Latest / Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors. / Elevating Airline Safety with Next-Gen Cybersecurity Measures

Transcript

Elevating Airline Safety with Next-Gen Cybersecurity Measures · Encrypted Ambition: Where Ambition Meets Encryption - Inside The Minds Of Disruptors.

• 0:17
  Speaker 1: Hey everybody, welcome to another episode here of the cybersecurity podcast with Craig Petronella and, of course, myself, blake.
• 0:24
  Speaker 1: Today we have a very special guest.
• 0:26
  Speaker 1: We have Sige Brody.
• 0:28
  Speaker 1: Please introduce yourself, sir.
• 0:30
  Speaker 2: Hey guys, nice to meet you, nice to be here.
• 0:33
  Speaker 2: Yeah, my name is Sige Brody.
• 0:35
  Speaker 2: I was the chief technology officer and co-founder of a managed cloud computing company called Webair almost 20 years ago.
• 0:44
  Speaker 2: We sold that to a private equity firm about two and a half years ago and that ended up merging with a bunch of other organizations and that is now called Optinine.
• 0:56
  Speaker 2: I am still the CTO over there in a part-time capacity and I'm also out doing consulting services around product management and cybersecurity for other interesting technology companies.
• 1:09
  Speaker 1: Nice.
• 1:10
  Speaker 1: Tell us about, maybe, some of your core values at Optinine and then some of the other spaces and verticals that you work in.
• 1:18
  Speaker 2: Sure, yeah.
• 1:19
  Speaker 2: So the primary value proposition of Optinine is really a managed cloud provider, and the services that Optinine provides surround management of public and private cloud infrastructure and then also a large focus on business continuity, disaster recovery and overall resilience.
• 1:40
  Speaker 2: So with that we have services such as managed backups and managed disaster recovery.
• 1:45
  Speaker 2: The important thing to note is that we are focused on working with organizations who have acknowledged that they don't have an appetite to take ownership and accountability of ensuring that their cloud infrastructure is properly managed and monitored and secured and scaled, that their disaster recovery infrastructure is set up properly.
• 2:06
  Speaker 2: The outsource ownership of those layers to us and we are the ones responsible to ask the right questions, ensure the run books are in place, ensure the right buttons are pressed, and so on and so forth.
• 2:18
  Speaker 2: So as we look into the future and we see IT getting more complex, I think sort of outsourcing, sort of non-interesting or sort of transactional layers managing infrastructure being one of them is low hanging fruit and we see a lot of organizations making that decision.
• 2:35
  Speaker 2: The other organizations I'm involved with I've done some investing in technologies that I think are cool and providing some consulting around there.
• 2:45
  Speaker 2: So one company that I've been working with is called Sidiation.
• 2:48
  Speaker 2: They are focused on providing cybersecurity protection for physical aircraft and they help them sort of get the word out.
• 2:56
  Speaker 2: The aviation is, pretty surprisingly, is pretty far behind others that we're all familiar with as far as requirements around vendor diligence and proper security.
• 3:05
  Speaker 2: So helping them educate and let people know what they need to do to protect their fleets.
• 3:11
  Speaker 1: What type of physical security does an aircraft require?
• 3:14
  Speaker 1: I know that's a silly question and obviously Craig and I work with computers and servers.
• 3:18
  Speaker 1: So to me, whenever you say physical security with aircraft, I don't know what triggers.
• 3:24
  Speaker 1: So I'm curious.
• 3:27
  Speaker 2: Yeah, it's a really interesting sort of topic, especially for folks like us who have come from a new traditional cybersecurity background.
• 3:35
  Speaker 2: But so when you think about a physical aircraft, there's a few attack vectors.
• 3:39
  Speaker 2: The possibly most alarming one and most obvious one is that the radio frequency based communication.
• 3:47
  Speaker 2: So you have planes and the ground and satellite sending RF type of signals and these RF based messages are unencrypted and unauthenticated.
• 4:00
  Speaker 2: I think the unauthenticated pieces is probably the more critical.
• 4:05
  Speaker 2: First, right, because if you can transmit a message powerful enough to be received by an aircraft, the aircraft has an assumption of trust that it is accurate information, and so you can do a lot of nasty things.
• 4:20
  Speaker 2: In fact, a few months ago and so something like GPS jamming has been around for a bit.
• 4:27
  Speaker 2: It's actually getting more sort of talk now because of the conflicts that are going on and the fact that it's actively being used by military.
• 4:34
  Speaker 2: But more alarming is GPS spoofing, which, from our world, we go back maybe 15 years and talk about sort of just TCP or really just IP spoofing.
• 4:45
  Speaker 2: Same thing right.
• 4:47
  Speaker 2: At some point it was this holy grail.
• 4:49
  Speaker 2: Is it possible?
• 4:50
  Speaker 2: Oh, it's really difficult.
• 4:51
  Speaker 2: What we got to work in some cases and then it became very prevalent, right, and so we're going to see the same thing.
• 4:56
  Speaker 2: In fact, a few months ago, there was a period of about three weeks where about over 20 commercial and business aircraft were the victims of GPS spoofing, and they in you know, we're talking 787s, 777s, airbuses, gulfstreams and they all thought they were about 80 nautical miles off from where they were supposed to be.
• 5:17
  Speaker 2: One of them almost ended up and I ran by mistake.
• 5:21
  Speaker 2: That would be bad, and super interesting is that a few years ago, somebody had this great idea to enhance the onboard inertial positioning systems to take GPS in as another factor to better ensure that positioning is correct, and it was that system's always designed to be standalone, and now, when this happened, the GPS data came in the IRS.
• 5:46
  Speaker 2: That system got super confused and it caused a cascading failure.
• 5:50
  Speaker 2: All these other systems in the cockpit failed, and I'm talking about the planes that I just mentioned and basically these planes have to call air traffic control and say where are we and where should we go, which is surprising.
• 6:02
  Speaker 2: So radio frequency is one.
• 6:05
  Speaker 2: The other attack vectors really surround physical access to the aircraft and trust, and so if you think about the number of people that have access to these planes, all these subcontractors and vendors.
