To The Point - Cybersecurity

Joining the podcast this week is Ellen Nakashima, National Security Reporter for The Washington Times, and shares insights into the ongoing conflict between China and Taiwan. Ellen provides perspective on the much publicized Pelosi trip to Taiwan and why the timing of that trip raised concerns in China as well as the complicated relationships the two countries have with international governments around the world, complex supply chain interdependencies (particularly in semiconductors), cyberattack impacts (or not) and why this conflict is different from Russia and Ukraine. This is truly a riveting and insightful conversation that you won't want to miss.

Ellen Nakashima, National Security Reporter, The Washington Post

Ellen Nakashima is a national security reporter for The Washington Post. She covers cybersecurity counterterrorism and intelligence issues. She has probed Russia's efforts to influence the outcome of the 2016 presidential election and contacts between aides to President Trump and Russian officials, work which led her and her colleagues to win a Pulitzer Prize in 2018. She was part of another team awarded the Pulitzer Prize for Public Service in 2014 for reporting on the hidden scope of government surveillance and its policy implications. Nakashima has also served as a Southeast Asia correspondent and covered the White House and Virginia state politics. She joined The Post in 1995.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e198

Joining the podcast this week is Tony Sager, Senior Vice President and Chief Evangelist for the Center of Internet Security and shares insights from his 45+ years on the security front lines, including 34 years at the NSA. Risk was a big theme of the discussion particularly looking at risk through a similar lens as we view other risky domains, such as the great work being done with the Cyber Safety Review Board. (And he shares color on the power of being okay with the risk of being wrong sometimes.) He also shares perspective on moving to incentive-based cyber models (such as what's been done in Ohio and Connecticut), and the criticality of translating technology, attacks & attackers into public policy and market incentives. And it can't be a great cyber discussion without addressing the growing sophistication of cyber criminals and their organizations – really becoming the defacto organized crime success path today.

Tony Sager, Senior Vice President and Chief Evangelist for the Center for Internet Security

Sager is a SVP and Chief Evangelist for CIS. He leads the development of the CIS Critical Security Controls™, a worldwide consensus project to find and support technical best practices in cybersecurity. Sager champions of use of CIS Controls and other solutions gleaned from previous cyber-attacks to improve global cyber defense. He also nurtures CIS's independent worldwide community of volunteers, encouraging them to make their enterprise, and the connected world, a safer place. In November 2018, he added strategy development and outreach for CIS to his responsibilities.

In addition to his duties for CIS, he is an active volunteer in numerous community service activities: the Board of Directors for the Cybercrime Support Network; and a member of the National Academy of Sciences Cyber Resilience Forum; Advisory Boards for several local schools and colleges; and service on numerous national-level study groups and advisory panels.

Sager retired from the National Security Agency (NSA) after 34 years as an Information Assurance professional. He started his career there in the Communications Security (COMSEC) Intern Program, and worked as a mathematical cryptographer and a software vulnerability analyst. In 2001, Sager led the release of NSA security guidance to the public. He also expanded the NSA's role in the development of open standards for security. Sager's awards and commendations at NSA include the Presidential Rank Award at the Meritorious Level, twice, and the NSA Exceptional Civilian Service Award. The groups he led at NSA were also widely recognized for technical and mission excellence with awards from numerous industry sources, including the SANS Institute, SC Magazine, and Government Executive Magazine.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e197

Joining the podcast this week is Stefan Soesanto, Senior Researcher in the Cyberdefense Project with the Risk and Resilience Team at the Center for Security Studies (CSS) at ETH Zurich. He recently authored the excellent research report "IT Army of Ukraine" that examined in detail how it was stood up out of necessity for what many have called the 'first cyberwar'. Yet for an IT army that is neither truly military or civilian and largely operating in the grey, how do you manage a globally dispersed, largely volunteer 'cyber army' more than 300k strong? Stefan provides insights from his extensive research – the first of its kind to provide a comprehensive analysis of the IT Army's structure, tasking and ecosystem. It's a fascinating discussion that also raises many questions on the implications ahead such as, can a cyberwar ever truly end? Be sure to read Stefan's research report to learn more: https://css.ethz.ch/content/dam/ethz/special-interest/gess/cis/center-for-securities-studies/pdfs/Cyber-Reports-2022-06-IT-Army-of-Ukraine.pdf

Stefan Soesanto, Senior Researcher Cyberdefense Program at Center for Security Studies

