Tech Transforms

As technology rapidly innovates, it is essential we talk about technology policy. What better way to get in the know than to have an expert break it down for us? Meet Ross Nodurft, the Executive Director of the Alliance for Digital Innovation. Ross dives in, explaining the evolution of FedRAMP controls and the recent, giant, AI Executive Order (EO) from the White House. Listen in to find out what this EO means for the government, the industry and the workforce as the U.S. attempts to implement policy ahead of AI innovation.

Key Topics

• 04:25 Increasing security controls for cloud migration
• 07:51 Discussion about customer feedback and cloud migration.
• 12:17 Encouraging commercial solutions into federal government securely.
• 15:39 Artificial intelligence shaping policy for future technology.
• 16:54 AI EO covers critical infrastructure, AI, data, immigration.
• 22:34 Guidance on AI impact assessment and testing.
• 27:02 AI tools adoption must not be delayed.
• 30:03 Ensure AI technologies have fail-safe mechanisms.
• 32:08 Concern over rapid pace of technological advances.
• 34:29 AI and technology advancing, policy aims control.
• 39:37 Fascinating book on technology and chip history.

The Future of Government Technology: Shifting to FedRAMP High and Accelerating Cloud AdoptionShift from FedRAMP Moderate to High for Sensitive Workloads

When FedRAMP was established over a decade ago, the focus was on managing the accreditation of emerging cloud infrastructure providers to support the initial migration of workloads. The baseline standard was FedRAMP Moderate, which addressed a "good amount" of security controls for less risky systems. However, Ross explains that increasing volumes of more sensitive workloads have moved to the cloud over time - including mission-critical systems and personal data. Consequently, agencies want to step up from moderate to the more stringent requirements of FedRAMP High to protect higher-risk systems. This includes only allowing High-cloud services to interact with other High-cloud applications.

The Evolution of Cloud Computing: "So right now, we're at the point where people are existing in thin clients that have access to targeted applications, but the back end compute power is kept somewhere else. It's just a completely different world that we're in architecturally." — Ross NodurftThe Future of Government Technology: Streamlining FedRAMP for the SaaS-Powered Enterprise

According to Ross, the COVID-19 pandemic massively accelerated enterprise cloud adoption and consumption of SaaS applications. With the abrupt shift to remote work, organizations rapidly deployed commercial solutions to meet new demands. In the federal government, this hastened the transition from earlier focus on cloud platforms to widespread use of SaaS. Ross argues that FedRAMP has not evolved at pace to address the volume and type of SaaS solutions now prevalent across agencies. There is a need to streamline authorization pathways attuned to this expanding ecosystem of applications relying on standardized baseline security controls.

High-level Security Controls for Sensitive Data in the CloudAddressing Data Related to Students and Constituents

Ross states that as agencies move more sensitive workloads to the cloud, they are stepping up security controls from FedRAMP Moderate to FedRAMP High. Sensitive data includes things like personal HR data or data that could impact markets, as with some of the work USDA does. Willie gives the example of the Department of Education or Federal Student Aid, which may have sensitive data on students that could warrant higher security controls when moved to the cloud.

Ross confirms that is absolutely the case - the trend is for agencies to increase security as they shift more sensitive systems and data to the cloud. Especially with remote work enabled by the pandemic. So agencies with data related to students, constituents, healthcare, financial transactions etc. are deciding to utilize FedRAMP High or tailor Moderate with additional controls when migrating such workloads to ensure proper security and rights protections.

The Future of Government Technology: Navigating the Tradeoffs Between Cloud Innovation and Data Security

As Ross explains, FedRAMP High means you can only interact with other cloud applications that are also FedRAMP High. So there is segmentation occurring with more sensitive data and workloads being isolated via stricter security controls. However, he notes it is not a "bull rush" to FedRAMP High. Rather agencies are steadily moving in cases where the sensitivity of the data warrants it.

Willie then asks about the costs associated with these stricter cloud security authorizations, given even Moderate is expensive. Ross explains there are currently policy discussions underway about making FedRAMP more streamlined and cost-effective so that innovative commercial solutions can still sell to the government without having to completely re-architect their offerings just for these processes. The goal is balancing the accessibility of cloud solutions with appropriate security based on data sensitivity.

Modernizing Federal Government IT: "We need to stop requiring companies to have their own completely separate over architected environment. We want commercial entities to sell commercially built and designed solutions into the federal government." — Ross NodurftLaying the Groundwork: The AI Executive Order and the Future of Government TechnologyRobust Framework for Future Policy and Legal Development

Ross states that the AI Executive Order is the biggest and most robust executive order he has seen. He explains that it attempts to get ahead of AI technology development by establishing a framework for future policy and legal development related to AI. Ross elaborates that there will need to be additional regulatory and legal work done, and the order aims to "wrap its arms around" AI enough to build further policy on the initial framework provided.

According to Ross, the order covers a wide range of topics including AI in critical infrastructure, generative AI, immigration reform to support the AI workforce, and government use of AI. He mentions the order addresses critical infrastructure like pipelines, hospitals, transportation systems and more. It also covers immigration policy changes needed to ensure the U.S. has the talent to advance AI. Additionally, it focuses heavily on government consumption and deployment of AI.

Mapping the Future of Government TechnologyNavigating the Future of Government Technology

The AI executive order tasks the Office of Management and Budget (OMB) with developing guidance for federal agencies on the safe and secure adoption of AI. Specifically, Ross states that the order directs the Federal CIO and other administration officials to establish rules that allow government consumption of AI in a way that protects safety and rights. Before writing this guidance, the order specifies that OMB must consider the impacts of AI on safety-critical infrastructure as well as rights like privacy and fairness.

Ross explains that OMB recently released draft guidance for public comment. He says this draft guidance contains several key components. First, it establishes AI governance requirements, directing every major federal agency to appoint a Chief AI Officer and create an AI council with agency leadership that will oversee adoption. Second, it mandates that agencies take inventory of existing AI use and develop plans detailing how they intend to utilize AI going forward.

Requirements for Agencies to Appoint a Chief AI Officer

According to Ross, a primary governance requirement in the OMB draft guidance is that all major agencies assign a Chief AI Officer to spearhead their efforts. Additionally, he notes that the guidance orders agencies to construct AI councils with membership spanning functions like IT, finance, HR and acquisition. Ross specifies that these councils will be led by the Deputy Secretary and Chief AI Officer of each department.

The Uncertain Future of Government TechnologyCollaboration, Prioritization of Assessments, Compliance, Monitoring and Validation

Ross highlights the need for collaboration between industry and agencies to address issues like prioritization, timing, specifics of compliance, attestation and who pays for and validates assessments. The order pushes the use of AI but lacks specifics that could slow adoption of widely-used technologies with AI. Ross notes this could introduce friction, slowing productive technologies when faster digital services are demanded. Better defining compliance pathways is needed to avoid nervousness using AI.

AI Ethics and Regulation: "You've got to run as close to live testing as possible, you've got to have human people factored into the decision-making engines." — Ross Nodurft

While embracing AI, the order does not detail how to facilitate adoption. Ross says this could cause confusion across agencies. His trade association ADI sees the need to add specifics around governance mechanisms to avoid inconsistencies. The lack of clarity risks friction and slowing AI incorporation, which Ross believes is imperative.

Balancing Innovation and Responsibility in Emerging TechnologiesDemand for a Digital Environment and the Importance of Observability

Ross states that there is a quick move towards a digital environment across all services, driven by demand from millennials, Gen X and Gen Z. He emphasizes that everything needs to have an app or digital access now to engage users. Ross then highlights how Dynatrace provides important observability of these new cloud-based architectures, allowing agencies to understand usage, interactions and performance. He argues this is essential to properly managing digital services.

