cyber Practice President and Partner at Red Cell Partners

In this episode of Cyber Focus, host Frank Cilluffo speaks with Ambassador Toby Feakin, Australia’s first Ambassador for Cyber Affairs and Critical Technologies. Feakin reflects on the evolving cyber threat landscape in the Asia-Pacific region, Australia's cybersecurity strategy, and its growing focus on balancing economic ties with China while addressing critical security risks. The conversation delves into Australia’s international partnerships, public attribution of cyber threats, and critical infrastructure protection. Feakin also shares insights into his role in spearheading Australia's cyber policy and the future of technological leadership in quantum computing, AI, and supply chain security.

Main Topics Covered:

• Australia’s evolving cybersecurity strategy and public attribution of threats like the Cloud Hopper incident
• The balance between economic ties with China and cybersecurity risks
• International partnerships with Five Eyes and regional players like South Korea and Japan
• Critical infrastructure protection, including undersea cables and cyber-kinetic threats
• The significance of China's pre-positioning cyberattacks
• Emerging technologies, including AI, quantum computing, and their impact on geopolitics
• Feakin’s role in shaping Australia’s cyber diplomacy and international engagement

Key Quotes:

"Something that Australia continually has to balance is this kind of multifaceted relationship with China... it's balancing the economic ties that you have with such a behemoth in the Asia-Pacific and globally, economically, alongside a growing understanding of security risk." - Toby Feakin

"[China's pre-positioning] absolutely should concern not just other governments, but it should concern industry because they are the guys... who own and operate a majority of infrastructure and they need to know clearly that's the level of threat they're dealing with." - Toby Feakin

"If you look at that tech convergence, you cannot afford to sit still for one second because it's all moving such a fast rate that even the developers themselves have no idea where this journey is ending up." - Toby Feakin

"[To safeguard supply chains] Australia in making much more rigorous assessments of not only where does the equipment come from, but where does the money flow from." - Toby Feakin

"Businesses need to feel comfortable in the chaos of trying out new technologies and creating right pockets of environments and business cases so that they can trial new tech and not be frightened of it." - Toby Feakin

Related Links:
 

• https://insights.sei.cmu.edu/blog/operation-cloud-hopper-case-study/
• https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
• https://www.iiss.org/publications/strategic-comments/2019/australia-huawei-and-5g/

Guest Bio:
Ambassador Tobias (Toby) Feakin served as Australia's inaugural Ambassador for Cyber Affairs and Critical Technologies. He was responsible for shaping Australia's international cyber engagement strategy and has been instrumental in fostering partnerships across the Asia-Pacific. Feakin has played a crucial role in Australia's public attribution of cyber threats and has been a key advocate for balancing technological innovation with security risks.