Stefan Soesanto is a Senior Researcher in the Cyberdefense Project with the Risk and Resilience Team at the Center for Security Studies (CSS) at ETH Zurich. Prior to joining CSS, he was the Cybersecurity & Defense Fellow at the European Council on Foreign Relations (ECFR) and a non-resident James A. Kelly Fellow at Pacific Forum CSIS. At ECFR, he designed and held cyber wargame exercises in cooperation with Microsoft, and organized a closed Cybersecurity and Defense conference in Odense together with the Center for War Studies at the University of Southern Denmark and the Office of the Danish Tech Ambassador. Stefan also served as a Research Assistant at RAND's Brussels office, co-authoring reports for the European Parliament Committee on Civil Liberties, Justice and Home Affairs (LIBE), the European Network Information Security Agency (ENISA), and Dutch Ministry of Security and Justice. Stefan holds an MA from Yonsei University (South Korea) with a focus on security policies, and international law, and a BA from the Ruhr-University Bochum (Germany) in political science and Japanese.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e196

Joining us this week is Brian Knappenberger, a producer and director renowned for such documentaries as Web of Make Believe: Death, Lies and the Internet, The Internet's Own Boy: The Story of Aaron Swartz, We Are Legion: The Story of the Hacktivists, and Turning Point: 9/11, to name a few. He shares insights from his recent documentary series Web of Make Believe (currently available on Netflix!) and the trajectory of misinformation, which has been around for centuries, through a lens from the 2016 election forward. We explore themes around technology innovation and how society adapts in both positive and negative ways – and how it presents opportunities for cyber attackers to exploit cracks in the system for financial gain. And we discuss impact of today's always on/always connected world where as Marshall McLuhan once observed has become "quite as imperceptible to us as water is to fish."

Brian Knappenberger, Producer and Director Brian Knappenberger is an American documentary filmmaker, known for The Internet's Own Boy: The Story of Aaron Swartz, We Are Legion: The Story of the Hacktivists, and Turning Point: 9/11 and the War on Terror and his work on Bloomberg Game Changers.

We go deep into the dark web and ransomware with this week's guest Tom Hofmann, SVP, Intelligence at Flashpoint. He tracks ransomware from its beginnings in 1989 through to present day ransomware gang shenanigans including Maze double extortion tactics that attackers have enthusiastically embraced. He also gets real on what's happening on the dark web – and the things that you can't unsee. But it's not all doom and gloom, Tom shares insights on the many available resources today to help organizations with addressing ransomware both before and after an attack -including essential ransomware tabletop exercises that teaches organizations how to defend against attacks and what to do during an attack. He also shared a great blog post that is essential reading on the history of ransomware – check out the link below: https://flashpoint.io/blog/the-history-and-evolution-of-ransomware-attacks/?utm_campaign=ransomware_attacks_affiliate&utm_source=forcepoint&utm_medium=affiliate

Tom Hofmann, SVP Intelligence Tom Hofmann leads the intelligence directorate that is responsible for the collection, analysis, production, and dissemination of Deep and Dark Web data. He works closely with clients to prioritize their intelligence requirements and ensures internal Flashpoint operations are aligned to those needs. Mr. Hofmann has been at the forefront of cyber intelligence operations in the commercial, government, and military sectors, and is renowned for his ability to drive effective intelligence operations to support offensive and defensive network operations.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e194

John Shier, Senior Security Advisor at Sophos, joins the podcast this week for a deep dive into today's ransomware threat landscape and insights uncovered in the recent Sophos research reports, including the "2022 State of Ransomware Report" and "Active Adversary Playbook". We explore future state themes of ransomware such as the geopolitics of ransomware, simultaneous attack and dwell time trends, will we ever get to a ransomware 'flat fee', increasing the resilience requirement for companies seeking cyber insurance, and industries such as healthcare that are seeing sizable upticks in attacks (and how these can be mitigated ahead).

John Shier, Senior Security Advisor at Sophos

John Shier is a senior security advisor at Sophos with more than two decades of cybersecurity experience. He's passionate about protecting consumers and organizations from advanced threats, and has researched everything from costly ransomware to illicit dark web activity, uncovering insights needed to strengthen proactive cybersecurity defenses.

John is often consulted by press, and has been quoted in publications like Reuters, WIRED, Fortune, CNN, The Hill, Fast Co, Yahoo, and more. He's also a frequent speaker at industry events like RSA Conference, Infosec, Cebit, Gitex, and more.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e193

This week Rob McDonald, SVP of Platform at Virtru joins the podcast to double-click into the privacy and data discussion. We explore subsidizing the pain of giving personal data in exchange for 'free' services, informed consent, regulation alone isn't a silver bullet, and what outcomes we could we drive when we combine user decisions with regulation. And he shares insights on behaviors that come with innovation, data as common denominator, regulations such as GDPR and CCPA as progress markers (and not the final destination), the criticality of the CIO/CISO as storyteller and recognizing our front line defenders are people (not robots!).