Ross worries that the new AI executive order guidance lacks specifics around compliance, which risks creating friction in adopting widely-used technologies like Dynatrace that have AI components. He states there is uncertainty whether tools like Dynatrace must be inventoried and assessed under the new policy. If so, there are many open questions around prioritization, timing, specific compliance activities, and who pays associated costs. Ross emphasizes that this uncertainty could hinder cloud adoption without more clarity.

Responsibility and Control Over the Use of AI Technology

Ross stresses that while AI technology enables incredible things, we have full control and responsibility over its uses. He states we must consider processes and safeguards that provide oversight and allow intervention over AI systems. Ross argues we cannot afford to deploy AI blindly, but highlights it is in our power to leverage these technologies to benefit humanity with appropriate guardrails.

Shaping the Future of Government TechnologyThe Future of Government Technology and Managing Change for Emerging Fields

Ross asserts today there is greater intention around anticipating risks from emerging technology compared to past eras. He advocates for building off switches and review processes that allow understanding and course correction around new innovations like AI. Ross states this considered approach is essential for nanotechnology, quantum computing and other exponentially advancing fields.

The Influence of Artificial Intelligence in Policy and Legal Development: "But artificial intelligence is now more than ever being built into everything that we do technologically." — Ross Nodurft

Ross disputes the concern that AI will replace jobs, arguing instead it will shift skills required by humans. He provides examples of comparable historical technology shifts requiring new expertise, like transitioning from horses to locomotives. Ross states AI moves job responsibilities in different directions rather than eliminating careers, necessitating learning new tools and approaches.

Establishing Processes and Organizational Structures for the Future of Government Technology

Ross highlights how the AI executive order establishes agency governance bodies to oversee adoption. He details required personnel like Chief AI Officers that must review and approve AI use. Ross states these processes aim to identify risks in using innovations like AI while still encouraging adoption. He argues this organizational oversight is a new paradigm essential for emerging technologies.

About Our Guest

Ross Nodurft is the Executive Director of the Alliance for Digital Innovation (ADI), a coalition of technology companies focused on bringing commercial, cloud-based solutions to the public sector. ADI focuses on promoting policies that enable IT modernization, cybersecurity, smarter acquisition and workforce development. Prior to joining ADI, Ross spent several years working with industry partners on technology and cybersecurity policy and several years in government, both in the executive and legislative branches, including Chief of the Office of Management and Budgets cyber team in the White House.

Episode Links

• Executive Order on the Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence
• FedRamp
• Turkey Gumbo Recipe
• Chip War by Chris Miller

Have no fear, your new wingman is here! AI is by your side and ready to help you multiply your abilities. Patrick Johnson, Director of the Workforce Innovation Directorate at the DoD CIO discusses how his team is working to further implement AI ethically and safely in areas such as human capital to expedite finding talent. Patrick also shares his passion for building cyclical pipelines to ensure that talent, and ideas, flow seamlessly between the government and private sector. Join us as we dive further into AI’s benefits and how government and industry can be cyber workforce innovation partners.

Key Topics

• 02:06 Lag in civilian workforce training upscaling needed.
• 03:19 Balancing talent, training and automation for better security.
• 08:22 Leaders understand AI as a force multiplier.
• 12:15 Our motivations are different; utilizing AI for advancement.
• 15:25 AI used for maintenance, scheduling, monitoring issues. Embracing technology.
• 18:35 Questioning impact of technology on workforce integration.
• 21:45 Knowledge, skills, ability, competency. Task-focused performance. Workforce coding. Qualification program ensures necessary skill sets. Tracking mechanism being developed. Vast department with skill spread.
• 25:26 Real-time data for proactive leadership and action.
• 27:05 Retention strategy includes talent competition and permeability.
• 30:36 Improving marketing for civilian DoD jobs.
• 33:49 It works for all sectors, find talent.
• 40:19 Government employees and veterans bring valuable skills.
• 41:27 Promote supply, train, partner for innovation.
• 45:33 Virtual reality: future of government services and museums.

The DoD's Cyber WorkforceCyber Workforce Improvement Is Crucial

Patrick states that the Department of Defense's (DoD's) total cyber workforce, comprising military, civilian and industry partner contractors, is around 225,000 people. He notes that the DoD has the biggest gap in the civilian cyber workforce, which makes up about 75,000 people. According to Patrick, one of the key problems when bringing new cybersecurity technologies online is failing to adequately train the existing workforce on how to use and get value from those technologies.

Training and Upscaling the Current Cyber Workforce

Rather than pursuing full re-skilling of employees which can set them back, Patrick advocates for upskilling the current DoD cyber workforce. This involves assessing talent and capability gaps. Then providing the workforce with the necessary training to perform new technologies appropriately. Patrick states that partnering workforce members with automated processes like AI can help them become more effective by highlighting key info and threats.

The Importance of Training and Upscaling in the Cyber Workforce: "Well, it's great to put new technology on the table. But if you don't take the time to train the workforce you have in the programs or the systems you're bringing online, you lose that effectiveness and you don't really gain the efficiencies or the objectives that you need to be."— Patrick JohnsonAutomation and AIAI Is Seen as a Partnership With the Human Cyber Workforce

Patrick views AI as a partnership with the human workforce rather than a threat. He emphasizes that AI should be seen as a "wingman or wingperson" that boosts productivity and acts as a force multiplier. Patrick explains that AI excels at rote, tedious tasks allowing the human workforce to focus more on creativity.

AI Helps With Rote and Tedious Tasks

According to Patrick, AI is adept at attention-to-detail tasks that would be tedious for a human to manually perform. He provides the example of a cybersecurity analyst or defender whose productivity can be enhanced by AI highlighting anomalies in data that they should pay attention to. This allows them to catch more threats and intrusions coming through their systems.

The Rise of AI and the Fear of Job Loss: "AI can expedite that and do it really fast. It's about how do you fit in and use the technology that is there. So for individuals that are bent on just being one thing or doing a particular way, it's gonna be a struggle."— Patrick JohnsonAI as a Productivity Multiplier

Patrick argues that all organizations are understaffed and says AI is like "adding a person and a half" to your existing workforce. In his view, this boosts productivity significantly if the technology is utilized correctly. He believes AI's capabilities in assisting with repetitive tasks allow human workers to focus more on creative problem-solving.

AI as a Cyber Workforce MultiplierAI Applied in Various Industries With New Jobs and Opportunities

Patrick explains that AI excels at automating repetitive, detail-oriented tasks, freeing up humans to focus on more creative responsibilities. As AI develops, Patrick believes new industries and opportunities will emerge. He references how industrial automation led to new maintenance jobs. Similarly, current AI advances likely indicate the rise of new industries needing workers to oversee AI systems.

Harnessing Talent in the Digital Age: "It'll work. If it works for cyber, why wouldn't it work for aviation, or why wouldn't it work for logistics? It's gonna work for just about any approach you wanna take."— Patrick JohnsonCurrent AI Advancements Focused On Non-creative Tasks

Willie agrees that true general AI with human-level creativity remains a distant prospect. He characterizes current AI as skilled at rote, non-creative work. While AI can simulate creativity by aggregating data, Willie argues it cannot independently demonstrate innovation as humans do. He believes consciousness and creativity constitute scientific frontiers we are far from unlocking in silicon.