• 6:16
  Speaker 2: Again, there is an assumption of trust.
• 6:19
  Speaker 2: If you have access to a device.
• 6:21
  Speaker 2: Lots of these devices have ethernet ports, usb, some of them are pretty old PCMCIA, all sorts of different inputs.
• 6:30
  Speaker 2: If you have access to those, then anything that you plug in there is assumed to be valid.
• 6:34
  Speaker 2: You can override the place to config all that and when those types of attacks, you can modify the guidance systems, the navigational data, the autopilot, the actual control surfaces, even in the cabin people think, well, the cabin is separate.
• 6:52
  Speaker 2: You get into a cabin management system.
• 6:53
  Speaker 2: You can set off the fire alarm, the fire suppression system, the plumbing for the toilets.
• 6:58
  Speaker 2: I mean you can force a plane to not take off or force it to make an emergency landing.
• 7:02
  Speaker 2: So that really comes down to supply chain and vendor diligence and all that.
• 7:11
  Speaker 3: So there's all sorts of alarms going off in my brain.
• 7:13
  Speaker 3: I'm thinking like pen tester for airplanes.
• 7:19
  Speaker 2: That's what this company does is a situation.
• 7:22
  Speaker 2: They're doing vulnerability assessments for a physical aircraft.
• 7:26
  Speaker 3: So would it be possible for a hacker to either board a plane or go into an airport where there's maybe a busy airport, like Atlanta for example, where there's a lot of aircraft kind of taxing in, and use something like a, like a flipper zero or some type of device like that, to kind of either infiltrate or jam signals?
• 7:47
  Speaker 2: Oh yeah, absolutely.
• 7:48
  Speaker 2: I don't know the output power of you know I'm familiar with that device, but as far as the proxy me requirement, I don't know.
• 7:57
  Speaker 2: I mean, obviously those things are all possible, right, it's not a matter of is it technically possible, it's more a matter of you know how illegal it is, right.
• 8:06
  Speaker 2: Same thing with, you know, shining the lasers up on the planes, right, like obviously anybody could do that at any time.
• 8:11
  Speaker 2: We're just, it's just lucky that it's not being done much.
• 8:15
  Speaker 3: So my fear yeah yeah, sorry to interrupt you.
• 8:19
  Speaker 3: My fear is that there's some type of spy balloon that has RF jamming capability, that, or even drones that are flown with some type of jammer capability to you know.
• 8:33
  Speaker 3: You know that, all sorts of alarm bells going off.
• 8:36
  Speaker 3: Oh, yeah, yeah.
• 8:39
  Speaker 1: Who has weaker secu.
• 8:40
  Speaker 1: Oh, I'm sorry, go ahead.
• 8:41
  Speaker 1: Go ahead, blake.
• 8:42
  Speaker 1: I was just curious.
• 8:43
  Speaker 1: I'm a huge Airbus guy so I've been, I'm on the Airbus train and I've invested in Airbus, like you know.
• 8:51
  Speaker 1: Obviously I hold stock in Airbus and I have for I don't know years now.
• 8:56
  Speaker 1: So I'm not a huge Boeing guy.
• 8:58
  Speaker 1: But who has weaker security, would you say Airbus or Boeing.
• 9:01
  Speaker 2: Yeah, he's taken me right to the hard questions.
• 9:03
  Speaker 2: You know it's interesting.
• 9:07
  Speaker 2: I don't know that I can answer that we Sidiation works with both of them, and so what Sidiation really does is they're doing like deep R&D around these avionics components.
• 9:20
  Speaker 2: And you know some of these planes are fairly old, right, and so when, when they were put into production assuming you know, physical access means assumed trust, you know that was.
• 9:32
  Speaker 2: There was nothing wrong with that back then, I guess.
• 9:34
  Speaker 2: But some of these vulnerabilities like if you, if I showed them to you on the platform, they would read like this like the cabin management system, you know, has a hard-coded IP of 10.0.0.5.
• 9:47
  Speaker 2: It's open to default credentials and if you plug into the Ethernet port, you can you can, you know, tftp over and override the configurations and configs right, like the types of vulnerabilities are not, you know, crazy just because it happens to be on a plane and unfortunate things if you're flying on a 30 year old plane, like you're gonna run into those types of things.
• 10:09
  Speaker 2: Now, upgrading and updating those components can be very time-consuming, they can't just do it right.
• 10:16
  Speaker 2: It could be only two or three years to replace a component like that, and so a lot, of, a lot of this sort of mitigation for those types of things comes down to security awareness, training and contextual awareness.
• 10:29
  Speaker 2: You know, you need to be aware of these exact vulnerabilities which we know this fleet or this plane to be susceptible to.
• 10:35
  Speaker 2: Instead of you know, sort of overwhelming them with just all the possibilities, make it very contextual.
• 10:44
  Speaker 1: Yeah, that makes a lot of sense and you know we we deal with, obviously we deal a lot of computers and devices and personal devices, business devices.
• 10:52
  Speaker 1: But my follow-up with that is obviously these hackers that have a motive right.
• 11:00
  Speaker 1: A lot of the motive that we see in our industry is financial.
• 11:03
  Speaker 1: So, from your perspective, what is the motive to you know, hacking a plane for one, and what benefit does that do to an hack, to a hacker, right like?
• 11:16
  Speaker 1: There's obviously got to be some motive, right.
• 11:18
  Speaker 2: So I did spend a little bit of time.
• 11:21
  Speaker 2: You know I actually have a diagram around it.
• 11:24
  Speaker 2: If I wanted to ransomware an aircraft, here's how I would do it and obviously there is financial benefit there, right, and you know the amount of money lost when these planes are sitting on the ground is pretty high, you know.
• 11:39
  Speaker 2: I mean, can you compare it to a hospital being ransomware?
• 11:42
  Speaker 2: I mean, it's probably close.
• 11:44
  Speaker 2: I mean, some of these planes you know cost, you know, 80 to 100 million dollars and you know what does that look like when they're down for a week.