Rob McDonald, SVP Plaftorm at Virtru Rob is the SVP of Platform and an advocate of safeguarding data across new applications and data-sharing workflows. Prior to Virtru, Rob was the CIO for several Acute Care facilities and Denovo Healthcare development teams. His significant expertise in the healthcare industry earned him a spot in Becker's Review as a 2013 and 2014 Top 100 Healthcare CIOs. Rob has also consulted with corporations to help them assess their current information security position and develop a plan to not only mitigate the discovered technical shortcomings but more critically to raise security awareness amongst their employees.

Rob holds a Bachelor of Science degree in Computer Science from the University of Texas at Dallas and is a perpetual student of technology, information security, and privacy practices.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e192

We have two guests joining the podcast this week to talk about election security - Marci Andino, Senior Director of the Election Infrastructure Information Sharing and Analysis Center (EI-ISAC) at the Center for Internet Security, and Trevor Timmons, chairperson of the Executive Committee of the EI-ISAC and CIO for the Colorado Secretary of State. We cover everything from the history of election security through to present day, including the creation of the EI-ISAC in 2017, physical versus cyber security, the role of paper ballots for validating digital results, mis/disinformation during elections, insider threat among election officials, and the importance of resilient systems and chain of custody process.

Marci Andino, Senior Director of the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC) at the Center for Internet Security As Senior Director of the EI-ISAC since October 2021, Ms. Andino has been responsible for overseeing the operation of the EI-ISAC and works with state and local election officials to increase their cybersecurity posture through the use of products and services provided by the EI-ISAC. Prior to joining the EI-ISAC, Ms. Andino served as the chief state election official and Executive Director of the South Carolina State Election Commission for nineteen years. Ms. Andino was responsible for overseeing the conduct of primary, general and special elections in South Carolina to ensure that elections are conducted in a fair and impartial manner. She was also responsible for supervising county boards of voter registration and elections and serves as agency liaison with the General Assembly. Ms. Andino also currently serves on the Council of State Government's Overseas Voting Initiative Technology Working Group and the Bipartisan Policy Center's Task Force on Elections Advisory Council. Ms. Andino is a former member of the U.S. Election Assistance Commission's Standards Board, President of the National Association of State Election Directors (NASED), President of the S.C. Deputy Director's Organization and Secretary of the S.C. Information Technology Director's Association.

Trevor Timmons, Chief Information Officer at the Colorado Department of State and Chair of EI-ISAC Executive Committee Trevor Timmons has served the Colorado Secretary of State as Chief Information Officer since 2007 after eight years as Deputy CIO and Director of Software Development. During the time Mr. Timmons has served under several Secretaries of State, Colorado has gained a national reputation in several areas including elections administration, business registrations, and cybersecurity operations. In 2017, Colorado became the first state in the U.S. to implement statewide risk-limiting audits of voter-verifiable paper ballots for all federal and state elections. Colorado routinely ranks among the top states in the nation in voter participation and the percentage of eligible persons registered to vote. Mr. Timmons is the current chairperson of the Executive Committee of the Elections Infrastructure Information Sharing & Analysis Center (EI-ISAC).

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e191

We're back with part-two of our discussion with Jill Aitoro, SVP for Content Strategy at CyberRisk Alliance where we pick the conversation up on privacy today and efforts by big tech and government to protect sensitive information. We also dive into the slippery slope of consumer apps and health information used for convenience and, for some, entertainment and the realization of how that information could be shared and used by third parties in the coming decades. (And the check boxes you might mindlessly click today could come back to haunt you.)

Jill Aitoro, senior vice president of content strategy for CyberRisk Alliance She has more than 20 years of experience editing and reporting on technology, business and policy. Prior to joining CRA, she worked at Sightline Media as editor of Defense News and executive editor of the Business-to-Government Group. She previously worked at Washington Business Journal and Nextgov, covering federal technology, contracting and policy, as well as CMP Media's VARBusiness and CRN and Penton Media's iSeries News.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e190

Jill Aitoro, SVP for Content Strategy at CyberRisk Alliance joins the podcast this week for a hot topics discussion across recent developments in the ongoing cyber war involving Ukraine, Russia and a supporting cast of many public and private entities including NATO, Microsoft, Lithuania and others. We also dive into recent exploits by China with social media microtargeting campaigns against rare earth mining companies and where their 'playing the long game' implications could lead.

Jill Aitoro, senior vice president of content strategy for CyberRisk Alliance She has more than 20 years of experience editing and reporting on technology, business and policy. Prior to joining CRA, she worked at Sightline Media as editor of Defense News and executive editor of the Business-to-Government Group. She previously worked at Washington Business Journal and Nextgov, covering federal technology, contracting and policy, as well as CMP Media's VARBusiness and CRN and Penton Media's iSeries News.

For links and resources discussed in this episode, please visit our show notes at https://www.forcepoint.com/govpodcast/e189