Ethical Use of AI in Western SocietiesEthical Considerations in Western Societies

Patrick discusses how there is an ethical piece when it comes to AI and its use in Western societies. He notes that the DoD's Chief Digital and Artificial Intelligence Office, and their principal staff assistant, are really looking hard at the ethical use of AI. Patrick contrasts this to some of the department's peer competitors, without naming specific countries, who are not as worried about using AI ethically. He explains that in Western societies that have operated in a prosperous, peaceful way for almost 90 years, there is more concern about ethics with emerging technology like AI.

U.S. is Known for Creativity and Innovation

Patrick talks about how one of the strengths of the U.S. as a nation is the focus on creativity, innovation and free thinking. He says these characteristics allow new technologies to fully prosper and reach their potential. Unlike in some other systems where there may be more ulterior motives from the state or ruling party that limit capabilities. Patrick notes that some other countries utilize AI for better understanding their citizens, monitoring people and tracking behaviors without as much ethical concern.

AI in the Defense DepartmentDoD Exploring AI in Maintenance Schedules and Issue Tracking

Patrick notes that the Defense Department is currently using AI in enclosed systems to improve maintenance schedules and track issues. He explains that this allows them to leverage AI to expedite when certain maintenance actions need to be taken and monitor problems. While the department is still in the early stages of incorporating AI, Patrick emphasizes they are embracing it for these types of automatable tasks rather than avoiding it due to security concerns.

Embracing AI While Avoiding Security Risks

When discussing AI, Patrick acknowledges there are legitimate security worries given the sensitive nature of the Defense Department's systems and environment. However, he states these concerns should not deter the department from bringing AI capabilities to the forefront. Patrick argues the department needs to find ways to ethically and safely integrate AI so it does not pose risks. He mentions this is an area of focus for the Chief Digital and Artificial Intelligence Office.

The Role of AI in Cybersecurity: "It really is about looking at your talent and your gaps and then giving them the training they need to execute the new technology, appropriately."— Patrick JohnsonAI Used to Automate Human Capital Tasks

In terms of human capital functions, Patrick highlights how the department is already employing AI to streamline and automate certain talent management processes. For example, he explains they are using AI-enabled systems to expedite applicant-job matching and make hiring more efficient. Additionally, Patrick notes AI is helping align training offerings and certifications to the workforce skill gaps the department needs to fill. He emphasizes these applications demonstrate the promise of AI in automating tedious tasks that would normally take humans much longer to accomplish manually.

Measuring Impact and Maintaining Cyber Workforce Technology BalanceUsing AI to Measure Program Impact

Patrick explains that they are using AI to track metrics like attrition rates, vacancy rates, losses and gains. This allows them to do predictive analysis to project future vacancy rates and take proactive action when needed. For example, Patrick can put up real-time data for leadership showing that if no action is taken, vacancy rates could rise from 17% to 37% in two years. This prompts leadership to address gaps proactively before problems become severe. Patrick envisions AI having an even greater impact by identifying talent gaps across the department and giving the services enough lead time to ramp up training programs accordingly.

Balancing Cyber Workforce and Technology

To balance workforce and technology, Patrick emphasizes the need to train the current workforce on new systems and technologies rather than expecting them to instantly adapt. He uses the example of implementing Zero Trust security, noting that deploying the technology alone is not enough if the workforce is not properly trained to leverage and maximize it. Patrick believes AI should be viewed as a "wingman" to augment human capabilities rather than replace jobs. Proper AI integration requires change management and culture change around utilizing automation.

Tracking Skills With 8140 Qualification Program

The 8140 qualification program tracks skillsets needed to perform critical cyber work roles across the department. By coding the entire military and civilian cyber workforce with work roles rather than just competencies, they gain visibility into the location of talent gaps. Work roles also allow them to incentivize critical positions rapidly. As they collect more workforce data, this program will enable sophisticated predictive analytics to get ahead of future talent and skill deficits.

About Our Guest

Mr. Patrick Johnson serves as the Director of the Cyber Workforce Management Directorate in the Office of the Deputy CIO for Resources and Analysis, Department of Defense (DoD) CIO.

In his role as Director, Mr. Johnson leads a dynamic team responsible for the Directorate’s expansive workforce management portfolio and program development supporting the broader talent management lifecycle for the Department’s cyberspace workforce. Directorate initiatives include the DoD Cyber Workforce Framework (DCWF) expansion, training and education program development (Cyber Scholarship, Cyber Exchange, etc.), Cyber Workforce Management Board (CWMB) facilitation, Cyber Excepted Service (CES) Personnel System, and the 8140 policy series implementation which establish enterprise baseline standards and requirements according to DCWF work role(s). At the OSD level, the Cyber Workforce Directorate's role is to leverage authorities and provide Department stakeholders with policies, programs, and tools to effectively recruit and retain a highly skilled cyberspace workforce.

Mr. Johnson previously served as the Chief, DoD Cyber Excepted Service where his leadership played a pivotal role in the development and implementation of the Cyber Excepted Service Personnel System, and ultimately mission expansion into today’s Cyber Workforce Directorate.

Mr. Johnson entered federal service in 2011, following more than 24 years of service in the U.S. Army. Prior to becoming the Director of the DoD CIO Cyber Workforce, Mr. Johnson served in a variety of positions in the Department, rising to his position today from his first role as Intelligence Combat Developer, with the U.S. Army Intelligence and Security Command (INSCOM). In his expansive civil service career Mr. Johnson has also served as Deputy Director, Military Personnel DLA; Cyber Integrator, OSD Personnel and Readiness (P&R); Senior Program Manager (Retention), Deputy Chief of Staff Army G-1.

Mr. Johnson spent his early career in the U.S. Army, serving as a Military Policeman, Protective Service Agent, Military Police Investigator, and Career Counselor culminating in his role as Special Liaison with U.S. Army Intelligence Support Activity within the Joint Special Operations Command (JSOC).

Episode Links

• Tech Transforms Ep. 69 with Jon Pelson
• Guardians of the Galaxy Vol. 3
• Star Wars VR Games

Meet the man on a mission to make software bill of materials (SBOMs) boring. In this So What? episode, Tracy Bannon and Carolyn Ford sit down with Allan Friedman the Senior Advisor and Strategist at the Cybersecurity and Infrastructure Security Agency (CISA). Allan tells us about how he is working to change how all software on the planet is made and sold, no big deal right? Join us as we dive into the world of SBOMs, xBoMs, and Secure by Design.

Key Topics

• 03:59 Track open source licenses, establish shared vision.
• 08:47 Discussing US government requirements, diversity in software.
• 12:07 Framework helps organizations with secure software development.
• 13:49 Organizations unaffected, prepare for impending software changes.
• 17:40 Concerns about sharing software with potential security risks.
• 20:59 Concerns about network security and regulatory pushback.
• 24:14 Enhanced security measures save thousands of hours.
• 27:53 Applying AI and data bombs in conversation.
• 32:38 Discusses the importance of SBOM in cybersecurity.
• 36:29 Rewriting global code is a complex task.
• 39:39 At RSA, little focus on secure design.
• 41:53 Organization's need for SBOM, call to action.
• 43:55 Cooking for diverse family, diverse food requirements.

Challenges and Implementation of SBOMsSelf-Attestation for SBOMs

Allan Friedman explained that there is currently a self-attestation model for SBOMs, where companies can sign a form stating that they have implemented SBOMs, rather than providing the actual SBOM data. This allows flexibility for organizations that are not yet ready to fully comply. However, it means buyers have to trust the attestation rather than seeing the SBOM details directly.