• 11:50
  Speaker 2: And the the operators, you know they have insurance if an engine is fails and needs to be replaced.
• 11:58
  Speaker 2: You know what is that.
• 11:59
  Speaker 2: What is the loss of business amount to for a week?
• 12:01
  Speaker 2: Loss of business for an aircraft because of some sort of cyber attack is not something that any insurance company in the industry is going to cover at all.
• 12:10
  Speaker 2: Right now it is definitely in the gray area and I've talked to some insurance counters there and they agree.
• 12:16
  Speaker 2: But if I wanted to, you know, ransomware plane, you know, think of it.
• 12:20
  Speaker 2: You know you have these.
• 12:22
  Speaker 2: You have these vendors who are coming on and off the planes and plugging in laptops to all these systems.
• 12:26
  Speaker 2: Now, unfortunately, there is almost no vendor diligence in this industry.
• 12:31
  Speaker 2: If I'm, if I'm, if I'm the owner of a fleet and I am and I'm entrusting a vendor or a partner to perform maintenance or do updates or replace a failed component, there's no, there's no.
• 12:45
  Speaker 2: Hey, fill out the cyber security diligence form.
• 12:47
  Speaker 2: Show me how you and you know, enhance my security, not expose me to more.
• 12:52
  Speaker 2: And so those laptops, you know, are they running EDR?
• 12:55
  Speaker 2: Are they going home and sitting on someone's home network?
• 12:57
  Speaker 2: You know what is the cyber security posture back at the corporate office?
• 13:01
  Speaker 2: Look like for these vendors that that's not happening.
• 13:04
  Speaker 2: And so it wouldn't be fairly difficult to develop a true, to take a traditional ransomware strain, right, that gets into a traditional IT organization through phishing, social means, whatever.
• 13:16
  Speaker 2: And once it's in, what are they doing?
• 13:18
  Speaker 2: Now?
• 13:18
  Speaker 2: They're looking for critical assets, right, they're designed to look for SQL databases, whatever.
• 13:23
  Speaker 2: A critical asset you know.
• 13:25
  Speaker 2: Swap that critical asset to a avionics vulnerability, you know, now, now, the ransomware sitting on these laptops, dormant, and it's just waiting to see, to see the right signature on a local land, and when it does, it can ransomware that component.
• 13:39
  Speaker 2: And so the leap from where we are to sort of a more sort of I don't know industry specific or use case specific strain.
• 13:47
  Speaker 3: It's not that, it's not that sort of crazy right have any drills been done like to simulate attacks like that?
• 13:55
  Speaker 2: now.
• 13:55
  Speaker 2: I mean, unfortunately, the like I said, industry is pretty far off.
• 13:58
  Speaker 2: I'm I just spoke at a, at a, at a large business aviation conference a few weeks ago, talking about these things, and so that's what we're just, at the point where we're educating as like, hey, these are the risks, this is what's possible, what's not, and I think, similar to HIPAA and health care, it's going to take some top down sort of pushing on.
• 14:21
  Speaker 2: You know, maybe you know warning, you know sort of threatening fines.
• 14:24
  Speaker 2: So actually in Europe, actually probably Blake, going back to your maybe maybe going back to your Airbus comment a little bit but the Europeans do have a cybersecurity for aircraft regulation going live next year, in 2025, and it's great.
• 14:40
  Speaker 2: And if you look at it, it reads like what you guys would be used to.
• 14:43
  Speaker 2: You know proper monitoring for unauthorized access, proper securing of making sure they're running the latest firmware, anything that you would see under normal sort of cyber requirements.
• 14:53
  Speaker 2: They're requiring that on physical planes and so that will help.
• 14:56
  Speaker 2: The FDA traditionally is a little bit behind YASA on these, but it's coming.
• 15:01
  Speaker 2: Tsa has some requirements around it now, but they don't.
• 15:05
  Speaker 2: They don't cover, you know everybody, and they actually also now just recently, made an announcement that if you want FAA funding for airports, you need to include in your proposal how you plan on protecting the airport from a cybersecurity perspective.
• 15:20
  Speaker 2: So it's starting, but it will take time.
• 15:22
  Speaker 2: We just really need to be out there.
• 15:24
  Speaker 2: You know advocating, sure I'm sorry, blake, real quick.
• 15:30
  Speaker 3: So what about DOD, or Department of Defense in military?
• 15:33
  Speaker 3: Is there any?
• 15:34
  Speaker 3: Is it still education there or is there any testing being done?
• 15:39
  Speaker 2: Oh yeah, they're like in a completely different frame of mind.
• 15:42
  Speaker 2: They are very advanced and they do a ton of stuff in this area and they're not like.
• 15:50
  Speaker 2: Their RF communication is not like what I'm talking about, right, so they have their own stuff and, from what I understand, they're aware of all these things and they protect themselves.
• 16:00
  Speaker 2: Okay.
• 16:02
  Speaker 3: So it's kind of like the traditional trickle down effect.
• 16:04
  Speaker 3: You know big companies, big militaries, and then it comes down.
• 16:07
  Speaker 3: But you know the system right.
• 16:11
  Speaker 2: Yeah, I mean I think it's really ironic and interesting is, if you think about commercial airlines right, some of the largest in the world, all the names that we know about they spend millions of dollars a year on cybersecurity.
• 16:23
  Speaker 2: They have their own, they usually have their own socks and they're paying threat intelligence companies.
• 16:30
  Speaker 2: You know half a million or three quarters of a million dollars for threat intel on their organizations to know what's going on.
• 16:37
  Speaker 2: Very mature sort of internal.
• 16:39
  Speaker 2: You know cyber teams, yet ironically, their most critical and price assets the aircrafts they have no visibility into those at all, into what's going on whatsoever.
• 16:50
  Speaker 2: And so part of what you know a situation is trying to do and what I'm helping them with is, you know this is, this is a bridge.
• 16:58
  Speaker 2: You know the platform that they're developing, which is really it's a real time, it's a vulnerability assessment, but it's also continuous.