Secure Software Development Model Compliance: "The challenge there is turning the framework back into a compliance model. Because, again, at the end of the day, everyone wants to think about things. Right? Understand your risk, but you still need to make that yes or no decision."— Allan Friedman

Tracy Bannon noted some companies have concerns about sharing their SBOM data with customers, worrying that the customer may not have secure enough practices to properly protect the SBOM. Allan Friedman explained SBOMs do not need to be public - they can be shared privately between supplier and customer. Known unknowns in the SBOM can also help address concerns about revealing proprietary information.

Debate About the Risk of Sharing SBOMs as a Road Map for Attackers

Allan Friedman argued that sophisticated attackers likely do not need the SBOM, as they have other ways to analyze and reverse engineer software. Automated attacks also do not leverage SBOMs. He noted defenders actually need the visibility an SBOM provides into components and dependencies. There may be some risk of exposing attack surface, but the benefits seem to outweigh that.

The Importance of SBOM for Product Security: "If we had this, we had SBOM across our products today, it would save us thousands of hours a year Because whenever the next Log4j comes out, if you have a centralized machine readable, scannable system, It's not that hard." — Allan Friedman

Allan Friedman noted there has been some lobbyist pushback against SBOM mandates, often coming from trade associations funded by companies already implementing SBOMs. He said while healthy debate is good, many of the lobbyist complaints seem misguided or overblown.

The Potential Role of AI in Creating SBOMs and Its Implications for Security

Carolyn Ford asked whether AI could help automate SBOM creation, especially for legacy systems. Tracy Bannon cautioned that AI is not yet at the point where it can reliably generate code or understand large complex contexts. AI may eventually assist, but currently is not ready to take on SBOM tasks. As AI is software, it needs to be secured using the same best practices as other code.

Tracy Bannon explained SBOM implementation may be harder for organizations with large legacy codebases and multiple complex or siloed systems. However, even newer companies can struggle if they have not built SBOM processes into their SDLC. Allan Friedman noted while costs exist, especially for older systems, SBOMs ultimately save defender time and money.

Benefits of Better Engineering Processes

Allan Friedman said some organizations view SBOM mandates positively, as it gives them budget and justification to reengineer antiquated processes. Overall, SBOMs provide incentives and reasons to follow modern secure software practices.

Tracy Bannon emphasized that any mandated change involves costs, which need to be acknowledged. But driving adoption of SBOMs and secure development practices is still an important improvement goal. Organizations should be supported in this transition.

Government Requirements and StandardsComplexities of US Government Requirements for Software

Allan explains that the executive order issued requirements that all software sold to the US government would need to meet certain security practices, like having separate development and build environments and using multi-factor authentication. While these may seem basic, turning the NIST framework into concrete compliance requirements has been challenging. The government pushed for a quick definition of SBOMs, while agencies said it would take months. There's a need to balance the push for progress with the realities of implementing changes across complex legacy systems.

Open Source License Tracking: "And if you're an organization, you need to track which open source licenses are you using both in your open source and your code because there are strong rules for some of them."— Allan Friedman

For some parts of the software world, Allan notes that SBOMs are already considered standard practice. Modern developers with continuous integration pipelines can easily generate SBOMs automatically. The challenge is bringing along the organizations still using legacy tools and processes. Widespread adoption will take time. The goal is for SBOMs to become a boring, expected part of software delivery that doesn't require much discussion.

Timeline and Process Following the Executive Order

The 2021 cybersecurity executive order mandated the use of SBOMs but didn't define what they were. After pushing for a faster timeline, the government issued a minimum definition of SBOMs within 60 days. NIST then updated their secure software development framework with guidance. The next step is moving from framework to compliance model, with self-attestation as a starting point until more formal requirements are in place across agencies.

The executive order mandated SBOMs but didn't define them, so the government had to quickly issue a minimum definition of what constitutes an SBOM. This was a challenging process that required balancing perspectives from across government and industry. The public and private sectors need a shared understanding of what SBOMs are as adoption spreads.

Concerns and SolutionsConcerns From Corporations and Suppliers About Revealing Proprietary Information

Allan acknowledges there are concerns from some corporations and suppliers that providing an SBOM could reveal proprietary intellectual property or special sauce in their software products. Many organizations want to avoid exposing their competitive advantage or secret methods. Allan says the SBOMs do not need to be public - they can be shared directly and privately with the customer purchasing the software. There are also ways to designate known unknowns or gaps in the SBOM data.

The Importance of Software Bill of Materials (SBOM): "We're building the plane while we're flying it."— Allan Friedman

Tracy raises the concern she has heard that requiring companies to share SBOMs with customers could potentially expose their intellectual property if those SBOMs are not properly secured. She notes there have been many high-profile data breaches lately. This means vendors may be wary about sharing an SBOM with a customer if they lack confidence in that customer's data security practices. There needs to be trust between the entities exchanging SBOMs.

Claims Regarding the Majority of SBOMs Content Not Being Secretive

In response to concerns about IP exposure, Allan argues that for most large software projects, the bulk of what is contained in an SBOM does not represent core proprietary IP or secret sauce. As an example, he says that just listing common third-party libraries used does not reveal a competitive advantage. So fears may be overblown about SBOMs leaking meaningful intellectual property.

Given the valid concerns around proprietary code exposure and SBOM generation limitations, Allan advocates for the concept of designating "known unknowns". This would allow software providers to specify areas of the codebase or supply chain that have incomplete SBOM data due to proprietary restrictions or tooling gaps. Known unknowns enable transparency about the boundaries of SBOM coverage.

Software Supply Chain Security and SBOMsBuffer Overflows and Memory Unsafety in Programming Languages

Allan Friedman explained that a large percentage of vulnerabilities arise from memory issues. Buffer overflows are a simple example, but there are thousands of variants that allow attackers to execute malicious instructions by tricking a system into accessing attacker-controlled memory regions. This memory unsafety occurs primarily in languages like C and C++ that lack memory safety protections.

Given the risks from memory unsafety, Friedman discussed CISA's vision of pushing more secure software development through the use of memory-safe languages. Languages like Rust and Go provide memory safety protections that prevent common categories of vulnerabilities. However, rewriting major legacy codebases will take time. CISA is exploring partnerships and incentives to accelerate adoption of memory-safe languages over the long term.

Group Dealing With a Large ADA Code Base and Other Languages

Tracy Bannon noted that some organizations, unfortunately, cut budgets by avoiding automated testing in favor of manual testing. But requirements like SBOMs remove excuses to not invest in automated processes and improved engineering.

Tracy Bannon mentioned there are ongoing conversations with the Department of Defense around extending the SBOM concept to data through "data bombs." While AI and algorithms are software, data artifacts like model cards and data cards also need supply chain transparency.

Bannon highlighted that she works with a group managing a complex codebase including not only a substantial amount of ADA, but 13 other languages layered onto the system. This exemplifies the challenges of legacy systems.

Friedman explained that CISA's director and CISO have been pushing the secure by design initiative to make software more inherently secure out of the box. He provided examples like moving away from hardening guides and instead selling software locked down, with optional integration instructions.

About Our Guest

Allan Friedman is a Senior Advisor and Strategist at the Cybersecurity and Infrastructure Security Agency (CISA). He coordinates the global cross-sector community efforts around software bill of materials (SBOM). He was previously the Director of Cybersecurity Initiatives at NTIA, leading pioneering work on vulnerability disclosure, SBOM, and other security topics. Prior to joining the Federal government, Friedman spent over a decade as a noted information security and technology policy scholar at Harvard’s Computer Science Department, the Brookings Institution, and George Washington University’s Engineering School. He is the co-author of the popular text Cybersecurity and Cyberwar: What Everyone Needs to Know, has a C.S. degree from Swarthmore College, and a Ph.D. from Harvard University.

Episode Links

• Executive Order on Improving the Nation’s Cybersecurity
• CISA’s Software Bill of Materials (SBOM) Page
• CISA Blog from Christine Lai and Dr. Jonathan Spring
• Allspice Dram in Cocktails

In the final, crossover episode of our three-part Halloween series, Eric Monterastelli, Public Sector SE at Delinea, Founder, Crew Chief of Gran Touring Motorsports and Host of the Break/Fix Podcast, joins Carolyn Ford and Tracy Bannon to discuss the scary reality of car security. Is your car spying on you? Can a nefarious actor take over your car? Does your car know your deep personal data like your immigration status, race and more? Hint: It can and it does.

Key Topics

• 00:02:05 Technology advances put vehicles at risk.
• 00:06:25 Hijacked Jeep's wireless signal, turning it off.
• 00:07:35 Chrysler systems hacked due to digital admission.
• 00:10:47 New EV platforms streamline technology for efficiency.
• 00:15:13 Disconnect, purge and be careful: data can be accessed.
• 00:18:58 Using TrueCar, author obtained personal information illegally.
• 00:21:54 Pre-OBD2 Mercedes is OBD1.
• 00:25:12 Mozilla uncovers alarming auto data collection.
• 00:28:29 Future vehicles will have integrated alcohol-detection systems.
• 00:32:48 Routers, cars can be hacked, collect data.
• 00:35:42 Read your vehicle's owner's manual for instructions.
• 00:36:55 Speak to rental clerk about removing data.

The Intersection of Cybersecurity, Car Security and the Ghostbusters MissionGhostbusters Mission: Car Security & Car Hacking

Eric Monterastelli talks about how cars have evolved to include more computing technology, which opens them up to potential attacks. He gives the example of a Jeep that was hacked to shut off while driving, demonstrating the real dangers.

Tracy Bannon contrasts U.S. car manufacturers that use many third-party components versus Tesla's more integrated system. She argues Tesla's approach may lend itself to more car security. The hosts explore different potential attack vectors into vehicles, like Bluetooth connections.

Mozilla Participants Share Automotive InfoSec Insights

Eric Monterastelli shares findings from a Mozilla report about the wide range of deep personal data that can be collected from cars. Including things like facial expressions, weight, health information and more. The hosts are alarmed by the privacy implications.

Tracy Bannon advocates that car manufacturers need to make cybersecurity a priority alongside traditional safety. She indicates cars are data centers on wheels, collecting information that gets sent back to big cloud data centers. They emphasize the need for vigilance from car owners about what information they allow their vehicles to collect.

Concerns About Data Collection in Modern VehiclesModern Car Security: Braking, Speed and Steering Patterns

Eric discusses the extensive data that is now collected by modern vehicles, especially EVs. He notes that information is gathered on things like stopping distances, brake pressure applied, vehicle speed and overall driving habits. This data is no different than the type of driver performance analysis done in race cars. Automakers are collecting real-world usage data from customer vehicles to analyze driving patterns and vehicle responses. Tracy adds that the average new vehicle contains over 100 different computers and millions of lines of code that are all networked together. This networked data covers areas like powertrain functions, safety features and infotainment systems. All of this interconnected data presents opportunities for tracking very detailed driving behaviors.

Privacy Risks in Driving: Collecting Personal Data and Concerns

Eric cites a concerning report that modern vehicles can potentially collect extremely sensitive personal data simply through normal driving. Including information on immigration status, race, facial expressions, weight, health conditions and even genetic data. He explains that optical facial recognition software could be applied to cameras already present in many vehicles. Other data like weight and health metrics can be gathered from sensors in seats or wearable devices synced to the vehicle. The interconnected nature of modern vehicle computers and far-reaching data collection enables mining of very private user information that goes well beyond basic driving statistics. Carolyn reacts with disbelief at the potential extent of personal data gathering described.

Car Security Comparisons Between Traditional Manufacturers and TeslaChallenges in U.S. Car Manufacturing Component Compatibility

Tracy explained that traditional U.S. car manufacturers have said they use components from hundreds of different distributors and providers. These components were not necessarily created to work together, unlike the approach taken by Tesla. Since traditional manufacturers are buying piece A and knitting it together with piece B, piece C and piece D, there can be integration challenges. The components may not align well since they were not designed under the same umbrella with a holistic approach.

Comparing Tesla's Integrated Approach to Enhance Car Security

Tracy contrasted the traditional manufacturers' approach with Tesla, which has created everything under one umbrella. Tesla told any component providers what the requirements were and how the components needed to align to what Tesla needed. This holistic approach within Tesla results in more seamlessly integrated and likely more secure vehicles compared to cobbling together components from many different organizations.

Tesla's Privacy Concerns: "But Tesla, there's been reports and there's been investigations showing that they can turn on the cameras inside the car and see what you're doing. They've been spying on people. There's been all sorts of allegations that have been thrown out there." — Eric MonterastelliCombining Car Parts from Various Sources Raises Security Risks

Eric and Tracy discussed how having disparate systems talking over a common bus and language can introduce vulnerabilities. While a proprietary closed system like Tesla's may have risks if it is fully hacked. Assembling many components from different providers can also have downsides. There are more potential holes or vulnerabilities when piecing together parts from various organizations. Compared to having everything designed and built under one umbrella.

Integration of Systems in Modern CarsUnified Mainframe Powers Modern Electric Vehicles, Replacing Separate Components

Eric discusses how newer electric vehicles like Teslas, Ford Mach-Es, and Porsches have a single mainframe that controls and interacts with all the components of the vehicle. In contrast, older cars had separate systems for the engine/drivetrain and infotainment that did not necessarily communicate with each other. For example, in a 2000s Chrysler, the infotainment system running the radio was separate from the encrypted Bosch system controlling the engine. Integrating all these components into one mainframe makes the new electric vehicles more convenient but also introduces potential vulnerabilities.

Single Computer Control and Car Security Vulnerabilities Explored

Tracy elaborates that the average new car today has over 100 different embedded computers. plus modules networked together and communicating via a CAN bus system. So there is one central computer that can interact with the engine, transmission, safety systems and infotainment features. While this integration is designed for efficiency and effectiveness of the software systems, it also means one access point can potentially control multiple components of the car. This is different from older cars where systems were more isolated from each other. The interconnectedness makes modern vehicles potentially more susceptible to cyber attacks.

The Vulnerabilities of Modern Vehicles: "For me, that's a scary reality. And it actually has shied me away from buying the newest of the new cars even though there are some really exciting things out there because what am I opening myself up to, if I buy a Ford Mach-E or a Tesla Model 3 or something else." — Eric MonterastelliVulnerabilities and Risks in Modern CarsIntegrating ML and AI into Cars through Computing Advancements

Eric discussed how cars have evolved significantly in engineering since the early 1900s. He highlighted that around 2000, more powerful computing technology like ML and AI computers were integrated into vehicles to make decisions about engine performance and interact with various systems. This advancement allowed for additional "creature comforts" in cars. But also opened them up to potential attacks and vulnerabilities that older cars did not face.

Future of DUI Prevention: "It's gonna become standard issue like power windows and remote locks and things like that where you're not even gonna be able to drive and operate a vehicle if it senses that you're in any way inebriated or under the influence." — Eric MonterastelliModern Vehicles' Complexity Heightens Vulnerabilities and Security Risks

Eric further acknowledged that consolidating disparate systems into one mega computer, while making things more convenient, also introduced vulnerabilities. With everything controlled by one mainframe, the attack surface is larger. He contrasted modern vehicles to cars from the mid-2000s, where engines were still separate from entertainment systems. Now they are fully integrated, which provides more connectivity but less isolation among components.