• 17:04
  Speaker 2: You know that can speak, that can feed data into the SIM.
• 17:07
  Speaker 2: You know we can.
• 17:08
  Speaker 2: You know it already has.
• 17:09
  Speaker 2: You know Mitre attack framework.
• 17:11
  Speaker 2: You know notifications.
• 17:12
  Speaker 2: It can speak sticks taxi.
• 17:14
  Speaker 2: I mean we need to create a bridge between the existing cybersecurity apparatuses and these new threats.
• 17:21
  Speaker 2: In fact, at Optinine we did something similar.
• 17:23
  Speaker 2: Optinine is in the business of you know, like I said, managing backups and disaster recovery, and part of that is we actually will deploy and manage backup and replication software at our at our customers, you know locations or on their servers and we manage them.
• 17:39
  Speaker 2: And we noticed that a lot of customers were coming to us to consume those services because obviously they were they were, you know, mindful of security and they wanted a capability to recover post attack.
• 17:49
  Speaker 2: And then we realized that when attackers who are looking to ransomware an organization get into organizations and IT infrastructure these days, they're actually one of the first things you're doing is a very common pattern in workflow.
• 18:02
  Speaker 2: One of the first things you're doing is they're looking for those backup and replication tools.
• 18:06
  Speaker 2: They're seeking them out so that they can destroy any, any potential for recovery and, blake to your point, if that's what your economic benefit is, I want to get paid a ransom.
• 18:17
  Speaker 2: I'm going to do everything in my power to improve the likelihood of getting paid.
• 18:21
  Speaker 2: So, because we knew they were looking for these backup and replication tools, one of the things we did was we built an ad, we built this add-on to our offering, where we would run the backup software configuration itself through machine learning on our side and we would look for anomalies and look for suspicious activity.
• 18:41
  Speaker 2: If the end users maybe change their retention policy twice a month, it may change us to encryption once a week, change job definitions and all of a sudden in one day we see a bunch of jobs deleted and other changes.
• 18:54
  Speaker 2: That's suspicious and because those things are happening before the ransomware takes place, it would be a predictor of a ransomware attack.
• 19:03
  Speaker 2: And so we built that and productized it and we tied it into our service that if and when we saw that we can automatically air gap the offsite backups or DR or we can, we built an API, we feed it into the client's SIM or the RMSP partner's SIM, and again, I think you have.
• 19:21
  Speaker 2: So it's like very it's a very sort of similar use case to the aircraft.
• 19:27
  Speaker 2: You have this new attack vector that maybe it's been around for a long time like backup service.
• 19:32
  Speaker 2: It's been around for a while, airplane's been around for a while, but all of a sudden it's an attack vector that was not encompassed by this cyber team.
• 19:40
  Speaker 2: Now it's being exploited and we need to sort of build that bridge.
• 19:46
  Speaker 1: Yeah, I'm surprised, honestly, the FAA doesn't have regulations behind this, like some type of compliance mandates that say, hey, if we're going to operate in our airspace, you have to go, like we see it in, obviously, data centers, endpoints, cmse, yeah, yeah, yeah, any type of cyber infrastructure.
• 20:04
  Speaker 1: We see these mandates already existing.
• 20:07
  Speaker 1: But the airline industry I mean it's a huge portion of our economy, right.
• 20:13
  Speaker 1: So travel, the airline industry, I mean I don't even know how much, I mean it's billions and billions of dollars, right of the sector that just goes unnoticed, uncared for.
• 20:25
  Speaker 1: I'm so surprised there's not mandates around that.
• 20:29
  Speaker 1: And so for you, I'm curious, you said it's coming right.
• 20:34
  Speaker 1: You did say that.
• 20:34
  Speaker 1: So what would those mandates look like for you?
• 20:39
  Speaker 1: If you had a golden grail of mandates, what do you think they would include?
• 20:46
  Speaker 2: Well, so you know, if you look at what IASA, which is the European FAA, essentially put out, you know it's exactly what you're saying.
• 20:56
  Speaker 2: We are mandating operators.
• 20:59
  Speaker 2: And someone asked me this the other day.
• 21:01
  Speaker 2: They said is it aircraft that are registered within Europe or that land within Europe?
• 21:07
  Speaker 2: I said, you know that's a really good question and I don't know that there's an answer for that yet.
• 21:12
  Speaker 2: But that has huge impact, right, because you know now it's like you have every operator in the world and every commercial operator needs to comply.
• 21:19
  Speaker 2: Then at that point and you're not just going to comply when you land, you need to comply your fleets fully.
• 21:23
  Speaker 2: But the requirements that IASA is putting out, which is called the PartIS and it goes live in October of 25.
• 21:30
  Speaker 2: And I'll read them to you.
• 21:32
  Speaker 2: You know, and again it reads very similar to what you know, what you know our traditional industries have been talking about for a while maintaining the security of an aircraft system through their lifecycle, vulnerability management, identifying the sessing and mitigating vulnerabilities in aircraft systems, security awareness, training, protecting the integrity and availability of aircraft system.
• 21:52
  Speaker 2: And that's a fun one, right?
• 21:54
  Speaker 2: I used to have a lot of fun with that one with HIPAA, because HIPAA also spoke about availability of data, which and when I was really focused on selling disaster recovery we would use that.
• 22:05
  Speaker 2: We'd say, hey, hipaa is not only about you know people stealing your data, but if someone can cause your system to go down and make that patient data unavailable, that's a HIPAA violation.
• 22:15
  Speaker 2: If you're, if you're, if you have downtime, your bio and you know doctors can't get the patient data, that's a violation.
• 22:22
  Speaker 2: So that's an interesting one.
• 22:23
  Speaker 2: The other ones, back to IASA, are ensuring the confidentiality of aircraft data monitoring, aircraft systems for sign up, unauthorized access or activity, aircraft incident response, implementing measures to mitigate risk.
• 22:37
  Speaker 2: So, again, like very sort of traditional, you know table sticks type of requirements.
• 22:41
  Speaker 2: But the issue is, you know the word aircraft shows up in almost all of these, right, and so that's the rub there's not many tools and systems that are out there designed for that.
• 22:52
  Speaker 1: I also see a web of jurisdictional conflicts, right?
• 22:57
  Speaker 1: So let's just say for example, an American airplane is flying within the borders of Europe and something happens within the borders of Europe, who has jurisdictional authority over that plane to investigate sad breach?
• 23:13
  Speaker 1: You know what I mean.
• 23:14
  Speaker 1: Like it just, yeah, it becomes this web of entanglement.
• 23:18
  Speaker 3: I'm also envisioning some type of, you know, fly by a hostile country and some type of almost EMP, but specific for aircraft, you know, like a new cyber weapon aimed at aviation.
• 23:34
  Speaker 2: Yeah, I mean like so all of this stuff can happen, you know, obviously in the air and in the sky In fact.
• 23:38
  Speaker 2: In fact, one of the RF systems that is susceptible to this is called AVSB and basically just positioning data and interesting thing is, all the planes actually it's now mandated that the planes do this.
• 23:55
  Speaker 2: So if you there's actually some pretty cool sites out there, like if you go to ADSB exchange or flight or flight tracker, which is a really cool app you can install on your phone, you might have those right now.
• 24:05
  Speaker 2: They're awesome, they have augmented reality.
• 24:07
  Speaker 2: You can just point your phone at any plane you see flying past in the sky.
• 24:11
  Speaker 2: It tells you the tail number, it tells you where it came from, where it's going really cool stuff.
• 24:15
  Speaker 2: But if you look in the corner behind me, I have a little, I have a little radio there.
• 24:19
  Speaker 2: I'm participating in this ADSB exchange.
• 24:22
  Speaker 2: You go to the website.
• 24:24
  Speaker 2: It shows you a global map of where every single plane is in the world right now and that's all.
• 24:29
  Speaker 2: That's all hobbyists like me that are that are sort of contributing to this network.
• 24:33
  Speaker 2: It's like SETI and it's cool.
• 24:35
  Speaker 2: My little radio back here.
• 24:36
  Speaker 2: I can.
• 24:37
  Speaker 2: I can receive signals within 300 miles.
• 24:39
  Speaker 2: If I can look at just my map, it's actually awesome.
• 24:44
  Speaker 2: It's a little Raspberry Pi with a $50 USB radio.
• 24:47
  Speaker 2: It's not a lot of fun, but anyway, the planes all put out these signals and so that's cool.
• 24:53
  Speaker 2: Here's where I am.
• 24:53
  Speaker 2: One of the interesting things is that there's this collision avoidance system where the planes receive the signals from the other planes in the area and the planes actually speak to each other and they basically will say they form this consensus it looks like we're going to, it looks like we're going to collide, I'll go, I'll go up, you go down, I'll go left, you go right.
• 25:15
  Speaker 2: And these messages are basically shown to the pilots like hey, your, your collision avoidance system is going off.
• 25:23
  Speaker 2: We recommend that.
• 25:25
  Speaker 2: You know we want to move to this position and we want to do this.
• 25:28
  Speaker 2: Press the button.
• 25:29
  Speaker 2: And so very easy to send a fake message and cause and cause that, cause that and cause the plane to move or change position.
• 25:38
  Speaker 1: I'm really curious, so something that I know.
• 25:41
  Speaker 1: This is more kind of content focused, but you know, obviously, when the Super Bowl was happening and you know, obviously Taylor Swift was flying across the ocean and people were tracking her flights, and then now you see there's this young guy can't think of his name, but I'm sure you know the young guy who's tracking celebrity jets and posting that information Tracking Elon Musk at one point.
• 26:09
  Speaker 1: Yeah, same kid.
• 26:11
  Speaker 1: So something that nobody really talks about and I'm curious to get your take on is transparency of of this information right?
• 26:20
  Speaker 1: Because they're they're using federal airspace, right, they're using federal tax dollars, obviously, and so there has to be some type of window for the public.
• 26:31
  Speaker 1: Where, where do you define that Right?
• 26:34
  Speaker 2: Well, so that's what's actually happening, right?
• 26:36
  Speaker 2: So if you go onto these sites you can see all the planes and you can see their tail numbers, the, the FAA registered tail number.
• 26:43
  Speaker 2: And if you go to the FAA's website you can look up any tail number.
• 26:47
  Speaker 2: It'll tell you what type of aircraft it is, give you some registration info and give you ownership and typically what, what is done to sort of to sort of obfuscate the ownership in the.
• 26:59
  Speaker 2: You know, I don't, I think the commercial operators, they don't care, you know, it's like they just put it out there.
• 27:04
  Speaker 2: But definitely in the business world side, an LLC, a new LLC, is created per aircraft and that's sort of like the, the paywall that you can't get behind, and so you don't necessarily know who the LLC.
• 27:16
  Speaker 2: I mean, you know, ironically enough sometimes, that now you can go digging and you can look at the LLC and you look at the address and it's fairly, you know, like I saw one that you know typically they'll put like the initials of the company.
• 27:29
  Speaker 2: You don't need to.
• 27:30
  Speaker 2: But that's the thing.
• 27:31
  Speaker 2: If you can, once you get the name of the LLC, if you can figure out who owns that LLC or what it's related to, now you know who's playing it is.
• 27:39
  Speaker 2: Now, what can they do?
• 27:41
  Speaker 2: I'm sure there's a way to.
• 27:42
  Speaker 2: Maybe, I don't know, maybe you can request to change your tail number, maybe you change the LLC.
• 27:47
  Speaker 2: But once someone has that association, once you can get from tail number to kind of owner they are the operators.
• 27:54
  Speaker 2: Now mandate to put out these signals of here's, here's where I am right now, here's my tail and here's my position, and then it's trackable.
• 28:03
  Speaker 2: I think and that's a thing, that's an interesting thing Like it's like you know people.
• 28:08
  Speaker 2: I think the person who was tracking Taylor Swift, you know they sent him a cease and desist, right, and they sent him all this.
• 28:14
  Speaker 2: Like we're going to sue you because you're putting her, like, at risk, and all this.