The Electric Vehicle Boom and Its Impact on Digital Systems

According to Eric, the rise of electric vehicles has led to even more potential issues, as they rely even more heavily on electrical systems and digital connectivity like over-the-air updates. Features that make EVs exciting also make them more susceptible to cyber threats compared to traditional internal combustion cars. The reality that EVs open owners up to unknown risks has made Eric shy away from the newest vehicles.

Differences in Car Security Among Manufacturers Contrasting Tesla and Porsche Systems: Unified Communication vs. Proprietary Approach

Eric compared Tesla's interconnected systems to Porsche's components from various suppliers like Bosch. He said Tesla has full access to proprietary systems through the air, while Porsche uses a CAN bus for disparate systems to communicate. The closed nature of Tesla's system makes it completely open to them.

Tracy added more context, mentioning Porsche is connected to VW and Audi, who work with Bosch for many electromechanical parts like sensors and multifunction interfaces. She reiterated that these disparate systems in Porsche communicate via a CAN bus system.

Eric acknowledged Tracy's point that both brands use a CAN bus for the back-end electrical system. However, he still sees more risks with Tesla having full access to a closed proprietary system through the air versus Porsche's various supplier components that don't directly communicate beyond the CAN bus.

Risks of Personal Data Storage in CarsStoring Personal Data in Car Infotainment Beyond Phone Disconnect

Tracy explained that even after disconnecting your phone from a car's infotainment system, personal data like contacts and GPS history can remain cached in the system. She warned that simply pressing "disconnect" does not purge the infotainment system of your data. Eric added that unless you fully wipe the system, your data remains stored even after trading in or selling your car. He gave the example of someone pulling a used head unit from a junkyard car, and upon powering it up having full access to the previous owner's contacts and address history.

Cyber Security Perspective on Data Collection in Cars: "They can collect deep personal data such as sexual activity, immigration status, race, facial expressions, weight, health, and genetic information while you're driving." — Eric MonterastelliCar Disposal Doesn't Ensure Personal Data Erasure from Head Unit

Tracy shared that her husband takes extensive precautions to prevent others from accessing personal data, such as degaussing old hard drives before disposal. She explained these same precautions should be applied to cars, since simply trading in or scrapping a car does not mean personal data is removed from components like the infotainment system. Eric affirmed this concern, stating that short of an EMP blast, data remains recoverable from the car's memory chips even after the car changes owners. He advised thoroughly wiping car systems before sale to prevent exposing personal information.

About Our Guest

Eric Monterastelli is the Public Sector SE at Delinea, Founder and Crew Chief of Gran Touring Motorsports and Host of the Break/Fix Podcast. He has more than 18 years of experience in information technology, specializing in systems engineering, virtualization and software development. His previous stops include Dynatrace, BAE Systems, Raytheon, the Department of Defense, LogRhythm and Symantec, among others.

Episode Links

• Break/Fix Podcast
• Andy Pilgrim Episode of Break/Fix Podcast
• Mozilla Article on Car Privacy
• Tech Transforms Halloween Series Episode 1
• Tech Transforms Halloween Series Episode 2

In the second episode of our 3-part Halloween series, Grant Schneider, Senior Director of Cybersecurity Services at Venable and former federal CISO, discusses the frightening implications of insider threats, how we are protecting critical infrastructure, and what it was like working on cybersecurity in the White House under both President Obama and President Trump.

Key Topics

• 00:03:59 Increased consequences led to rise of cybersecurity
• 00:08:47 Insider threat, screening, hiring, malicious actor, Manning, Snowden
• 00:09:53 Snowden challenges legality of government surveillance
• 00:15:00 Adversary gains access, steals information, demands ransom
• 00:19:19 Different levels of readiness present challenges
• 00:23:15 Helping clients & coalitions for cybersecurity policy
• 00:24:58 Consistency in technology and cybersecurity under past presidents
• 00:27:47 Cybersecurity is like warfare or terrorism
• 00:32:30 AI tools and data drive persuasive information
• 00:34:50 National Cybersecurity Awareness Month raises awareness on cybersecurity and encourages action to protect businesses
• 00:42:40 Diversity of experiences leads to career growth
• 00:44:01 Adaptive, willing, and able to learn

Introduction to National Cybersecurity Awareness MonthPurpose of Raising Awareness About Cybersecurity

Grant explained that one of the great things about National Cybersecurity Awareness Month is exactly raising awareness and providing an opportunity to hopefully spend time thinking about and discussing cybersecurity. He noted that for organizations already focused on cybersecurity daily, the awareness month may not raise their awareness much more. However, many organizations don't constantly think about cybersecurity, so for business leaders and executives who may now recognize the existential threat a cyber incident poses, the awareness month offers a chance to have important conversations they may have previously avoided due to lack of understanding.

National Cybersecurity Awareness Month: "You're only one bad kind of cyber incident away from your organization not existing anymore."— Grant SchneiderOpportunities for Organizations to Have Conversations About Cybersecurity

According to Grant, leaders who don't grasp cybersecurity risks may personally fear initiating conversations to ask what the organization needs to do to address risks. National Cybersecurity Awareness Month provides an opportunity for these leaders to have the necessary conversations and gain education. Grant said the awareness month is a chance to discuss basics, like implementing multifactor authentication, patching and updates. He observed that much of the content produced for the awareness month focuses on cybersecurity fundamentals, so it allows organizations to dedicate time to shoring up basic defenses. Overall, Grant emphasized National Cybersecurity Awareness Month facilitates essential cybersecurity conversations for organizations and leaders who otherwise may not prioritize it consistently.

Evolution of Insider Threat in the Intelligence CommunityScreening Out Bad Actors During the Hiring Process

Grant explains that in the early days of his career at the Defense Intelligence Agency (DIA), insider threat mitigation focused on screening out bad actors during the hiring process. The belief was that malicious insiders were either people with concerning backgrounds trying to get hired, or nation-state actors attempting to plant individuals within the intelligence community. The screening process aimed to identify and reject potentially problematic candidates.

Nation-State Actors Planting Individuals Within the Community

He mentions the possibility of nation-state actors attempting to plant malicious insiders in the intelligence community through the hiring process. This underscores the perceived risk that foreign governments would try to insert spies or saboteurs into the ranks of U.S. intelligence agencies.

Shift Towards Insiders Becoming Whistleblowers

Grant then discusses how over time, the nature of insider threats shifted more towards insiders becoming whistleblowers driven by ideology or moral objections. He cites the Manning and Snowden cases as examples of this shift. Rather than foreign plants, these were trusted insiders who went on to leak classified information out of claimed conscience.

Importance of Not Making Negative Generalizations About Whistleblowers

While describing this evolution, Grant is careful not to make generalizations condemning all whistleblowers. He maintains that whistleblowing serves an important function in society.

Snowden’s Different View on the Community’s Work and His Actions

In Snowden's case specifically, Grant characterizes his mindset as believing the intelligence community's lawful work was actually wrong. This led Snowden to take matters into his own hands by leaking classified materials.

Importance of Diversity of Experiences for Personal and Professional GrowthActively Seeking Out Different Experiences Within Current Role

Grant emphasized the importance of seeking diversity of experiences, even within one's current job. He advised not constantly changing jobs, as that may look unfavorable on a resume. However, within a role, one should actively volunteer for new projects and tasks that provide exposure to different skills. Being willing to say "yes" and take on unfamiliar work leads to becoming a more versatile, well-rounded employee.