• 28:18
  Speaker 2: But meanwhile, you're right, it's publicly available information.
• 28:22
  Speaker 2: He's just bundling it up in a way that's easier for folks to see.
• 28:26
  Speaker 1: And I'm assuming you believe in that ability to do that right, I mean.
• 28:33
  Speaker 2: I don't know, I haven't really thought about it much.
• 28:34
  Speaker 2: I mean, on one hand it's you know it is it's it's related to federal government and this and that and taxpayer dollars.
• 28:41
  Speaker 2: On the other hand, it does make it easier right to conduct these attacks.
• 28:47
  Speaker 3: But I wonder if it needs to stay public.
• 28:51
  Speaker 2: Well, yeah, well, the tail number is.
• 28:55
  Speaker 2: You know, the tail number is just a number, right?
• 28:57
  Speaker 2: I think maybe the registration information right, that's what I mean.
• 29:00
  Speaker 2: Yeah, maybe not showing the owner or maybe, you know, maybe that has to be behind like a freedom of information act request or something that makes it more difficult.
• 29:12
  Speaker 1: We're starting to see a lot of.
• 29:14
  Speaker 1: You know we talk about like trust lists, like zero trust frameworks, a lot, and you know there seems to be kind of a divide of people that say no, zero trust isn't the way, and people saying zero trust is the future.
• 29:30
  Speaker 1: I'm curious.
• 29:32
  Speaker 1: I could tell by your facial expression you have a few things to say.
• 29:38
  Speaker 2: Zero trust has been, you know, overly it's turned into this overhyped marketing term.
• 29:43
  Speaker 2: Look 15, 20 years ago, you know, in our offices in the optinine at that point it was Web Air offices we had a whole bunch of employees, we were tech companies like it's not a fair example, but we wanted to secure our staff and our people and ensure that, you know, there was no data leakage.
• 30:06
  Speaker 2: So every employee was put in their own VLAN and when they VP and in, they ended up in that same employee VLAN and so there was segmentation.
• 30:15
  Speaker 2: They were not on a shared layer two network and it was that was.
• 30:19
  Speaker 2: You know, we were doing zero trust without having a fancy name for it, and that's what bothers me.
• 30:25
  Speaker 2: I think that you know going.
• 30:27
  Speaker 2: You just sort of I worry that there are business owners that are out there who read the news, see these stories about ransomware and basically in their head they're like well, I'm okay because I buy backups or I have a disaster recovery, or I pay the security company to take care of everything for me, and there's all these like there's so many bad assumptions related to cloud and security that people have a false sense of security and they just sort of discount it and, as you guys know, this is all multi-layered.
• 31:00
  Speaker 2: There's no, there's no.
• 31:02
  Speaker 2: If I have X, then I'm secure.
• 31:03
  Speaker 2: And I think we fall into that trap with zero trust.
• 31:05
  Speaker 2: We subscribe to zero trust, therefore we're all set, we can ignore everything else.
• 31:11
  Speaker 2: And that's what scares me is the marketing aspect of it.
• 31:14
  Speaker 2: There's a company that is focused on cybersecurity for the space vertical, for digital infrastructure and space, and so there's an AWS snowball, which, if you don't know, is a glorified Raspberry Pi compute device and it's an edge.
• 31:31
  Speaker 2: It's okay, it's an AWS edge compute device, but under the surface it's pretty much a Raspberry Pi.
• 31:37
  Speaker 2: Anyway, there's one of those on the space station, and so, from a marketing perspective, it's like whoa, we have edge compute in space.
• 31:44
  Speaker 2: You know we can conduct computational things in space.
• 31:48
  Speaker 2: We have public cloud in space, raspberry Pi, and that's cool.
• 31:51
  Speaker 2: Like you got to start somewhere.
• 31:53
  Speaker 2: But then this other company came along and says hey, we're doing zero trust in space.
• 31:56
  Speaker 2: So, marketing perspective, I think it's great.
• 31:59
  Speaker 2: I would have done the same exact thing, but we got to be careful, you know.
• 32:04
  Speaker 2: So do I believe in your trust principles?
• 32:06
  Speaker 2: Yes, is it to be all into all?
• 32:08
  Speaker 1: No, that's kind of funny to me.
• 32:12
  Speaker 1: Obviously, we want to talk about the future.
• 32:15
  Speaker 1: Right, I know you don't have a crystal ball, but obviously you kind of seems like you have a pulse on where the future of cybersecurity is heading.
• 32:25
  Speaker 1: Is there any type of exciting developments that you feel like that are happening now that may be game changing or groundbreaking in the future?
• 32:38
  Speaker 2: Well, you know, I think I said at the beginning, but one of the things that also scares me is the fact that if you look at the role of IT managers, of CIOs, vp of infrastructure, whatever you know, the amount of sort of responsibility put on their plates year over year is increasing and, in many organizations, smaller.
• 33:00
  Speaker 2: Obviously.
• 33:00
  Speaker 2: There's typically not a separate sort of security apparatus there than tasked with owning all the security stuff as well, and I think one of the things that a lot of those folks in those positions don't realize is part of their job is to manage complexity group, is to have a focus on ensuring the most simplest architecture that they can find which still satisfies the business needs and provide some level of flexibility.
• 33:27
  Speaker 2: That should be one of their goals, but I don't think that they're really thinking that way, and so we end up with this vast sprawl that we're all aware of, right?
• 33:36
  Speaker 2: We end up with cloud sprawl.
• 33:38
  Speaker 2: We end up with, if you look at, something like SASE, right, another great marketing term.
• 33:43
  Speaker 2: Thank you, gartner is cool, but it's not one product, it's like 50 products, and so people need to like really focus on simplifying their environment, because the more complex it is, obviously the harder it's going to be to manage, monitor, secure and scale it right, and it becomes almost impossible, and so we need to take a very active approach on managing complexity.
• 34:06
  Speaker 2: If that's not done, it will almost become impossible.
• 34:11
  Speaker 2: And again, I think that also means the outlook is good for managed vendors, mssps, managed security vendors, managed cloud vendors, all that and so I think we're going to see, in the future, outsourcing to best and breed becoming much more common, because, as things get more complex which they will it's going to be almost impossible for internal teams to do it.
• 34:36
  Speaker 3: I think, by the way, I think it's well-heating fruit.
• 34:39
  Speaker 2: I think if you have remediation list of 50, you don't like, hey, I'm just going to give it to my vendor.
• 34:44
  Speaker 2: Yeah, I have spent some time looking at what's happening with digital infrastructure in space.
• 34:52
  Speaker 2: It's just an interest of mine.
• 34:53
  Speaker 2: I think it's just super, super cool to geek out on Space-based data center, space-based edge compute, space-based connectivity.
• 35:02
  Speaker 2: There's a company, actually, that was a great launch Yesterday.
• 35:06
  Speaker 2: It was a SpaceX rideshare launch, the first of this year.
• 35:10
  Speaker 2: The rideshare launches are awesome because they're typically like 100.
• 35:14
  Speaker 2: I looked at my LinkedIn.
• 35:15
  Speaker 2: There was like 30 different companies that were in space.
• 35:17
  Speaker 2: We made it because they're all in the same rideshare.
• 35:19
  Speaker 2: But it was a company that's doing cell phone towers in space, direct to device.
• 35:27
  Speaker 2: I'm on my normal iPhone I don't want Android and I have cell phone access because I'm directly connected to a cell phone tower in space.
• 35:35
  Speaker 2: How cool is that?
• 35:36
  Speaker 2: Now you think about where's the content?
• 35:39
  Speaker 2: Well, why not just put it in space, in the space data center, which gets free power and free cooling?
• 35:44
  Speaker 2: Is it going to happen tomorrow?
• 35:46
  Speaker 2: No, but I think it's super fun to talk about.
• 35:48
  Speaker 2: That.
• 35:51
  Speaker 2: All needs to be secured Now.
• 35:54
  Speaker 2: There's a lot of optical links.
• 35:55
  Speaker 2: Now all the space-based connectivity is optical in nature.
• 35:58
  Speaker 2: Amazon Kuiper is already doing 100 gig satellite to satellite, spacex is doing satellite to satellite.
• 36:05
  Speaker 2: Now how do you secure that?
• 36:06
  Speaker 2: I don't know To me.
• 36:09
  Speaker 2: Now, going back to complexity, look at the increased complexity there and now apply your cybersecurity frameworks to that.
• 36:17
  Speaker 2: Sorry, go ahead.
• 36:24
  Speaker 1: No, I was just sorry.
• 36:25
  Speaker 1: I had a really quick follow-up.
• 36:26
  Speaker 1: It brings up a lot of thoughts to my mind Now.
• 36:29
  Speaker 1: I haven't seen any mandates or frameworks around satellite security.
• 36:35
  Speaker 1: Yeah.
• 36:38
  Speaker 2: People are talking about.
• 36:39
  Speaker 2: I mean, within the satellite industry there's like a subgroup.
• 36:43
  Speaker 2: But again, going back to radio frequency communication, a lot of it has been and I think that, going back to your question about aviation and the lack of requirements, a lot of it's been security by obscurity and the fact that these things were, from an engineering perspective, very difficult to do.
• 36:59
  Speaker 2: But it's amazing to see how quickly it's gone from theory to active exploitation in the wild.
• 37:04
  Speaker 2: I'll give you another example that touches on space and security and even complexity is there's a company that's spun out of Google I don't know how to pronounce her name.
• 37:17
  Speaker 2: It's called Al Yara, but if you think you guys are familiar with SD-WAN, the capability of overlaying on top of multiple internet connections and all that.
• 37:27
  Speaker 2: So what this company does is they created something called like temporal space software to find networking, like they made up a really co-acronym.
• 37:36
  Speaker 2: Then their focus is on meshing, is on taking terrestrial fiber connectivity, terrestrial 5G-based connectivity, multiple satellite operator connections and creating a mesh network.
• 37:51
  Speaker 2: That is creating an overlaid mesh experience where, if satellites are blown out of the sky, if your network is cut, whatever your connectivity can move from one part to the other with no disruption at all.
• 38:07
  Speaker 2: To me, it's super cool.
• 38:08
  Speaker 2: It's something that we didn't even think we needed, but now, as these new options for connectivity become available, we're going to start using them Now.
• 38:18
  Speaker 2: We need a way to manage the complexity Now.
• 38:22
  Speaker 2: How do we ensure security?
• 38:24
  Speaker 2: How do we ensure security assurances?
• 38:25
  Speaker 2: As we go from platform to platform, I think there's always new problems to solve as we force ourselves.
• 38:33
  Speaker 2: It's almost like self-efforting prophecy New technology we never knew we needed it, but now that we see it, we want to use it, and so we're going to use it Now.
• 38:44
  Speaker 2: We just made our lives more complex and now we have to secure the more complex reality.
• 38:50
  Speaker 1: Yeah, yeah.
• 38:52
  Speaker 1: Well, we went down the rabbit hole of space.
• 38:54
  Speaker 1: We went down the rabbit hole of aviation.
• 38:57
  Speaker 1: We talked briefly on Cloud.
• 38:58
  Speaker 1: Obviously a part of you joining our podcast, obviously you're tapping into our audience and our viewership and our listener base.
• 39:09
  Speaker 1: Is there anything We'd like to obviously give you the platform here.
• 39:14
  Speaker 1: Is there anything that you feel like we didn't talk about that maybe you had on your mind?
• 39:23
  Speaker 2: Well, I would say, just going back to the comment about assumptions, don't assume anything.
• 39:27
  Speaker 2: A lot of people like to check the box around backups, disaster recovery and again, I think the most important thing that an organization can answer himself is do we have an appetite to take ownership and accountability of managing X, y and Z, of being responsible that we've set up our AWS account the right way and that we checked all the boxes?
• 39:48
  Speaker 2: Do we want to be on the hook?