Saying Yes to New Opportunities

Grant recommended that when presented with new opportunities at work, such as a manager asking for someone to work on a certain project, the best approach is to always say yes. Even if the work does not seem interesting or relevant, accepting the challenge provides a chance to learn new skills. Saying yes demonstrates eagerness to expand one's capabilities.

The Importance of Diversity of Experiences: "Diversity of experiences, and whatever it is you're working on, when your boss, your coworkers say, hey, we're looking for someone to work on this, always say YES. I wanna go work on that as well."— Grant SchneiderBecoming a Well-Rounded Employee and Leader

According to Grant, embracing diverse experiences allows professionals to build unique skill sets and make themselves stand out. Having broad exposure equips individuals to work effectively on varied teams and projects. It enables adaptability that makes one a more valuable contributor. Grant emphasized that diversity of experience helps shape well-rounded leaders who can thrive in any environment.

View Work and Life as a Scavenger Hunt for Acquiring Skills

Grant suggested viewing one's career progression as a scavenger hunt to collect talents and capabilities. Being strategic and purposeful about pursuing different opportunities maximizes growth. Grant urged professionals to reflect on the skills they want in their toolbox and then leverage jobs and other life experiences to intentionally develop expertise across multiple areas.

The Consequences of Cyber Incidents and the Growth of CybersecurityIncreased Consequences of Cyber Incidents

As Grant explained, when he first joined DIA, there were no connections to the unclassified internet in the building. Over time, every employee had both unclassified and classified computers to connect to various networks. As more devices were connected to networks, the potential consequences of a cyber incident grew. With more reliance on technology and interconnected systems, a cyberattack could cause major disruptions to operations. Grant noted that this increase in risk led to a greater focus on cybersecurity within both government and private sector organizations.

The Consistency of Approach Towards Technology and Cybersecurity across Administrations: "In my opinion, technology and cybersecurity has not been very politicized. And really going back from Bush to Obama, to Trump and to Biden, in my opinion, we've seen a good bit of consistency around the directions, the people have been headed."— Grant SchneiderCreation of Dedicated Security Operations Centers

Grant discussed how the growing risks from cyber incidents led to the creation of security operations centers focused on monitoring threats. Whereas IT operations teams had previously handled security, cybersecurity emerged as its own discipline requiring specialized skills and 24/7 vigilance. Organizations established dedicated security operations centers tasked with detecting and responding to security events around the clock. This represented a major shift as cybersecurity transitioned from a purely policy function to an operational capability within organizations.

Cybersecurity as a Distinct Operational Entity in Public and Private Sectors

Over the years, cybersecurity evolved from an information security policy role to a distinct operational entity, according to Grant. This transition occurred in both the public sector and private sector as the nature of threats changed. Cybersecurity is now recognized as requiring its own set of skills and continuous monitoring separate from traditional IT operations. Grant noted that this shift has continued with cybersecurity capabilities and staffing growing significantly across sectors.

Understanding and Manipulating Information in CyberspaceIncreasing Availability of Data and AI Tools

Grant discussed how there is more and more data available now as compared to the past. He also mentioned how AI tools allow people to analyze and understand this data in new ways. For example, AI can help determine what information or messages are most likely to resonate with someone based on what is already known about their views and preferences. Grant suggested that the combination of more data and better AI-enabled analysis means information can be tailored and targeted to individuals in new ways, for good or bad purposes.

Delivering Messages That Resonate With Individuals, Regardless of Truth

Building on the availability of data and AI tools, Grant noted how messages can now be crafted in a customized way for each person. He said that tools allow understanding of what is believable to each individual. Then messages can be created that align with existing beliefs and preferences, regardless of whether the messages are factually true. Grant gave the example that false information could potentially be spread this way if the content resonates with what someone already thinks.

Society’s Acceptance of Divisive and Blunt Opinions

Grant suggested that technology capabilities enabling tailored messaging are emerging alongside the increased societal acceptance of divisive, controversial and blunt opinions being shared publicly. He noted that norms seem to have changed from when there were more things people didn't express out loud. Grant proposed that this societal shift combined with technological capabilities that can take advantage of divisions creates risks in terms of information manipulation.

About Our Guest

Grant Schneider’s entire 30-year career has focused on our nation’s security. Grant spent more than 20 years at the Defense Intelligence Agency, seven of which he served as the CIO. He then spent six years in the Executive Office of the President during the Obama and Trump administrations, focused on all aspects of federal and critical infrastructure cybersecurity. During that time, he served as a Senior Director for Cybersecurity Policy on the National Security Council staff and most recently as the Federal CISO. For the past three years, Grant has served as Senior Director of Cybersecurity Services at Venable, helping companies from across all sectors enhance their cybersecurity programs through the development and implementation of risk management programs as well as assisting with the preparation, response, and recovery from various cyber incidents, including ransomware.

Episode Links

• Colonial Pipeline hack
• Live Free or Die Hard
• Alliance for Digital Innovation

In the first episode of our 3-part Halloween series, Dave Egts, Mulesoft Public Sector Field CTO at Salesforce, details what's scaring the public sector most and how Salesforce is utilizing - and securing - AI to improve customer experience with their Einstein Trust Layer. Additionally, Carolyn and Dave dive into the spooky worlds of brain cell chips, mind-reading AI and more.

Key Topics

• [02:17] Starting the Dave & Gunnar Show
• [04:14] Dave's Role At Salesforce
• [05:18] What's Scaring the Public Sector Most?
• [10:22] Ways Agencies are Attracting Talent
• [13:56] How Agencies Are Handling Legacy Systems
• [15:45] What MuleSoft Does & Generative AI's Role
• [22:44] Salesforce's Einstein Trust Layer
• [29:21] PoisonGPT
• [36:07] Brain Organoids & Other Spooky, Ethically Questionable Experiments
• [42:15] Tech Talk Questions: Halloween Edition 

Quotable Quotes

Considerations for the Public Sector While Using AI: "As you're going on your AI journey, you've got to be looking at the EULA [End User License Agreement] and making sure that, okay, if I give you data, what are you going to do with it?"

On Bias & Disinformation in Generative AI: "There were some previous studies that show that people are more likely to go with the generative AI results if they trust the company and they trust the model. So it's like, 'Oh, it came from Google, so how can that be wrong?' Or 'I'm trusting the brand,' or 'I'm trusting the model.'"

About Our Guest

David Egts is MuleSoft’s first-ever Public Sector field CTO. Outside of MuleSoft, David is the founding co-chair of the WashingtonExec CTO Council, where he advises numerous companies on working with the public sector. David has received numerous industry-wide recognitions, including as an FCW Federal 100 winner, a FedScoop 50 Industry Leadership awardee and one of WashingtonExec’s Top Cloud Executives to Watch. He has won multiple employee honors from Red Hat, Silicon Graphics and Concurrent Technologies Corporation.

Episode Links

Dave & Gunnar Show Episodes

• Episode 165- If you can’t measure it, you can’t manage it
• Episode 185- In Your Brain, Nobody Can Hear You Scream
• Episode 227- Meetings and Punishment
• Episodes 248 & 249- Stay tuned to the Dave & Gunnar Show for these episodes to go live

Additional Links

• Minority Report 
• Cuyahoga Valley National Park
• Flowers For Algernon

In this So What? episode, Jon Pelson, author of the best-selling book "Wireless Wars," discusses China’s impact on the telecommunications space. He also shares the frightening security concerns around Chinese components in 5G networks and discusses why the FCC's ban on these components may not be enough.

Key Topics

• [01:30] China's Success in the Telecom Industry
• [05:12] China's Grip on 5G
• [08:29] Are Your Communications Ever Private?
• [13:00] The Influence of Technology
• [15:53] What Would Happen if China Got Control?
• [19:20] FCC Ban on Chinese Components
• [24:50] Huawei's Placement Strategy
• [30:05] Is the FCC Ban a Good Start?
• [38:42] How America Takes Back Control
• [44:51] Tech Talk Questions

Quotable Quotes

On Huawei's Tower Placement: "Our nuclear missile bases, our special operations command at the nuclear sub base are all served by Huawei cell equipment." I said, 'That's impossible. They have like 0.1% market share. How could they have every nuclear missile site?' I started looking into it. The reason I called the book 'Wireless Wars' is because it's a war that's being fought through what appears to be business means. This is not business." -Jon Pelson

On Why We Should Protect Data: "People say, 'I have nothing to hide.' Especially the younger generation says, 'Look, my privacy, in that regard, is not that important.' I was asked at the end of an interview, 'What would happen if China got control over us the way they're trying to?' I said, 'You don't have to scratch your head and do scenario planning. Look at places where China has control over the population.' -Jon Pelson

About Our Guest

Jon Pelson spent nearly 30 years working as a technology executive, including serving as vice president at Lucent Technologies and chief of convergence strategy for British Telecom. His work with China’s telecom industry during this time led Pelson to write his best-selling book "Wireless Wars" China’s Dangerous Domination of 5G and How We’re Fighting Back."

Episode Links

• The Kill Chain by Christian Brose
• Paul Scharre's Tech Transforms Episode
• Focus
• Breaking Bad
• Boyd by Robert Coram
• Undaunted Courage by Stephen Ambrose

On this special episode, Willie Hicks and Carolyn Ford discuss the Billington Cybersecurity Summit, as well as insights from panels, led by Willie, on workforce automation and zero trust.

Key Topics

• [00:22] Willie's Workforce Automation Panel Highlights
• [03:28] The Difference Between Training & Education
• [11:11] Securing Data In A Zero Trust World Panel Highlights
• [16:31] Willie's Experience with Constant Reverification While Working in Financial Data Protection
• [20:44] Overarching Impressions from the Billington Cybersecurity Summit

Quotable Quotes

On the Human Factor: "I think this is always the case, that the human's usually going to be the weakest link. We're always the weakest link. But that's why that constant reverification is so critical."

On Generative AI: "We can't fear these things like generative AI. We've got to embrace it. We've got to use it. We've got to figure out how to use it and use it right and use it appropriately. But we have to figure out how to use it because you know who's using it? Our adversaries."

About Our Guest

Willie Hicks is the Public Sector Chief Technologist for Dynatrace. Willie has spent over a decade orchestrating solutions for some of the most complex network environments, from cloud to cloud native applications and microservices. He understands tracking and making sense of systems and data that has grown beyond human ability. Working across engineering and product management to ensure continued growth and speed innovation, he has implemented Artificial Intelligence and automation solutions over hundreds of environments to tame and secure their data.

Episode Links

• Billington Cybersecurity Summit Speakers
• Tech Transforms with Tom Billington
• Tech Transforms with Ann Dunkin
• Mission Impossible

Sandi Larsen, Vice President, Global Security Solutions at Dynatrace, joins our host Carolyn Ford to share her perspectives on the relationship between zero trust and defense in depth. She also discusses her storied career, leadership and what it's like to be a woman in technology (although she dislikes the term). Additionally, Sandi shares her advice on identifying mentors, finding your voice and battling imposter syndrome.

Key Topics

• [00:00] Introduction
• [01:10] Sandi's Role at Dynatrace
• [03:11] Sandi's Take on Zero Trust & Defense in Depth
• [09:21] Sandi’s Career Path
• [19:01] People in Technology and the Gender Gap
• [25:26] Sandi's Key Takeaway for Listeners
• [27:37] Tech Talk Questions

Quotable Quotes

On Finding Inspiration: “You just can't sleep on these pivotal people in your career whether they're ahead of you or beside you or even behind you, I’ve been inspired by people that I am mentoring.”

On Having Mentors: “Find mentors, they are just invaluable and will be throughout your whole entire career, no matter what stage you're in. At the beginning, at the middle, later in your career, they will always be indispensable for you.”

On Using Your Voice: “Speak up. Just have a voice. And if that voice in your head is planting doubt, don't listen to it. If it's coaching you on what to say and what not to say, and being wise about that, listen to that. But if it's planting seeds of doubt, you've got to you have to push it aside. And you have to take that step. Because if you don't, you might be missing out on the next best thing.”

About Our Guest

Sandi Larsen currently serves as the Vice President of Global Security at Dynatrace. Prior to joining Dynatrace in November 2020, Sandi held various positions, including sales and systems engineering roles in cybersecurity and financial services organizations.

Episode Links

• The Bear
• The John Maxwell Leadership Podcast
• The Tim Ferriss Show

Tom Billington, CEO of Billington CyberSecurity and Producer of the Billington CyberSecurity Summit, joins Carolyn and co-host Mark Senell to discuss the upcoming 14th Annual Billington CyberSecurity Summit, what goes into creating a valuable community for both the government and the commercial sector, and the important topics that will be the basis for this year's conference.

Key Topics

• [02:58] - Founding the Billington Cybersecurity Summit
• [09:59] - Developing Conference Topics
• [12:43] - Bridging Federal and Commercial Cybersecurity
• [16:02]- Critical Infrastructure at Billington
• [19:04] - Commercial Industry at Billington
• [21:45] - Registering for The Summit
• [22:49] - Preparing Key Conference Themes
• [24:46] - Hottest Topics at Billington This Year
• [27:03] - What’s New About Zero Trust
• [28:22] - Tech Talk Questions

Quotable Quotes

On Founding Billington Cybersecurity Summit: "I really started this business to be distinctly patriotic, to provide a serious dialogue in a way that I felt wasn't really being done at that time...So breaking into the federal cybersecurity community, to be honest, was hard as an entrepreneur. We had to build trusted relationship after trusted relationship. Over the course of 14 years, it's become decidedly easier now, now that we have had the privilege of having those trusted relationships."

On Zero Trust: "Many of the areas that zero trust encompasses have been around since the profession has existed in cybersecurity. But at no other time has the U.S. government proclaimed the importance of this overarching field as it has in the last few years. So it becomes important for the government. It becomes important for the industry leaders who serve them."

On International Cyber Collaboration: "So it's not just the U.S. team sport. It's an international team sport. The partnership with our international allies is crucially important."

About Our Guest

Before launching his company in 2010, Tom Billington spent nearly two decades producing hundreds of events, publications and articles for four of the world’s leading media companies: Reader’s Digest, Phillips Business Information, BNA (now Bloomberg BNA) and Thomson Reuters. Now, Tom is the CEO and Founder of Billington CyberSecurity, a leading independent education company founded in 2010 with an exclusive focus on cybersecurity education. Every year, he hosts the Billington Cybersecurity Summit, which is known as the world's leading government summit on cybersecurity with the unique educational mission of convening the who's who in cybersecurity: the senior leadership from the U.S. government, our allied partners, and their industry and academic partners.

Episode Links

• 14th Annual Billington Cybersecurity Summit Agenda
• Ann Dunkin on Tech Transforms
• Books By Kevin Mitnick