• 39:49
  Speaker 2: Do we want to be on the hook to ensure that our disaster recovery configuration is working properly, or would we rather just sign a contract for it and hold a vendor accountable to an SLA?
• 40:00
  Speaker 2: And I think people don't realize.
• 40:01
  Speaker 2: When you think about managed services I think you guys have similar services is you're not buying bits and bytes or X amount of storage.
• 40:09
  Speaker 2: You're buying performance, like with Optinine.
• 40:13
  Speaker 2: You're entering into a contract that we are going to ensure that your disaster recovery infrastructure is up and running with the specified RTO of recovery time and that your data is no longer than X amount old.
• 40:25
  Speaker 2: And if we happen to be using the wrong hardware infrastructure on our side to get that job done, well then it's on us to spend any amount of time or any investments to ensure that we upgrade so that we're meeting the performance requirements of the contract.
• 40:42
  Speaker 2: And so the first question is what do we want our IT folks managing infrastructure and security and cloud and backups in DR or do we want them focused on adding value to the business?
• 40:54
  Speaker 2: That is super important.
• 40:56
  Speaker 2: By the way, I've worked with many very large organizations who totally have the technical capabilities and the teams to do all that, but they've made the conscious decision of we don't want to be on the hook for it.
• 41:07
  Speaker 2: We'd rather have a contract and sue someone to get to that, to be responsible for it.
• 41:11
  Speaker 2: And so I would say that to everybody.
• 41:14
  Speaker 2: Think about that and also think about the assumptions that you might be making of we're good because and then talk to a vendor Optinine is great at managed disaster recovery, backups, managing cloud, especially with what's going on with Broadcom and VMware right now.
• 41:31
  Speaker 2: I don't know if you guys are following that.
• 41:32
  Speaker 2: Yeah, yeah, it's a mess.
• 41:34
  Speaker 2: I know it's going to cause a ton of consolidation.
• 41:37
  Speaker 2: I mean that was a really good time If you were teetering.
• 41:42
  Speaker 2: Well, maybe should we keep running our own VMware.
• 41:44
  Speaker 2: Should we keep running our own hardware One of the cool things that Optinine does is we run managed VMware private clouds and so we can move your existing VMware-based infrastructure to keep it on VMware.
• 41:58
  Speaker 2: Our pricing is much better than what your renewals are coming in at Integrate to your existing network and adhere to your existing security framework so the best of both worlds.
• 42:08
  Speaker 2: So, yeah, those are interesting things I think to put out there for Optinine.
• 42:12
  Speaker 2: And then myself I'm involved there.
• 42:15
  Speaker 2: I'm also doing some consulting, so if there's anything I've mentioned that is interesting, feel free to hit me up.
• 42:20
  Speaker 2: But, as you can tell, I love to chat about these things.
• 42:22
  Speaker 1: Yeah, yeah.
• 42:24
  Speaker 1: Tell our listeners how they can reach you, how they can communicate with you.
• 42:27
  Speaker 1: What's the best means to make contact to you?
• 42:31
  Speaker 2: My personal website is 10forwardai number 10forwardai or find me on LinkedIn.
• 42:38
  Speaker 1: Yeah, we'll find it and we'll drop some links here in the description.
• 42:41
  Speaker 1: Awesome, I think that's all that I had, craig, any.
• 42:47
  Speaker 3: No, I think that was great.
• 42:48
  Speaker 3: So one last question I had on the Optinine Do you support most of the modern regulations?
• 42:57
  Speaker 3: I know you mentioned HIPAA compliance, assuming that maybe you're achieving or headed towards CMMC compliance.
• 43:05
  Speaker 3: Is there anything that you guys don't do or that you like in a certain regulation or vertical?
• 43:14
  Speaker 2: Yeah, I mean, is there anything we don't do?
• 43:15
  Speaker 2: Well, no, we do all of them.
• 43:21
  Speaker 2: If it's FedRAMP, that's the only one that's a real fun one to talk about.
• 43:24
  Speaker 2: But when we do FedRAMP, we like to partner with AWS, govcloud.
• 43:28
  Speaker 2: Besides that caveat, we do all the rest, and what we do and our strategy around compliance is we've taken our SOC2 audit and we've added all of the additional frameworks and we added a section that shows how we demonstrate how we comply with all those and we map them back to our SOC2.
• 43:48
  Speaker 2: And we also let the client know hey, for this specific regulation, this one's on you.
• 43:53
  Speaker 2: And so we are mapping to CMMC and to ITAR and CJIS and HIPAA and GDPR and probably 50 more.
• 44:05
  Speaker 1: I should make you both aware of this.
• 44:06
  Speaker 1: It's always so annoying for us, but I mean, we find some fun in it.
• 44:14
  Speaker 2: Yeah, I saw CMMC on your website and I thought that's like a super interesting one where it went, where it's heading and, to me, what's going to happen in the aviation industry from a sort of subcontractor perspective.
• 44:25
  Speaker 2: I think it's going to look very similar to what's going on with CMMC right now.
• 44:30
  Speaker 1: Yeah, cmmc is our bread and butter.
• 44:31
  Speaker 1: Craig and I are both CMMC certified.
• 44:34
  Speaker 1: I'm an RP, craig's an RP and we're an RPO, so that's kind of our bread and butter for sure.
• 44:42
  Speaker 1: Awesome.
• 44:44
  Speaker 2: Well, thanks for your time.
• 44:45
  Speaker 2: Thank you.
• 44:47
  Speaker 1: Yeah, thank you so much for coming on.
• 44:48
  Speaker 1: We appreciate the opportunity to speak to you and I'm sure we will definitely stay in touch and we'll definitely see you, probably likely in the future.
• 44:56
  Speaker 1: We will follow up and make sure that we check in on you and our listeners as well.
• 45:02
  Speaker 1: We'll ask you back for updates and, yeah, looking forward to doing that with you.
• 45:09
  Speaker 2: Awesome guys.
• 45:09
  Speaker 2: Thank you for the time.
• 45:10
  Speaker 2: Appreciate it, Thank you so much.
• 45:11
  Speaker 2: Thank you.